topic Re: Help try remove a trojan, Packed.generi.265 in Norton 360

Help try remove a trojan, Packed.generi.265

George55 — Sat, 13 Feb 2010 20:05:11 GMT

After about 20 years of using a computer I may have finally gotten a Virus/Malware.

Current version of Norton’s 360 is Version: 3.8.0.41

Norton’s reports 4 copies of a file called packed.generic.265. Trojan worm.

Norton’s states that removal failed and to rescan.

Pc running Win. XP service pack 2. Norton’s and Windows have all their updates.

I followed the instructions at Norton’s web site on how to remove these files, but with no luck. Norton’s finds no threats when following those instructions.

Norton’s instructions.

http://www.symantec.com/security_response/writeup.jsp?docid=2009-102022-2733-99

This is what I did, updates, turned off System Restore, Norton’s set to scan all files, and booted to safe mode. Ran scan and Norton’s found no threats.

I called Norton and asked what I was missing in their instructions on how to remove this malware but they wanted around $100 to help me.

Link to search results at Norton’s community

http://community.norton.com/t5/forums/searchpage/tab/message?location=Category%3Anis&q=packed.generic.265#message-list

I’ve also tried other free virus software to see if they could find or remove the problem, and again no luck

Malware bytes, and Super Anti spyware

Any help or suggestions would be appreciated.

Re: Help try remove a trojan, Packed.generi.265

boneidle — Sat, 13 Feb 2010 21:25:17 GMT

Have you thought of updating your XP to service pack 3 to get all their latest security updates.

Re: Help try remove a trojan, Packed.generi.265

floplot — Sat, 13 Feb 2010 22:05:38 GMT

Hello boneidle

He can't really update now until he gets his computer cleaned up first, but that would be a good idea one the o/p has a clean computer.

Re: Help try remove a trojan, Packed.generi.265

dallas_maverick — Sat, 13 Feb 2010 23:32:29 GMT

hello my friend,

let's ged rid of the pill taste :)

get : HIjack This

http://free.antivirus.com/hijackthis/

and MalwareBytes

http://www.malwarebytes.org/

so start your PC in safe mode, do a full system scan with MalwareBytes, restart your PC, Scan and save a log-file with HijackThis and post the log here.

Re: Help try remove a trojan, Packed.generi.265

floplot — Sat, 13 Feb 2010 23:40:13 GMT

Hello Dallas

The o/p already tried Malwarebytes and SuperAntiSpyware scans which didn't help.

Re: Help try remove a trojan, Packed.generi.265

dallas_maverick — Sat, 13 Feb 2010 23:44:26 GMT

let's see the HT log then :)

Re: Help try remove a trojan, Packed.generi.265

George55 — Sun, 14 Feb 2010 01:38:18 GMT

Thanks for you thoughts so far.

I did not run Malware bytes, and Super Anti spyware in safe mode. I ran them before but not in safe mode.

I will also get a log file and back with that as soon as possible.

Thanks again

Re: Help try remove a trojan, Packed.generi.265

George55 — Sun, 14 Feb 2010 01:47:13 GMT

Here is the log file from Hijack this.

Will report results of scan in safe mode tomorrow.

Thanks

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 8:42:53 PM, on 2/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\lxcecoms.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\George\My Documents\Downloads\Messenger\yhexbmes0322.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Documents and Settings\George\My Documents\Downloads\Messenger\yhexbmes0322.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.softpedia.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120335202000
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://66.28.45.60/Download_Plugin.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (Yahoo! MailTo) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0410.dll
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} - http://www.linksysfix.com/netcheck/45/install/gtdownls.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
O16 - DPF: {F621C77F-126F-4CA5-BC8B-2F64189E93A5} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/George/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 9353 bytes

Re: Help try remove a trojan, Packed.generi.265

George55 — Sun, 14 Feb 2010 01:51:36 GMT

Sorry I am running Win. XP service pack 3. Must have been done on a auto update from Microsoft some time in the past.

