Xp Virus - Help Appreciated

[poynton]

Hi.

I am running Windows XP SP2 with Panda AV Platinum - all up to date.

Panda has reported 2 incidents of W32/DMSPatch.A.

Both appear to be registry entries pointing to this file :-
c\windows\system32\dmserver.dll

After a scan, Panda puts the virus on report but does nothing else.
During use, the virus is intercepted by Panda (red info box in corner) and says it has been neutralised and quarentined. However, the file is still there and nothing appears in quarentine.

I cannot rename the file, delete it or anything else even though 1 site suggests replacing with a clean copy.

Panda website states that it should delete the file!

Anyone come across this ??
Anyone suggest anything (oher than get a Mac!)

Andy

[kelticwizard]

Boot into Safe Mode and try to delete it then?

Just a suggestion-sometimes it works.

Keep tapping F8 as soon as your machine comes on. That takes you to Safe Mode.

[poynton]

Originally posted by kelticwizard
Boot into Safe Mode and try to delete it then?

Just a suggestion-sometimes it works.

Keep tapping F8 as soon as your machine comes on. That takes you to Safe Mode.

Yep. Tried that !

I also tried going to the dos prompt and tried to reset the attributes/delete/rename. All I get is access denied.

Andy

[SVinzant]

Try taking a look at This link and this link.
Scott

[kelticwizard]

There are a lot of good computer people on here, but here are two sites which specialize in this sort of thing where I have gone successfully in the past.

aumha.net I have gone to many times. I am amazed at the lengths the people at aumha have gone to to help-realy detailed, step-by-step advice.

Castle Cops I have gone to only twice, but was quite pleased with the response.


www.aumha.net

www.castlcops.com

[theAnonymous1]

Is there a program in the add/remove programs list called Comet Cursor? If so, try uninstalling it.

http://www.pctoday.com/editorial/art...ID=25525&guid=

[es44]

Did you try Superantispyware ?
It's sometimes amazing what this little tool can do.

Best of luck.
Ebbe

[lineup]

there is a spray you can buy
you spray the pc outside
this will keep the virus away from your computer

Spybot Search & Destroy is a very good free program.
It is welknown.
Will search your PC and give you info and options to 'clean up'
http://www.spybot.com/

[ak_47_boy]

You need to delete the file. You can try killbox first. You will probably need to use MoveOnBoot if it is very stubborn. Then you can replace the DLL with one from an uninfected computer.

[poynton]

Hi.

I tried both suggestions.

with moveonboot, I got "access denied"

Killbox was also unsuccessful




Andy