Trojan bokja.exe (Home SP1)

[Ram]

MORE BACKGROUND: Haven't yet installed SP2; auto update attempt on Friday failed.

THE PROBLEM: This morning, the weekly Norton AV scan picked up the subject intruder. The Notification message, under "Action Taken" noted the following: 'Clean failed. Delete failed: Access denied'.

I located the file in C:Windows and tried to delete it directly. It failed noting the following: 'Access denied. Make sure disk is not full or write protected and file is not currently in use'.

I ran Pest Patrol, Spybot and Adaware to no avail.

Any suggestions?

[HansV]

1. Stop Bokja.exe running for the moment.

Press Ctrl+Alt+Del to start the Task Manager.
Activate the Processes tab.
Locate and select Bokja.exe.
Click 'End Process'.
See if you can delete Bokja.exe now.

2. Stop it from running automatically.

Select Start | Run...
Type regedit and press Enter.
Navigate to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionRun
Delete any entry that contains Bokja.exe.
Do the same in HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVe rsionRun

3. If you failed to delete the file above:

Start Windows in safe mode (press F8 while the PC starts)
Try to delete the file now.

[DocWatson]

It sounds like you need to download and run HiJack This. and have the pros at Tom Cyote's forum analize your log. But....You also mentioned that you ran PestPatrol and came up empty. Take a look here and see if it has any relevance to your situation. Since you already have PestPatrol installed this might be worth a try first.

HTH <img src=/S/smile.gif border=0 alt=smile width=15 height=15>

Edited to add Guess Hans beat me to it !! <img src=/S/smile.gif border=0 alt=smile width=15 height=15>

[HansV]

But your link provides more complete instructions!

[DocWatson]

Speed vs. Quality.... an age old conundrum. <img src=/S/yep.gif border=0 alt=yep width=15 height=15> You gave him an answer. I gave him a direction to a possible answer.

Anyway, thanks for the props (that is the latest word for support and encouragement, isn't it ??) <img src=/S/smile.gif border=0 alt=smile width=15 height=15>

[Ram]

Many thanx for the suggestions. I tried Hans' suggestions first and it worked like a charm. I ran the AV program 3 times since and the bug has not reappeared.

Hans/Doc, I really appreciate all the help I have received from you and your colleagues since discovering the lounge two years ago.

Be well and happy.