thanks

Re: Help try remove a trojan, Packed.generi.265

dallas_maverick — Sun, 14 Feb 2010 04:21:05 GMT

hi George,

now locate this entry with hijack this and fix it :

O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://66.28.45.60/Download_Plugin.exe

open registry editor (start > run > regedit)

locate this packed.generic.265 here,

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

or use the search option (F3) in regedit and look for keywords like "packed", "generic"

next step:

find in c:\windows\system32 and delete them

%System%\lowsec\user.ds
%System%\lowsec\local.ds
%System%\lowsec\user.ds.lll

now sit back, drink a coke and relax, your PC should be clean :)

Re: Help try remove a trojan, Packed.generi.265

Quads — Sun, 14 Feb 2010 04:52:49 GMT

dallas_maverick wrote:
hi George,

now locate this entry with hijack this and fix it :
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://66.28.45.60/Download_Plugin.exe

open registry editor (start > run > regedit)
locate this packed.generic.265 here,

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

or use the search option (F3) in regedit and look for keywords like "packed", "generic"

next step:
find in c:\windows\system32 and delete them

%System%\lowsec\user.ds
%System%\lowsec\local.ds
%System%\lowsec\user.ds.lll

now sit back, drink a coke and relax, your PC should be clean :)

It's easy to spot a novice

"or use the search option (F3) in regedit and look for keywords like "packed", "generic", ??

The name Norton gives a detection is not what the name of the files or the registry entries" Like Packed.Generic.200" which was for like the UAC variant of the TDL2 Rootkit, None of the Registry entries or Files had Packed Generic in the names. Lets alone that they were ultra hidden.

Or for a Trojan Horse, search in the registry for Trojan Horse.

I should install a Rogue AntiVirus on my PC the do a Registry search for Rogue AntiVirus.

It Just doesn't work like that, as Malware creators do not create Malware files etc. to match what Symantec (Norton) detects it as.

Quads

Re: Help try remove a trojan, Packed.generi.265

dallas_maverick — Sun, 14 Feb 2010 14:16:57 GMT

thanks for the record mate :) .. I admit it was kind of silly to suggest the search option, but I also mentioned the path where to look in. I know malware doesn't create a folder or a registry key with it's name, there would be no use for an antivirus anymore. Now let's see if our friend gets rid of it.

Re: Help try remove a trojan, Packed.generi.265

George55 — Sun, 14 Feb 2010 16:30:30 GMT

No guys I've not fixed the problem.

Hi Dallas

Do you know what I'm doing wrong when it comes to using the Norton web site steps to remove this malware?

I've seen the steps you suggest online, but could not figure the instructions out.

Is what your saying, is to open and run hijack scan, from the list of scanned results highlight the file (O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://66.28.45.60/Download_Plugin.exe)

Then clicvk on the fix button.

Next I open regedit, follow the path to the WINLOGON FOLDER, and when I do, I find 5 folders with even more sub folders. So where and what to do next? Then when I follow the hkey user path in regedit to the SHELL FOLDERS I find 24 folders. What to do then?

When trying the F3 search option in regedit I only find this, Col_Packed.

The files you say to delte in the Windows sub folder System 32, will these files look exactly like below?

%System%\lowsec\user.ds
%System%\lowsec\local.ds
%System%\lowsec\user.ds.lll

Thanks for you help so far

Re: Help try remove a trojan, Packed.generi.265

SendOfJive — Sun, 14 Feb 2010 19:41:13 GMT

Hi George55

Editing the registry, if you are not fully knowledgeable about what you are doing, can create many more problems if the wrong entries are removed. The Packed.Generic 265 detection is a heuristic detection of a packer that is associated with several families of malware - it is not an identification of a specific threat. Since no one here has supplied the name of the infection that they are providing removal instructions for, the recommendations to go poking around in your registry without giving you the exact keys to look for is ill-advised. Also, since we do not know the name of the malware, there is no way for you to research the infection and its remediation methods to assure that the advice you have been given is safe and effective.

