Deltree Trojan Virus Help

Discussion in 'Computer Information' started by Jon, Nov 2, 2003.

  1. Jon

    Jon Guest

    I have Windows 98 and Norton Anti-virus 2001 installed.

    I have a problem when trying to remove a Deltree Trojan virus using
    Norton. It locates the virus in the file C:\Image\Drive\Drive.000 but
    is unable to repair it, quarantine it or delete it which leaves my
    computer still infected.

    I have checked on the Symantec site and it refers to Scandisk creates
    a DIR000 folder that deltree cannot delete.

    Any help would be greatly appreciated. I have no idea of the programme
    that uses this image file. Is it safe to purely delete it?

    My Norton recovery disk is out of date although it should contain
    protection against this virus. Does anybody have any knowledge of this
    virus and what it actually does?

    Jon

    Jon, Nov 2, 2003
    #1
    1. Advertising

  2. Jon

    HF Guest

    Get a virus like AVG Go to www.grisoft.com Free AND IT WORKS!!!!
    "Jon" <> wrote in message
    news:...
    > I have Windows 98 and Norton Anti-virus 2001 installed.
    >
    > I have a problem when trying to remove a Deltree Trojan virus using
    > Norton. It locates the virus in the file C:\Image\Drive\Drive.000 but
    > is unable to repair it, quarantine it or delete it which leaves my
    > computer still infected.
    >
    > I have checked on the Symantec site and it refers to Scandisk creates
    > a DIR000 folder that deltree cannot delete.
    >
    > Any help would be greatly appreciated. I have no idea of the programme
    > that uses this image file. Is it safe to purely delete it?
    >
    > My Norton recovery disk is out of date although it should contain
    > protection against this virus. Does anybody have any knowledge of this
    > virus and what it actually does?
    >
    > Jon
    >
    >
    HF, Nov 2, 2003
    #2
    1. Advertising

  3. Jon

    Oldus Fartus Guest

    In news:,
    Jon <> wrote these words:

    | I have Windows 98 and Norton Anti-virus 2001 installed.
    |
    | I have a problem when trying to remove a Deltree Trojan virus using
    | Norton. It locates the virus in the file C:\Image\Drive\Drive.000 but
    | is unable to repair it, quarantine it or delete it which leaves my
    | computer still infected.
    |
    | I have checked on the Symantec site and it refers to Scandisk creates
    | a DIR000 folder that deltree cannot delete.
    |
    | Any help would be greatly appreciated. I have no idea of the programme
    | that uses this image file. Is it safe to purely delete it?
    |
    | My Norton recovery disk is out of date although it should contain
    | protection against this virus. Does anybody have any knowledge of this
    | virus and what it actually does?
    |
    | Jon
    |
    |

    It is a relatively old trojan which is quite easy to clean. Basically
    it puts the lines "deltree c: /y" into an infected machines AUTOEXEC.BAT
    file so that when an infected computer is started DELTREE is run and
    delete all files from C:
    Look for those lines in your AUTOEXEC.BAT file, and if they are in
    there, delete them.

    I suspect C:\Image\Drive\Drive.000 may be part of a "go-back" type of
    program similar to Windows System Restore so it should be possible to
    temporarily disable it, delete the folders, then re-enable it and create
    a new restore point. The only similarity with Scandisk DIR000 files
    would seem to be the 000 part of the name.

    --
    Cheers
    Oldus Fartus
    Oldus Fartus, Nov 2, 2003
    #3
  4. Jon

    Jon Guest

    On Sun, 2 Nov 2003 22:01:12 +0800, "Oldus Fartus"
    <> wrote:

    >In news:,
    >Jon <> wrote these words:
    >
    >| I have Windows 98 and Norton Anti-virus 2001 installed.
    >|
    >| I have a problem when trying to remove a Deltree Trojan virus using
    >| Norton. It locates the virus in the file C:\Image\Drive\Drive.000 but
    >| is unable to repair it, quarantine it or delete it which leaves my
    >| computer still infected.
    >|
    >| I have checked on the Symantec site and it refers to Scandisk creates
    >| a DIR000 folder that deltree cannot delete.
    >|
    >| Any help would be greatly appreciated. I have no idea of the programme
    >| that uses this image file. Is it safe to purely delete it?
    >|
    >| My Norton recovery disk is out of date although it should contain
    >| protection against this virus. Does anybody have any knowledge of this
    >| virus and what it actually does?
    >|
    >| Jon
    >|
    >|
    >
    >It is a relatively old trojan which is quite easy to clean. Basically
    >it puts the lines "deltree c: /y" into an infected machines AUTOEXEC.BAT
    >file so that when an infected computer is started DELTREE is run and
    >delete all files from C:
    >Look for those lines in your AUTOEXEC.BAT file, and if they are in
    >there, delete them.
    >
    >I suspect C:\Image\Drive\Drive.000 may be part of a "go-back" type of
    >program similar to Windows System Restore so it should be possible to
    >temporarily disable it, delete the folders, then re-enable it and create
    >a new restore point. The only similarity with Scandisk DIR000 files
    >would seem to be the 000 part of the name.


