trojan problem

Norton just downloaded the latest refresh with LiveUpdate and
immediately flagged a file called wincvs0.dll as a backdoor trojan,
couldn't quarantine, couldn't repair and couldn't delete. Upon
reboot, it's now detecting a file called wincvs1.dll and wincvs0 has
disappeared. It behaves as above with no delete possible. Norton
"knowledge base" doesn't show anything about that file and a search on
the internet doesn't reveal anything about any file called "wincvs".
a search of the registry finds it in 2 places under userkey. In one
location it is listed along with several other files that were
downloaded off the internet and at the other location it is listed at
HKEY_USERS\S-1-5-21-336809978-847386435-1484400983-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll
with the entries:
Name: a
Type REG_SZ
Data: C:\WINDOWS\wincvs1.dll

and
Name: MRUList
Type: REG_SZ
Data: a

Anybody know what is going on and how to delete this beastie? Any
suggestions??
thanks,
bumblebee

Bumblebee,

I did a search using www.groups.google.com on the keyword "wincvs" and had
14,300 hits. You might want to give it another try and review the results.

--
Sir_George


"bumblebee" <nospamoldchevy.RemoveThis@rock.com> wrote in message
news:ekpcp0l41k1kou4ik2d3dnho6k5up1sfri@4ax.com...
> Norton just downloaded the latest refresh with LiveUpdate and
> immediately flagged a file called wincvs0.dll as a backdoor trojan,
> couldn't quarantine, couldn't repair and couldn't delete. Upon
> reboot, it's now detecting a file called wincvs1.dll and wincvs0 has
> disappeared. It behaves as above with no delete possible. Norton
> "knowledge base" doesn't show anything about that file and a search on
> the internet doesn't reveal anything about any file called "wincvs".
> a search of the registry finds it in 2 places under userkey. In one
> location it is listed along with several other files that were
> downloaded off the internet and at the other location it is listed at
>
HKEY_USERS\S-1-5-21-336809978-847386435-1484400983-1005\Software\Microsoft\W
indows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll
> with the entries:
> Name: a
> Type REG_SZ
> Data: C:\WINDOWS\wincvs1.dll
>
> and
> Name: MRUList
> Type: REG_SZ
> Data: a
>
> Anybody know what is going on and how to delete this beastie? Any
> suggestions??
> thanks,
> bumblebee
>