Thread: Help on an unknown virus!!

In article <ApednTgIxN72sz7YnZ2dnUVZ_oernZ2d@comcast.com>, chuck@nospamland.com
says...
>
>I found that there are a lot of winxx.exe, e.g. win2.exe, win3.exe,
>replicating in my "\Document and Settings\<user name>\Local Settings\Temp"
>folder. One of them is active. But I cannot see it in Task Manager.
>Therefore I cannot kill it. Together there is a LgSyz.dll. It is in use. I
>cannot kill it at all.
>
>My anti-virus program cannot kill it. I researched on the Internet and could
>not find a solution either.
>
>Could you help me kill this vrius? Thanks for your help.
>
************ REPLY SEPARATER ************
In order to delete any file, you must first stop it from executing. This may be
as simple as starting in safe mode, or stopping the particular program or
service from running in the task manager. If (and I say IF) you are able to
delete all occurrences of the file (including the DLL), your system may then
produce an error on boot-up because it cannot find the file, or the file may be
reproducing itself using a short program (like a batch file) to copy itself
from another file of a different name or over the Internet. Consequently, when
you are attempting to repair your system, always disconnect from the Internet.

The nature of the error produced on boot-up will determine the next step.

J.A. Coutts

This sample is detected as Trojan-Downloader.Win32.Small.czl by kapersky
antivirus you may want to try that scanner



"chuck" <chuck@nospamland.com> wrote in message
news:ApednTgIxN72sz7YnZ2dnUVZ_oernZ2d@comcast.com. ..
>I found that there are a lot of winxx.exe, e.g. win2.exe, win3.exe,
>replicating in my "\Document and Settings\<user name>\Local Settings\Temp"
>folder. One of them is active. But I cannot see it in Task Manager.
>Therefore I cannot kill it. Together there is a LgSyz.dll. It is in use. I
>cannot kill it at all.
>
> My anti-virus program cannot kill it. I researched on the Internet and
> could not find a solution either.
>
> Could you help me kill this vrius? Thanks for your help.
>