    Many thanks for your help. I have checked my C drive and can find no
    references to deltree c: /y in the autoexec.bat files.

    Having said that I am something of a novice when it comes to sorting
    our problems like this. Can you confirm how I can actually access the
    autoexec.bat files to see the lines?

    Also will it be ok purely to delete the Drive.000 file. As I said I am
    not too sure where I can find replacements!!

    Thanks again and I apologise for my ignorance

    Jon
    Jon, Nov 2, 2003
    #4
  5. Jon

    Oldus Fartus Guest

    In news:,
    Jon <> wrote these words:

    | On Sun, 2 Nov 2003 22:01:12 +0800, "Oldus Fartus"
    | <> wrote:
    |
    || In news:,
    || Jon <> wrote these words:
    ||
    ||| I have Windows 98 and Norton Anti-virus 2001 installed.
    |||
    ||| I have a problem when trying to remove a Deltree Trojan virus using
    ||| Norton. It locates the virus in the file C:\Image\Drive\Drive.000
    ||| but is unable to repair it, quarantine it or delete it which leaves
    ||| my computer still infected.
    |||
    ||| I have checked on the Symantec site and it refers to Scandisk
    ||| creates a DIR000 folder that deltree cannot delete.
    |||
    ||| Any help would be greatly appreciated. I have no idea of the
    ||| programme that uses this image file. Is it safe to purely delete it?
    |||
    ||| My Norton recovery disk is out of date although it should contain
    ||| protection against this virus. Does anybody have any knowledge of
    ||| this virus and what it actually does?
    |||
    ||| Jon
    |||
    |||
    ||
    || It is a relatively old trojan which is quite easy to clean.
    || Basically it puts the lines "deltree c: /y" into an infected
    || machines AUTOEXEC.BAT file so that when an infected computer is
    || started DELTREE is run and delete all files from C:
    || Look for those lines in your AUTOEXEC.BAT file, and if they are in
    || there, delete them.
    ||
    || I suspect C:\Image\Drive\Drive.000 may be part of a "go-back" type of
    || program similar to Windows System Restore so it should be possible to
    || temporarily disable it, delete the folders, then re-enable it and
    || create a new restore point. The only similarity with Scandisk
    || DIR000 files would seem to be the 000 part of the name.
    |
    | Many thanks for your help. I have checked my C drive and can find no
    | references to deltree c: /y in the autoexec.bat files.
    |
    | Having said that I am something of a novice when it comes to sorting
    | our problems like this. Can you confirm how I can actually access the
    | autoexec.bat files to see the lines?
    |

    I would be surprised if the lines are actually in your autoexec.bat
    file, simply because you are able to start and run the computer, which
    would not have been possible had the trojan actually ran.

    Just to check though, try opening a DOS window, and make sure the prompt
    is showing C:\ and then type (less quotes) "edit autoexec.bat"
    Depending on your operating system you will either get a message that
    the file is not found, or the edit program will open your autoexec.bat
    file ready for editing. If the lines are in there, then delete them,
    and then click on the save option and close the window.

    | Also will it be ok purely to delete the Drive.000 file. As I said I am
    | not too sure where I can find replacements!!
    |

    If I am correct, and the folder is setup by Norton GoBack, then you may
    have to disable that program from running first. Restart, and then
    delete the folder, and then re-enable Norton GoBack. Do a full virus
    scan. After yet another restart, open up GoBack and create a new restore
    point.

    Perhaps another reader who uses Norton Utilities may be able to comment?

    | Thanks again and I apologise for my ignorance
    |

    You are welcome Jon.

    --
    Cheers
    Oldus Fartus
    Oldus Fartus, Nov 3, 2003
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Thumper

    Deltree?

    Thumper, Nov 16, 2003, in forum: Computer Support
    Replies:
    1
    Views:
    608
    °Mike°
    Nov 16, 2003
  2. DannyD1355

    Deltree?DOS in Win XP

    DannyD1355, Nov 19, 2003, in forum: Computer Support
    Replies:
    7
    Views:
    3,345
    °Mike°
    Nov 20, 2003
  3. Maria

    W98 deltree - howto?

    Maria, Nov 15, 2006, in forum: Computer Support
    Replies:
    7
    Views:
    413
    Maria
    Nov 20, 2006
  4. Lawrence D'Oliveiro

    Re: Deltree program that runs in a DOS like system

    Lawrence D'Oliveiro, Apr 25, 2009, in forum: NZ Computing
    Replies:
    2
    Views:
    340
    Jack Spratt
    Apr 25, 2009
  5. Woger
    Replies:
    2
    Views:
    344
    Craig Sutton
    Apr 25, 2009
Loading...

Share This Page