Fjerning av trojan.domcom

[erlendhagen]

hei!

Eg har Norton Internet Security 2003 insallert, oppdatert med siste definisjoner, etc.

 

Antivirusprogrammet finner på systemsøk to infiserte filer i ei .ie5 mappe under temporary internet files. Antivirusprogrammet klarer ikkje å slette filene.

 

For det første klarer eg ikkje å finne denne mappa sjølv, hverken gjennom windows utforsker eller dos ledetekst. (Har ikkje forsøkt å starte opp i DOS). (Eg har som mappealternativ at alle filer skal vises.)

 

For det andre så ser eg på internett at eg må slå av automatisk systemgjenoppretting, og så kjøre antivirusprogrammet. Dette gjer ingen forskjell for meg. Filene blir ikkje sletta.

 

Har nokon et tips til meg?

 

Takk, Erlend

[Alastor]

Star opp i sikkerhetsmodus og scan på nytt. F8 under oppstart, før winxp logoen dukker opp.

[erlendhagen]

Takk skal du ha!

Skal prøve når eg kjem heim i dag.

[b21a]

Kanskje litt enklere hvis du har oppskriften

 

 

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1.Disable System Restore (Windows Me/XP).

2.Update the virus definitions.

3.Run a full system scan and delete all the files detected as Trojan.Domcom.

4.Delete any values added to the registry.

 

4. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

 

Click Start > Run.

Type regedit

Click OK.

 

 

Navigate to the subkey:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

 

In the right pane, delete the value:

 

"loader32 " = "%AppData%\SysDown\sys[5 random numbers].exe"

 

 

Navigate to and delete the following registry subkeys:

 

HKEY_CLASS_ROOT\CLSID\{031B6D43-CBC4-46A5-8E46-CF8B407C1A33}

HKEY_CLASS_ROOT\TypeLib\{4A31E565-08CB-4272-8817-7BF729B6A96F}

HKEY_CLASS_ROOT\Interface\{CC1725CD-1EFA-4D88-8987-5EBF66347856}

HKEY_CLASS_ROOT\DownCom.CDownCom.1

HKEY_CLASS_ROOT\DownCom.CDownCom

 

 

Exit the Registry Editor.

[erlendhagen]

Kanskje litt enklere hvis du har oppskriften

 

 

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1.Disable System Restore (Windows Me/XP).

2.Update the virus definitions.

3.Run a full system scan and delete all the files detected as Trojan.Domcom.

4.Delete any values added to the registry.

 

4. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

 

Click Start > Run.

Type regedit

Click OK.

 

 

Navigate to the subkey:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

 

In the right pane, delete the value:

 

"loader32 " = "%AppData%\SysDown\sys[5 random numbers].exe"

 

 

Navigate to and delete the following registry subkeys:

 

HKEY_CLASS_ROOT\CLSID\{031B6D43-CBC4-46A5-8E46-CF8B407C1A33}

HKEY_CLASS_ROOT\TypeLib\{4A31E565-08CB-4272-8817-7BF729B6A96F}

HKEY_CLASS_ROOT\Interface\{CC1725CD-1EFA-4D88-8987-5EBF66347856}

HKEY_CLASS_ROOT\DownCom.CDownCom.1

HKEY_CLASS_ROOT\DownCom.CDownCom

 

 

Exit the Registry Editor.

Det er det eg har skreve i min første post: Denne fremgangsmåten har ingen virkning. Filene blir ikkje sletta.

[b21a]

Hmmmmm, fant disse forslagene til deg med et søk på google:

---------------------------------------------------------------------------

Norton makes a backup copy of any files (trojans) removed. They still show up as being in the system even though they were removed. Delete them from the backup folder.

 

May 27, 2005 20:53:24 GMT N/A: Question Author

sorry to ask a dumb question, but where do I find this backup log in Norton? I tried to find it through 'search", but nothing came up.

Pat

May 27, 2005 21:01:38 GMT 6 pts

I believe you have to look into Report then click on the Quarantined Items. That should show a list of backup items kept. Right click on each and delete (or hold down CNTRL to delete several).

When prompted by a warning re: removal, click on Yes

Close Norton

Pat

----------------------------------------------------------------------------

Run Trojan Scan (http://www.windowsecurity.com/trojanscan/). It's free and often detects and cleans trojans better than most antivirus software.

 

If that doesn't do it, download, install, immediately update and then run Spybot (http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10289035.html?tag=lst-0-1) and Ad-Aware (http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button).

 

Norton and other AV programs may detect some spyware as a trojan but, since it's spyware, can't clean it.

---------------------------------------------------------------------------

Ville også ha søkt etter filen: sys*.exe, ligger den i en folder som heter SysDown ville jeg ha slettet den.

 

Håper noe av dette hjelper, ikke noe er så irriterende som SW.

[erlendhagen]

Takk for responsen. Jobber overtid, så eg rekk ikkje gjere noko før seint i kveld eller i morgon kveld.