Win32: Trojano-461 [Trj]

please help.

avast home edition found this virus in c:\documents and settings\aaron kale\local settings. edition 4.1,vps8.10.2004.
windows xp home, broadband cable, netscape and internet explorer.
can not delete, repair, or move. message -"process cannot acess the file because it is being used by another process.
warning reappears after every restart.
i’ve disabled system restore,scanned, etc.
i’ve tried virus cleaner, no sucess.
thanks.

Disable system restore and run a boottime scan. See if that solves it.

Eddy,
I tried that and still have the virus found warning.

Hi, welcome to the forums.

You didn’t give the full path to the infected file in your first post, but from the limited path (and gueswork) it would appear that the file is in your temporary internet files. Without the full path and filename this is just a guess.

Clear your browser/s cache and check again.

It’s in local settings\temp\cvsw.dat file

Hi 30yrheel:
Run Disk Cleanup
Go to: Start/Programs/Accessories/System Tools/Disk Cleanup
and get rid of your temporary files.

good news, i guess-

o.k., i deleted all temp files, ran another boot time scan, chose “move all” this time since delete didn’t work before. Restarted, got a message said windows “couldn’t find something? security.exe”, but the virus warning was gone.
i guess i’ll see how it goes from here.

thanks

The message you are getting is very likely caused by a entry in the registry that still is trying to load the infected file which you have removed. Please post a HijackThis log here and let us have a look.

You cna find HJT (along with a log analyzer) on the page in my signature.

30yrheel
(security.exe) is a part of the virus that’s been removed. Apparently there is still something that tries to load the non existen file. Most likely in the files being loaded at startup.
You can go HERE and download a small progam called Startup Monitor.