View Full Version : Dg.14.exe Packed.Adware


Speechless Two
27th November 2005, 00:44
I am confused by this one. Norton AntiVirus has picked up a threat during the scan tonight. It says that "The file G:\RECYCLERS\S-1-5-21-515967899-436374069-839522115-1003\Dg14.exe is a Adware threat".

It won't let itself be deleted or quarantined by NAV and I cannot find the file to manually delete it. As well as NAV, I run Spybot, AdAware, and the Microsoft AntiSpyware Beta. None of those threw up an alert.

I looked at the Geeks-to-go Forums and one guy there has masses of these Dg. files found by Panda and the advice to him was that they needn't worry him. I don't like the thought of a rogue .exe file floating around though.

Symantec reference Dg14.exe under Packed.Adware (updated November 2004) but the page is next to useless in helping me get rid of this. I can't send it to Symantec as I can't quarantine it.

Out of my depth here guys - any ideas?



Background Noise
27th November 2005, 09:39
Looks like its in the recycle bin. You should be able to find it by opening the recycle bin or you could empty the recycle bin.

The recycle bin folder eg. G:\recycler is usually a hidden folder so to see it in a folder list you have to select 'show hidden files and folders' from the Tools, Options, View tab from any explorer window.

BOAC
27th November 2005, 09:55
This from MS: (http://support.microsoft.com/kb/136517/EN-US/)

"D<original drive letter of file><#>.<original extension>
Examples:
New file name:

Dc1.txt = (C drive, second file deleted, a .txt file)

INFO file path:

C: \Windows\Desktop\Books.txt

New file name:

De7.doc = (E drive, eighth file deleted, a .doc file)

INFO file path:

E: \Winword\Letter to Rosemary.doc "

This only applies to NTFS systems and does NOT appear to 'name ' the file so it is not 'searchable' - it looks like the 14th (exe) file deleted from the G drive?

Adaware 'help' also warns that as it runs, it decompresses quarantined files whcih can trigger an 'alert', and offers a solution but says there is 'no threat'

Speechless Two
27th November 2005, 13:04
Many thanks for both those replies. Found that the source is Adware.GamesSpyArcade and it looks as though this came from a deleted demo of the Wings at War game that I ran from an old magazine CD.

Anyway, I deleted everything in the Recycle Bin that came from the G: drive (my programs partition) and a new Norton scan has just completed without throwing up an alert so I'm very grateful to you two for your posts.