Re: Cannot remove virus

From: Stuart Reed (sr_at_stureed.co.uk)
Date: 04/29/05 

Date: Fri, 29 Apr 2005 17:32:41 GMT

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%23Oxk7CMTFHA.2676@TK2MSFTNGP10.phx.gbl...
> From: "Stuart Reed" <sr@stureed.co.uk>
>
> | Hi David
> |
> | Thanks for your help but there was a problem with Sysclean: I couldn't
> | download a missing file LPT$VPN.*
> |
> | Stuart
>
> Stuart:
>
> You didn't follow the directions proprly in "Trend Sysclean Method 1" so
follow the
> directions in "Trend Sysclean Method 2" as that simplifies the
downloading and execution
> process.
>
> In addition, I have come up with the following alternate method of
removing this infector...
>
> 1) Dump the contents of the IE Temporary Internet Folder cache (TIF)
> Start --> Settings --> Control Panel --> Internet Options -->
Delete Files
>
> Dump the contents of the Mozilla FireFox Cache
> Tools --> Options --> Privacy --> Cache --> Clear
>
> 2) Disable System Restore
> http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
>
> 3) Download Pocket KillBox
> http://www.bleepingcomputer.com/files/spyware/KillBox.zip
>
> Extract killbox.exe from the ZIP file.
> Execute; KillBox.exe
>
> Click on Tools --> Select; Delete Temp Files.
>
> Choose; OK
>
> In the Full Path of File to Delete box, type the entire following
line exactly
>
> C:\Windows\REGIST~\cabplay.dll
>
> Select; Replace on Reboot
>
> put a check in the box "Use Dummy"
>
> Click The Red circle and a white X
>
> When prompted to Replace on Reboot, click YES
>
> If prompted to Reboot Now, Click YES
>
> Allow the PC to shutdown
>
> 4) Reboot your PC into Safe Mode and shutdown as many applications as
possible.
> 5) Using your NAV software, perform a Full Scan of your platform and
clean/delete any
> infectors found
> 6) Restart your PC and perform a "final" Full Scan of your platform
> 7) Re-enable System Restore and re-apply any System Restore
preferences,
> (e.g. HD space to use suggested 400 ~ 600MB),
> 8) Reboot your PC.
> 9) Create a new Restore point
>
> * * * Please report back your results * * *
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm

Hi David

I did try to follow your instructions to the letter, but there are a couple
of points I didn't mention:

First, I don't have Mozilla FireFox installed and my System Restore is
always off because I have Norton GoBack installed.

I tried to install Sysclean again but had the same problem.

I downloaded KillBox and did a scan but the trojan is still there.

Thanks again for your patience.
Stuart

Relevant Pages

  • Re: Browser goes to unwanted page when invalid web address is entered.
    ... >Download, UPDATE before running, and run: ... >You will need to disable System Restore and then reboot ... >programs report as spyware. ... >install malware) Keep it UPDATED. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: i need help deleting programs
    ... even if you install the so-called spyware free versions, ... start by turning OFF the System Restore function.. ... You will also need to download Spyware removal software.. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Help with highjack please
    ... > Before you try to remove spyware using any of the programs below, download ... > The process of removing certain malware may kill your internet connection. ... > malware garbage from your System Restore backups after you've cleaned up. ... > install malware) Keep it UPDATED. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: which updates?
    ... Given how much trouble it is to download SP3, would I do better right now to ... I hope that doesn't mean it's planning to install ... doing a System Restore and trying again sometime next week? ...
    (microsoft.public.windowsupdate)
  • Re: ads234?
    ... > Before you try to remove spyware using any of the programs below, download ... > The process of removing certain malware may kill your internet connection. ... > malware garbage from your System Restore backups after you've cleaned up. ... > install malware) Keep it UPDATED. ...
    (microsoft.public.security.virus)