norat and fo(o) are in c:\windows\system folder. According to
Zonealarm To infect a machine, the trojan copies itself to %System%\Winerdir.exe before dropping two DLL files. These file have been identified as:
%System%\foõ.exe (26,112 bytes) and %System%\norat.exe (1,536 bytes).
I can't find the "winerdir.exe" file
I've run adaware and it also did not detect the virus
edit:
After running avast! Virus Cleaner
"avast! Virus Cleaner Tool - version 1.0.207 Ansi
Creating log file: C:\MY DOWNLOADS\aswclnr.log
4/28/05, 9:22:56 AM
Memory scanning started...
No virus body found in memory.
Memory scanning finished (82.8s).
----------
Files scanning started...
No virus body found.
Files scanning finished (73223 files, 0 infected, 891.4s).
Drives scanned: C:"
----------