virus
 

Norton Anti-Virus identified the virus Download.Trojan at C:\Windows\System\880uicbv5l.dll but cannot remove it. I can't find it by using Windows Explorer.
Any help is appreciated.
regards,
Mark

The file may be hidden...
Do you have Windows Explorer configured to show Hidden Files?
Open Windows Explorer and at the top click:
TOOLS / FOLDER OPTIONS / VIEW / SHOW HIDDEN FILES & FOLDERS

Also while your in there, UNCHECK the "Hide extensions of known file types" and the "Hide protected Operating System files"

You should be able to find 880uicbv5l.dll after that.

After you delete it. You can revert back the settings you changed above.

The trojan might deny you access of deleting it, if it does, youll have to use REGEDIT or a similar program to delete it.

No not REGEDIT.

Reboot to Safe Mode with Command Prompt and delete it.

Hit F8 several times immediately after turning on the computer to get to the Windows Advanced Options Menu.

Are you sure that you spelled that right?

http://securityresponse.symantec.com/avcenter/venc/data/download.trojan.html

Link to symantic website, includes removal instructions.

What he said!

The reason I ask about the spelling is that a google search for 880uicbv5l.dll doesn't return anything.

Symantec is the company that sells the norton antivirus that you say you are using and a search at that website doesn't find 880uicbv5l.dll either. There is an entry for Download.Trojan at Symantec, that is what I linked to above.

What did you find out? Did you get it fixed?

Use Grisoft AVG Anti-virus Free Edition, might work for you.

I found the virus is in C:\Windows\System32\880uicbv5L.DLL. Re-booted in Safe Mode, but cannot remove with Windows Explorer; get this message: "Cannot delete 880uicbv5L.DLL. Access is denied. Make sure the disk is not full or write protected and that the file is not currently in use."

Also downloaded Grisoft AVG which finds the same virus but cannot remove or quarrantine it either.

What's next anyone?

Mark

run msconfig and either uncheck all the startup items that are not common system startup or check the box that says selective startup. Then restart in safe mode again.

This will make it so that the virus does not run when you turn on you computer. So, since it is not running you will be able to delete it in windows explorer after you find it again.

Please tell me how to run msconfig.
Mark

click "Start"

then click "Run"

next type in "msconfig"

click "ok"

then go over to the "startup" tab at the top and uncheck everything that is not common startup. Next click "apply" and then "ok"

Finally restart your computer in safe-mode once again and find the virus in windows explorer again and try to delete it.

NOT Safe Mode.
Safe Mode with COMMAND PROMPT. It looks like old DOS. There is no Windows Explorer.

but, if he is using windows XP or 2000 there is not an option to restart in a command prompt. In fact, Im not sure how he is starting in "safe-mode"

What Operating System are you running?

How did you get into safe mode? (Did you use the "control" key or the "F8" key?)

I run XP Professional; and get to the Safe mode with the F8key. MSconfig did not work. However, Grisoft was able to move it to a virus vault, and now a scan with Norton Antivirus dosen't pick it up. Hope it stays there.
Thanks,
Mark