Help with Trojan Horse

[jerry]

I have Windows XP Home edition and am running with Norton Antivirus 2003 Professional. I run the full system scan and it locates a Trojan Horse in C:\Windows\DNSErr.dll file. I have completed every action that Norton suggests for removing this Trojan and nothing works. I have booted in SAFE Mode and deleted the file and as soon as I reboot into Normal mode the file is back. When I try to delete the file it says it is not accessable. I booted in SAFE mode as the Administrator and deleted the file DNSErr.dll and then reboot into normal mode and the file is back. I have looked in the registry and don't find anything in there that even resembles this file. Any suggestions????????????

Thanks in advance for your help

Jerry

[brad]

Try going to the registry (Back it up first) and deleting these entries:
HKEY_CLASSES_ROOT\clsid\{1e1b2879-88ff-11d2-8d96-d7acac95951f}
HKEY_LOCAL_MACHINE\clsid\{1e1b2879-88ff-11d2-8d96-d7acac95951f}
Now boot in safe mode and check for the DNSERR.dll and delete if present.
brad

[jerry]

Brad,
I have looked the registry through and I don't find either of the entries that you noted.

I went to the Trend-Micro site and ran their online scan and it did not locate any virus or Trojan on my computer. I also went out and downloaded the A.T.S. (Anti Trojan Shield) program. This program is directed primarily at finding and blocking and/or removing Trojan Horses. I ran the scan in this program several times and it did not find any signs of a Trojan on my computer.

Can it be that Norton is just seeing something that is giving it a false result???????????

Thanks for your assistance - Jerry

[brad]

Could be... Norton may have eliminated it also.
brad

[jerry]

[Gecko]

According to SpywareInfo DNSErr.dll is a Browser Helper Object and a hijacker.
You need to download and install

When you run HiJackThis look for the entry below and remove it:

X {1E1B2879-88FF-11D2-8D96-D7ACAC95951F}: DNSErr.dll -

Also look for anything else that refers to DNSErr.dll

[jerry]

Hello Gecko - I went out and loaded HijackThis and ran the scan and it did not find anything like you listed and did not find anything that even looked like DNSErr.dll. I opened windows brouser and hilighted the file and right clicked and asked it to scan with Hijack and it did not find a thing. I went into safe mode and deleted the file but when I re-booted into normal mode the file is back. Any other suggestions???????????

Thanks in advance for your help


Jerry

[jerry]

Gecko,,,,,,,,,,,,,,I went to the SpywareInfo site and searched for information about Trojans and located their repair tool CWShredder and ran it on my computer and WOW it is FIXED!!!!!!!!!!!!!!!!!!! Thank you so very much for providing that information to me. It was the CoolWebSearch trojan and altho HijackThis did not find it the information was there at their site concerning the DNSErr.dll file.

Again thanks - this site is awesome!!!!!!!!!!!!!!!!!!!!!!!!!!

Jerry

[Aaron]

glad everyone but me was able to help you. seriously though, I would suggest getting XP pro. its so much better than home.

[jerry]

Thanks Aaron for your additional comments. I guess I have a couple of questions for you on this suggestion. Can you give me a little information concerning the advantages of XP Pro over Home and secondly, would you do an upgrade or do a clean installation of the new software???? And if your answer is a new clean installation I am not sure I would know how to do that process.

Thanks

Jerry

[Restek]

No point re-inventing the wheel - here's microsofts list of the differences:
http://www.microsoft.com/windowsxp/pro/ ... osing2.asp

Let us know if you have any questions about that page