How do I get rid of this trojan/virus?

Question

It seems to get around every program I use- i think its even attacking the antivirus software. It won't let Microsoft Update install what it needs to get rid of it. I can' t delete it, move it, or anything - it's detected as read-only.

What was really annoying was that Zone Alarm was allowing hundreds of programs to hijack my computer, with that message next to it "Look how ZoneAlarm is protecting your computer!" Yeh. Right. It's also hijacked my top menu bar on explorer, so I can't see my address. Basically the controls are faded out.

I found the registry entries, but no antivirus will touch them! They are:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page
iemain:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL
ieabout:
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\SecurityRisk
and a few others.

Those are the exact infected registry entries. Is it okay to delete them manually using RGEDIT? Or is it a gamble?

Cheers

Answer 1

Anytime you go chopping around in your registry is a gamble.

If your machine is horribly infested, it might be faster to reformat and reinstall everything. You have backups of your music, right?

If you want to do it the hard way, here is the canonical method:

1) Set file view to "all files" nothing hidden.
2) Turn OFF restore points.
3) Install or update your A/V and anti-spyware software if you can.
4) Reboot into safe mode.
5) Run your A/V and antispyware software until they find nothing else.
6) Reboot.
7) Turn ON restore points.