You say that Norton and other scanners are now showing your system is clean? Since this is a heuristic detection it could have been a false positive. Or Norton may have removed the threat at some point. If you can find the files that Norton flagged (they may be in quarantine) you can submit them to Symantec for evaluation.

Re: Help try remove a trojan, Packed.generic.265

George55 — Sun, 14 Feb 2010 21:05:11 GMT

Thanks to the last person who replied. I know not to mess around in the registry. Norton's still finds the 4 copies of the file in normal mode but not in safe mode.

This is what Norton states as the details for each packed.generic.265 file found.

[lxceupld.exe] inside of [lxceupld.ex_] inside of [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc43.exe]

[lxceupld.exe] inside of [lxceupld.ex_] inside of [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc45.exe]

[lxceupld.exe] inside of [lxceupld.ex_] inside of [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc46.exe]

[lxceupld.exe] inside of [lxceupld.ex_] inside of [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc49.exe]

Re: Help try remove a trojan, Packed.generic.265

SendOfJive — Sun, 14 Feb 2010 21:39:08 GMT

Hi George55,

lxceupld.exe is a possible false positive. It is reported to be a Lexmark printer driver and this issue came up previously in this thread. However, the location seems highly suspicious. You can upload the file to VirusTotal to see if any other antivirus engines detect it as malicious. The c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc43.exe containing the lxeupld file could be malicious.

Re: Help try remove a trojan, Packed.generic.265

George55 — Sun, 14 Feb 2010 22:08:35 GMT

I saw the previous post here and on the web about this problem being associated with a lexmark printer driver. I do have a lexmark optra T610, and 4300 series, both are hardwired to this pc which is on a small 3 pc home network.

How do I find this file to upload. Do a windows search on all files and floders on all drives, and if found upload it virus total?

I did a search as mentioned above found these to files.

Should I upload these to Virus Total?

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32x86\lexmark_4300_series8a00

Re: Help try remove a trojan, Packed.generic.265

SendOfJive — Sun, 14 Feb 2010 22:12:56 GMT

Those are probably the legitimate Lexmark files. The c:recyclers file is the suspicious guy. Is is quarantined? I'm not sure if you can upload to VirusTotal from quarantine, but you can send it to Symantec from there.

Re: Help try remove a trojan, Packed.generic.265

George55 — Sun, 14 Feb 2010 23:26:53 GMT

I guess the windows search I did found the same file but in different locations, as shown in my last post.

I upload that file to Virus Total and scanned both copies. I have no idea what the results mean, Is this the result I'm looking for ? Result 0/41 (%). file uploaded was lxceupld.exe]

When Norton's scanned and found the four files in question, I then clicked on the name of the file and was able to choose the details tab, and that is where I found this, [lxceupld.exe] inside of [lxceupld.ex_] inside of [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc43.exe]

What is this? Is this giving me a list of files or a file and their location.? Is [c:recyclers-1-5-21-2190867815-3604470327-847386435-1006dc43.exe] a location and a file name? if so what is the location?

One copy of packed.generic.265 appears once in the quarantined list in Nortons.

When Nortons does a full scan it finds four copies of packed.generic.265

When it does a quick scan it finds nothing.

When it finds four copies on a full scan, is it just finding the same file/problem at different times, or is it four copies?

Sorry for confusion on my part in these post.

Thanks

Re: Help try remove a trojan, Packed.generic.265

delphinium — Mon, 15 Feb 2010 16:37:46 GMT

George55:

A quick scan only checks specific areas and will not find the same things that a full scan will find.

The RECYCLER folder is the recycle bin. The recycle bin on your desktop is simply a shortcut to all the RECYCLER folders in your computer. If you have a C:\ D:\ and E:\, your recycle bin shows the contents of C:\RECYCLER D:\RECYCLER and E:\RECYCLER. Having these RECYCLER folders on each drive saves the OS from having to copy a deleted file or folder from any other drive to the C:\ drive. http://forums.techguy.org/windows-xp/423576-recycler-folder.html

This link might also help you find the files to remove.

http://support.microsoft.com/kb/229041