Member Avatar for Asiweb

I'm new here by the way. System is Win XP SP1

1. So far i have used Norton to run a full comp scan and Quarantiine
the following:
Trojan.Metajuan filename:A0058208.dll
Trojan Horse filename:A0058205.dll
Trojan Horse filename:A0058201.dll
Trojan.Zlob filename:A0046057.exe

All of the above files were found in the System Volume information folder. So i Turned off System Restore and now all previous restore points are deleted. I was hoping that everytime i updated norton that it would have the necessary files to fix these files that i have in quarantine, but it didn't. My question is what can i do to get rid of them, or should i wait on Norton's future updates.

2. Why does Norton choose to "Leave Alone" the threats that are found in Expanded Threats? Should i set Norton to first delete files that it finds when it is set to scan expanded threats?

3. When Winxp starts, it always shows a DLL error message
it says : Error loading
C:\WINNT\System32\ypyovicr.dll The specified module could not be found.

What can be done to fix this and stop the error messages.

As a side note i did run AVG right after i turned off System Restore.


Thanks for your help, i appreciate it. I hope i posted this correctly, ;)

  • 3 Contributors
  • 4 Replies
  • 391 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

Quick summary and first steps (you’ve already done the right first move). Turning off System Restore removes the restore‑point copies that live in the hidden System Volume Information store, so infections there won’t come back from a restore point once SR is disabled — that’s why you saw those trojans in that folder. Immediately disconnect the PC from the network, copy only personal files (documents, photos) to external media and scan those backups from a clean machine before reusing them. (learn.microsoft.com)

About Norton showing “Leave Alone” for expanded threats: that action is typically a log/deny option used for unproven or in‑use items (it doesn’t delete a file by design). You can change Norton’s scan action to quarantine/delete for confirmed malware, but take care with system files; if a detection is in the System Volume Information area or the file is locked by a running process, an offline/bootable scanner is needed to remove it reliably. Relying on a future LiveUpdate alone isn’t guaranteed for a deeply compromised SP1 machine.

That startup DLL error almost always means a leftover startup entry (registry Run value, scheduled task or startup shortcut) points to a DLL that no longer exists. Use Sysinternals Autoruns (run as admin) or msconfig to find and remove the entry; back up the registry before making edits. Note: Safe Mode uses the basic VGA driver and a very low resolution, so the “huge” UI is normal while troubleshooting there. If you can’t remove the run entry in normal mode, disable networking, boot Safe Mode, run Autoruns and uncheck/delete the offending entry, then reboot. (learn.microsoft.com)

If multiple offline scanners (for example Malwarebytes + a reputable rescue disk) still can’t restore system stability, back up user data and perform a clean reinstall — that’s the fastest way to be certain the system is clean. Also note Windows XP is no longer supported by Microsoft (no security updates after 2014), so plan to migrate to a supported OS or at least install SP3 and keep the machine air‑gapped if you must keep XP. Recommended next tools/readings: Malwarebytes for cleaning and a vendor rescue disk for offline scans; search vendor support pages for current rescue‑disk instructions before creating media. (malwarebytes.com)

Notes tied to thread: — disabling SR was correct; — move off SP1 (SP2/SP3 is better) and — when cleanup fails the clean install route is the pragmatic, guaranteed fix.

Recommended Answers

All 4 Replies

Member Avatar for jbennet

Um, why are you running xp sp1?

Its full of holes so viruses can get back in very quickly after you try to remove them...

Member Avatar for Asiweb

Hello, i'm in the process of changing to WINXP SP2 because i haven't used this Comp in a long time. i just wanted to clean my system of infections first and then back it up.

So far i ran A-squared in safe mode and i'm about to run spybot Search and Destroy in safe mode but i want to do something about the error message i keep getting when i start Win XP it

says: Error loading c:\WINNT\System31\ypyovicr.dll . It says this DLL could not be found.

I did delete some infected files in the past so that might have something to do with it.

And also when i go in safe mode the SCREEN is so HUGE!! i can't even see the full display of a menu screen to select some options.
Is there a way to fix this?

And if by chance someone know where i can get Windows Backup Utility so i can back up my system before installing Win XP SP2 Please let me know.
Thanks i really appreciate it.

Member Avatar for dr4g

I recommend formatting your hard drive and installing XP SP2 from fresh.

If you're on a machine with SP1 and you're getting numerous infections, good chances are you're not going to get rid of them, especially running Norton.

Secondly, the virii were found in the System Volume Information section.
As far as i'm aware, this is related to the System >Restore< directory.
Thus if you have infections in your restore directory, you're always going to be infected no matter how many times you restore the machine..

Conclusion.....
Wipe the damn thing, it seems riddled as it is. and start from fresh, if you have documents..etc upload them to a public FTP or email them to yourself.
backup utils will probably backup virii too. ;)

Member Avatar for jbennet

yes, the only way to remove viruses from system vol. information is to turn system restore off (deletes all restore points!!!!) and reboot then scan

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.