[Neoptolemus]

Hi everyone!

Today, out of the blue, Sophos Anti-Virus started popping up messages informing me that C:\WINDOWS\Help\runwin.dll has been infected with 'Troj/Agent-DO', and that access to the infected file is denied. So far, all attempts at removing it have failed. I also tried going into safe mode, but it was still in use so I couldn't touch it.

I have tried Trojan Remover which didn't detect it, and my 30-day trial for The Cleaner has conveniently expired. I believe there is a program I could use called MoveOnBoot which will allow me to delete or rename any file I like, but I don't want to touch the file until I know it won't damage my installation of WinXP.

Could someone tell me if it is safe to remove this file, or if not, how I could possibly clean it? Heck, if you could just tell me what this trojan does I'd feel a little happier heh

[Advertisements]

I can sympathize...it is not a windows file, that is for certain....if you cannot delete it, something else is protecting it or it is in memory.

Can you see it in task manager, processes tab

ctrl-alt-del, processes

[gerryf]

I can sympathize...it is not a windows file, that is for certain....if you cannot delete it, something else is protecting it or it is in memory.

Can you see it in task manager, processes tab

ctrl-alt-del, processes