I have had the same issues. Norton 2004 has no clue that it is in my system. I have done their remote scan, I have manually updated, everything says my system is clean in Norton...

Then I downloaded AVG, immediately it detects 2 Trojans: dowloader.lamedon.B and downloader.delf.2.AO

I tried to scan AVG in safemode, no luck, but the three times AVG has "healed" my computer the darn thing immeditatly tells me I have the lamedon virus again.

I have looked up all manual removal instructions for recent Trojans in both AVG and Norton, following Nortons was no help.

They system is not as cripled as it was before the AVG, but it is still not up and running. I am so mad cause I just got my new Mini IPod and I can't use it.

I too am experiencing exactly the same problem. Norton and p-cilin are unable to detect Lamedon.B. AGV does detect it and will clean but Lamedon.B reinstalls within minutes (this happens when both online and offline.

It appears in a file called dl.HTML which is located in the WINDOWS folder. I have deleted this file out of WINDOWS and trash probably 200 times. But, again, it reinstalls within minutes.

I ran the specific Lamedon.B scan from microtrend and this, too, was unable to detect it both when the dl.HTML file was in WINDOWS and after I had dewleted it.

I assume there must be a reinstaller buried deep within Windows somwwhere and would hugely appreciate any help or suggestions before resort to a sledge hammer to kill it!!!

I recently picked up this Trojan horse and believe that I have now removed it. I do not pretend to understand exactly what has worked.

I have a Win95 system, if that is relevant. AVG detected the Trojan horse, and said that it had cleaned it, but obviously it had not.

The only useful info about this Trojan horse that I could find on the internet was at Sophos (search for lamedon - throws up details of varieties A and F, which seem very similar to B) and Trend Micro (same search, and HTML_Lamedon.A info seemed the most relevant).

This info contains details of the various files and registry entries typically created by the Trojan horse. I just went through and deleted the files that I found that were mentioned (although many were simply not present).

For your information, the files I did find and delete/rename were dl.HTML and mstasks3.exe (both in Windows folder). The others, including the Registry entries, were not present. (If I had found them, I would have intended to delete other mstasks executables.)

But I believe the crucial piece of the jigsaw to be the file wintime.exe, that was in my Windows\System32 folder. I noticed that it was in the registry as running automatically each time Windows was started, and had a 'modified' date coinciding with the start of my problems with the Trojan Horse. I deleted this file and its reference in the Registry, and everything seems to be okay now (fingers crossed).

hello finaly i got a sulution taht worked for me.. the file named dl.HTML in windows what reaperes when u delete it can be removed i did it and it woked from me hope it wokes for u all to... now let me tell you how its easy just right click on the file select cut and then paste the file in c:\ then delete the file in c: and emty trash bin... that's all.. i think this works and don't realy know how but i think its something like this.. the file isin the wiindows regestry and got an auto backup function like important windows files and has high preority and cant be removed cause it always restores buy when u cut and paste it some other where it changes the regestry and sets it up to the new location and it wants to backup there but the reg file is linked to other files and they don't change cause they are not directly l9nked to the dl.HTML reg file just to the c.\windows\dl.HTML and theydont change and when they rty to restore the file the reg filr fot it that has been changed colides whit them and the whole process messes up and don't work so i think this will work try it it worked for me... :) have a nice day

hello i wrote earlier about taking the file away and i later found out that it don't work only for a while so i searched for a new idea and found out a way that will work for all... and almost easyer then the lastone... how to do... simply open wordpad and write the following text if u want you can just write whatever you want but i write this.. "i hate illegal trojans and som99 roxs" after that save the dokument and name it dl.HTML and sav it on the desctop after that cut the file and paste it to c:\windows and when it asks you to replace the infected dl.HTML just do it. now right click on it and click on propeties and now click on write protected and then ok now the file is write protected and the virust cant write a new dl.HTML if you don't know how to do email me and if you want my home made security patch that will be redy until monday just erite to me :) good night zzzzzzzzzz....

Thanks a lot som99! I've spend the last seven hours trying to find a solution. To everyone reading this, try som99's last solution, it works for me too. Once again, thanks big time, now I can finally go to sleep.

i also have had this problem with all the things you guys said but also i kept getting dl.HTML popping up as though it were a regulage web-page. this is despite having every pop-up stopper i could find all runnig at once (including, norton, yahoo, panicWARE, and ISP provided one and others) i tried som99's second method and it stopped the AVG message but dl.HTML still pops up if i leave my terminal for even 20mins i come back to over 20 of the windows with dl.HTML in them any help anyone can give for this second half of the problem would be great ~Tom

had that thing for 4 days...tried a number of things..what worked was updating the AVG database...the last one had been less that 14 days ago, but the current AVG finally worked..

