Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

What to do when Nortons cannot delete a file?

Feb 17, 2005 9:31AM PST

I ran a scan and I had 1 file detected as an adware threat. I deleted it but it said it failed. I restarted my computer and ran a 2nd scan. Now 2 files we detected, I then tried to delete and it failed again. I know a lot of trojans multiply after restarts so I assume that is what happened.

Here is my question. I then ran a scan in Ad-Aware and Spybot Search and Destroy and deleted everything that came up (had 6 files in Ad-Aware and none in Spybot. I ran Ad-Aware first.) I then ran Nortons again and the same 2 files came up and they could not be deleted.

I then restarted again and ran Nortons Scan and the same 2 came back (it didn't multiply this time.) BTW I cleared my cookies and Cache since the time I rebooted. I clicked on the Threat Name in Nortons and it took me to their site. I followed their instructions for removal. I went into the registry (I have some experience with deleting things in there, I got rid of DSO Exploit this way by myself, lol I took pride in it for a newbie.) And when I follow the tabs/paths in the registry to get to the keys they say to delete, I get to the end and those files arent in the folders they say they are.

Did I get rid of them in Ad-Aware? Are the Adware files still on my computer somewehre? I wish I could give you the names and stuff, but I am at work and don't have them with me. I will paste them on here when I get home.

Any help or advice? Thanks.

Discussion is locked

- Collapse -
Hi phattferd
Feb 17, 2005 9:42AM PST

The name and the path would sure help but you could try the scan again in Safe Mode. Many things can get deleted that way. Your operating system, would help too. Directions for safe mode are here.

- Collapse -
oops, forgot the link
Feb 17, 2005 9:44AM PST
- Collapse -
Thanks
Feb 17, 2005 10:12AM PST

I have Windows XP SP2.

I will try that when I get home in a couple hours.

- Collapse -
OK, Good luck and if it doesn't work
Feb 17, 2005 10:31AM PST

find out the name and exact location if you can. I'm leaving for the day but I'll be back in the morning or someone else can jump in.

- Collapse -
Here are the Threat Names...
Feb 17, 2005 11:38AM PST

Adware.CDT

And these are the file names:

7B2BC44Dd01
7B2BC44Dd01

- Collapse -
I haven't left yet. LOL
Feb 17, 2005 11:45AM PST

Here are the directions from Norton for removal of it which also includes using BOTH safe mode and going into the registry. Just do everything in the same order as Symantec says in the link. They give full directions including how to backup the registry.
http://sarc.com/avcenter/venc/data/adware.cdt.html

- Collapse -
I followed that earlier today and that was my main question.
Feb 17, 2005 12:44PM PST

When I followed that when I got to the "domain" in the tabs within the registry the files they say to delete or keys to delte werent in there.

Anyway something is strange. I ran a scan before I left for work and 2 files popped up as being harmful...then I went to work didn't have time for anything. Got home booted my computer into safe mode like you said ran Nortons and no threats...so I booted it back into normal boot and ran Nortons and no threats.

I didn't do anything since I last ran it to this time and the files went away? Is this the case or is it smart and hiding?

- Collapse -
Try doing an online
Feb 17, 2005 7:32PM PST
- Collapse -
(NT) (NT) Put a checkmark in "autoclean" on the first one.
Feb 17, 2005 7:34PM PST
- Collapse -
Ya I ran housecall last night, 1 more thing...
Feb 18, 2005 3:25AM PST

thanks for the help I appreciate it. Housecall came back clean...I just was wonderig what you meant by going back in system restore. Should I go back to a restore date and scan the computer? or go into the registry then and delete the files?

I am naive in things, dont feel bad to tell me anything. I would just assume that if I got rid of it now (when I got it, I scan almost every day when I go to sleep and look at it when I wake up) then I would just assume its ok on past dates. Would a virus go back in time and mess with things?

Thanks again Roddy you have been great.

- Collapse -
Windows XP creates a restore point
Feb 18, 2005 3:47AM PST

for every 24 hours that the computer is on so, very possibly there is a copy of the virus in System Restore so you should disable it, which clears it out and then reenable it and create a new one. This way, if you ever had to go back to a restore point for whatever reason, you won't bring the virus back. I'm not going to say you're welcome until we know it's fixed LOL. Here are the directions for doing what I just told you about and don't even feel naive, we are all here to help each other.
http://www.pchell.com/virus/systemrestore.shtml

- Collapse -
OK I turned off System Restore what next
Feb 18, 2005 4:10AM PST

I turned it off. According to that page you sent me it says to now delete the virus. Well according to Nortons there is no virus now. Do I just go on now and assume the virus is gone? Do I turn system restore back on?

Is there something else I need to do? Thanks.

- Collapse -
Yes, just turn it back on now and
Feb 18, 2005 4:19AM PST

Go ahead and do your scans again after you turn it back on. Hopefully you are clean now.

- Collapse -
Thanks Roddy!!!
Feb 18, 2005 4:31AM PST

Nothing has popped up in Norton's since last night after doing every test you haev suggested. I am going to say its safe to say everything is gone (knock on wood), thanks for the help.

- Collapse -
(NT) (NT) You're welcome, glad we could help.
Feb 18, 2005 4:56AM PST