Trojan Virus

[Lord]

I've used adaware and I found 3 folders that have the virus in it. How do I restart in safe mode? And what does f3 do?

[johnny]

Press F8 when windows is starting up, you can then start in the safe mode. Once you found the file your looking for, press F3, it will show you any files related to the one you found. There might not be any, but you never know if you don't try.

[Lord]

According to SpyBot and Adaware, the only infected file left is:
HKEY_LOCAL_MACHINE\software\comet systems\

I keep removing it using spybot, but it keeps coming back each time I scan. Is this the file I want to delete when using RegEdit in safe mode?

[johnny]

If that's what Spybot came up with, yes, that's the one you wanna kill.

[Marikai]

If you ever incounter virus probs, goto:

www.sarc.com

And do searches. Thats Symantec Antivirus Research Center [img]smile.gif[/img]

[Lord]

ARG! This isn't working. This is what I've done so far:
1. Used Adaware: 3 infected files found.
2. Downloaded Spybot: 69 infected files found. 'Fix selected problems.' All of them are 'fixed.'
3. Scan again just to be safe. 1 infected file named:
Comet Cursors: Program Settings
HKEY_LOCAL_MACHINE\Software\Comet Systems
4. I use 'fix selected problems' on that too. But it's still coming back each time I scan.
5. Turn off computer. Enter safe mode, run spybot, remove the infected file.
6. Turn off computer. Enter in normal mode, scan usng spybot. Infected file remains.
7. Turn off computer. Enter safe mode, run spybot, see the infected file is still there. I didn't remove it this time. I hit start-->run-->RegEdit.
8. Go to Comet Systems and delete it.
9. Scan using spybot in safe mode. Infected file not found.
10. Turn off computer. Enter in normal mode, scan using spybot. The same infected file is back!

How the hell do I remove this goddamn trojan? I've been trying to remove it since around 6 PM yeseterday, with only a 10 or so hour break of rest and other stuff in between!

[Ilander]

ummm...I'm reluctant to mention it to you, but have you tried erasing the thing? Not DELETING, mind you, erasing. That means deleting the thing and make random data passes over it's corpse, rendering it genuinely dead...I use a program called Eraser 53, which you should be able to find on Download.com, or someplace like that fairly easily...

[Lord]

Originally posted by Ilander: ummm...I'm reluctant to mention it to you, but have you tried erasing the thing? Not DELETING, mind you, erasing. That means deleting the thing and make random data passes over it's corpse, rendering it genuinely dead...I use a program called Eraser 53, which you should be able to find on Download.com, or someplace like that fairly easily...

Just how do I do that? Use the program, I mean.

BTW, the AIM thing started opening on its own again, attempting to enter in that away message again .

[philip]

It's also possible windows somehow restores it. That was a problem I was encountering sometimes. If you uncheck the system restore somewhere in your settings/configuration-system. For me it's in there but I probably can't translate it correctly so you have to search anyway

[Lord]

1 problem down, 2 to go!
I got rid of the infected file. It turns out that I was only deleting 1 of the 2 files I needed to delete, but I finally got that done. So, what are the 2 problems that are left?
First of all, AIM still keeps opening up on its own and putting up an away message. It used to say "hey check this out" and then give the link listed above. Ever since I deleted the file, it now says 'new profile' and then gives the link. How do I stop this away message problem from coming up? I can't stand using my computer and having it come up every minute. It's happening to me as I'm writing this, too.
Also, ever since I got the trojan, Norton Antivirus hasn't been working correctly. Under 'Email Scanning' it says error. I have the boxes for it checked. I tried unchecking and rechecking it, but it still says error. The help said to try restarting my computer, but that didn't help. How do I fix this?