I think the main problem was in the win file registery..don't know why I didn't delete that one

All Trojan horses are hidden files, in order to get at them you will need to go to the Files Option (click the View tab)at Control Panel and uncheck both the *Hide file extension for known file types & *Hide protected operating system files (Recommended)-boxes, then OK yourself out. Then you will need to restart your computer and go into SafeMode by HOLDING the F8 key DOWN -(at bootup - after the first screen info - be quick!) and choose SafeMode. [ You have to use your keyboard when you're in SafeMode - the keys to use are Ctrl/Alt/Delete (to exit the Help and Support screen) - Tab/Arrow keys/ Pageup/Pagedown/ the Window key(between Ctrl & Alt) & Enter] So, from the DeskTop screen press the Window key to get Start/ arrow up to Search/ arrow right to For Files or Folders and type up the NAME OF THE FILE & EXT (not horse.winshow.V) but the actual name of the file, which would have shown up on your anti-virus software. To delete this file from here just press Page Up to highlight the file and then delete. To get out of Search -Alt F/ arrow down to Close and press Enter. Press the Window key to shutdown and restart your computer.

It will be safe to empty your Recycle Bin in the Normal mode where you can use your mouse.

I have had 4 Trojan horses on my C drive and kinda figured out the above method a week ago. After unchecking the hidden files boxes I deleted the Temp file (as these keep putting the same files back into your system) from the _Restore folder , then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests!

PS. I also have AVG 6.0 (the free one) & also the Ad-aware 6 and I use them every day as my kids love to play games from the Internet.

I use windows98 and I removed the file system32 and after that everything as been ok. I haven't had any problems, but I'm not sure if someone else can get problems doing this remove of the file.

KN is right. The easiest way is to go to grisoft.com and download either the trial version or the freeware version of AVG and click updates. When you get the one most recently released... you'll be FREE AT LAST!...FREE AT LAST!...Thank GOD ALMIGHTY...YOU'LL BE FREE AT LAST!

I think I got this one figured out, as most do already, been dealing with this for a week. Somehow not only this one but 10 to 10 others were automatically downloading onto the machine. The firs AVG run I did on June 2nd and it got rid of 15 viruses, all from the night before. This Lamedon.B one was never removed. So I went through downloaded a bunch of stuff and kept trying. Bullguard, spybot S&D, CWSredder, Ad-aware, Stinger, and PestPatrol never seen this virus. I updated AVG and it caught another 15 viruses (all downloader's). Only one file could not be erased and that was the C:\WINDOWS\system32\wintime.exe I went in safe mode and manually deleted this. AVG says things are clean, now we just wait and see..

hello all again i write about this Trojan...people tells me that they get the avg window disappears when they does my solution but the start page in internet explorer wont change its still the same... i got a solution for that to :P that worked for me and hopefully for you all out there too... before doing this backup your internet explorer original exe ... now delete the explorer links on your desktop and system tray and start menu or wherever u got it but don't delete the original exe in the explorer folder... now make new shortcuts from the explorer file in the program folder to all those places then right click and click on properties and where it stands "C:\Program\Internet Explorer\IEXPLORE.EXE" or what it stands on your computer this is from my Swedish windows i am Swedish :P :)) in that line write after the " thing write an internet address for example

"C:\Program\Internet Explorer\IEXPLORE.EXE" www.Google.com and then click ok now every time you open that shortcut from explorer it opens Google.com and this works for me.

Had that nasty Trojan downloader winshow. It was detected by AVG but AVG was unable to delete it. I disabled wnxp home restore and tried all the forum suggestions including running AVG in dos mode...I tried about every AV shareware but the virus was recognized only by AVG....very frustrating...AVG would clean all the Trojan installed files except one...and a host of othe exe files would propagate every time after restart. I ended up getting out the WINXP install CD and reinstalling windows completely..finally, no more virii.

This virus is a one of the most annoying I have ever tried to delete. For my computer, the file was dl.HTML. First if you have the up-to-date version of Norton AntiVirus 2004 then simply use its Quarantine feature and hold the file in Quarantine that should take care of it. To do this simply right click on the file/s and then scan with Norton it will say delete failed or something similar. Then when the quarantine tab comes up leave the file ticked and click finish.