Removal instructions from XP (& probably 2000 & maybe Vista)

1. After rebooting, ASAP, before the tool loads, press [CTL-ATL-DEL] you may have to try a couple of times.

2. Select “Task Manager”,”Processes” tab,

3. Click on “Image Name” (to sort in ascending order)

4. There should be a process running that is 8 numbers and only numbers… Mine was 808561

5. Kill the process as noted above, and you now should have control of your system again.

6. Open control panel, “Add, Remove Programs”

7. Find and uninstall “DNA” (1 of 3 to be uninstalled and deleted)

8. Open windows explorer (show all files & folders)

9 Navigate to C:\Program files\

10. You need to have your “explorer”, “view” “detail” selected to see the time stamps. Then sort by modified date (Desc) (click on the date column to sort and again to reverse the sort order). Order the sort so that the most recently modified appear at the top for you.

11. 1 or 2 folders should appear on the top with the current dates of your infection. “DNA” with and “WINCAP..(something along these lines) Also look for any other added folders since the day and time of the infection. You can tell by the date stamp on them. If you know you didn’t install any programs on these recent dates:
delete them.

I found DNA (Security Tool Virus, with an executable file called BTDNA.exe, this is the virus program — and WINCAP (RPCAPD.exe). DNA is the Security Tool Virus and WINCAP is a trojan came along as a package deal with the DNA. You need to be sure to remove all the bad stuff. If you aren’t sure, look them both up

12. Be sure to have your “Explorer”, “Tools”,”Folder Options” “view” “Show Hidden Files & Folders” ON). Then go to c:/documents & settings/all users/application data as noted in other posts above and delete the folder with the 8 numbers for the name. Note: It will match the process that you killed to get here)

13. reboot … and you should be home free.

14. Delete all the files in your folders C:/Document & Settings//Local Settings/Temp
Find and delete: GDIPFONTCACHEV1.DAT
Scan your computer for all files dated at with time stamp from your infection date. Use
your judgement to delete them or not. If you are not comfortable with WINDOWS OS better
to not delete.

15. And if you are comfortable with checking your registry file.
Scan your registry file for BTDNA, the eight digit numerical name, WINCAP, and RPCAPD.
I found a bunch with the eight digit numerical name & BTDNA and deleted them. DNA appears
to be used for more than just a virus, so BE CAREFUL.

16. Empty your recycle bin. Run your antivirus.

17. If this doesn’t work, try booting in safe mode and restoring it.

Good Luck.