how to remove this virus:?

Question

this virus keeps on coming back in my pc everytime i log in
and not just in one file but in different files

norton says that the virus name is W32.Rontokbro.X@mm
norton always says that it was automatically deleted
but another norton pops up if i click ok until about a hundred of clicks or more

everytime i use my pc it appears again, i tried scanning my pc with avg but it cant find the virus

can anyone help me remove this virus from my pc?

Answer 1

W32.Rontokbro.X@mm is a mass-mailing worm that lowers security settings and causes system instability.

Follow the remove instructions here
http://www.symantec.com/security_response/writeup.jsp?docid=2006-032415-3832-99&tabid=3

Do an online virus scan to check if you still have any other viruses in your computer. And let us know if the online virus scan still finds any virus or spyware .

Answer 2

2

Answer 3

This is a mass mailing Worm. It is installed by a Downloader Trojan. This Trojan hides in areas of your computer that is not scanned in normal mode. When Nortons removes the Worm, the Trojan download it again. Get the idea? Both the Worm and the Trojan must be removed.

This procedure and the ewido program will remove the Trojan. Use the Norton to remove the Worm.

Download and Update Ewido (now called the AVG Antispyware). Do not run:

http://www.ewido.net/en/download/

TEMPORARILY SHOW HIDDEN FILES AND FOLDERS.

1. Click Start, and then click Control Panel.

2. Click Appearance and Themes, and then click Folder Options.

3. On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.

IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


EMPTY INTERNET EXPLORER BROWSER CACHE:

1. On the Internet Explorer Tools menu, click Internet Options.

2. On the General tab, in the Temporary Internet Files section, click the Delete Files button. Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK. Click OK again.

RESTART IN SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



START THE SCAN WITH YOUR PROGRAM(S). Run both programs consecutivly.



When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode.

RESET HIDDEN FILES AND FOLDERS.

The RESTORE POINTS may be infected with the Malware and cannot be used. Delete the old one(s) and make a new one.

CLEAR OLD RESTORE POINT(S). HERE'S HOW:

1. Click Start, and then click Control Panel.

2. Click Performance and Maintenance, click System, and then click on the System Restore tab.

3. Select the Turn Off System Restore check box, click Apply, then restart your computer.

4. Return to the System Restore Tab and turn System Restore back on.


TO SET A NEW RESTORE POINT:

1. Click the Start button.

2. Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3. Choose Create a restore point, and then click Next.

4. In the Restore point description box, type a name for your restore point, and then click Next.

5. Click OK.

NOTE: If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the box. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.

Answer 4

Norton's just pain,it doesn't do what it is supposed to do.it is a waiste of HDD space and money. go download prevx and your troubles are over, guaranteed. it checks all your programs with their data base and will not let any program like you are talking about or any other run on your computer. it is a trial but is a full program and removes the problems. click on the red download on the screen. read what the pages have to say. you'll be amazed at it. semantic program are the same as Norton and also will slow your system down. i get all the semantic programs free and aren't any good. you'll get alot of people claiming this and that about the other programs, but until they try the real ones they'll never know. before i used to go to some of the hacker sites and didn't matter where i was, I'd get a Trojan or virus. none of those other program these people are talking about would do crap, but prevx DOES!!!!

Answer 5

Scan the PC with a standard antivirus. I think that you have to download a standard antivirus software. . I have come across a website that gives a brief study on computer viruses and their removal. It is very useful.I recommend that you go through this study and download a free software or a better software by making a payment. Please visit
http://jskproducts.co.uk/antivirus.htm
You also try to select and install a suitable anti spy ware from the following link to protect the Pc against spyware attacks.
http://www.jskproducts.co.uk/spyware.htm

Answer 6

Hey, I got hit by this virus a few months before. it affected many files. My is detected by McAfee, but I think Symantec can do a better job. The result, it modify my OS that I have to reformat my PC.

if you hit by W32.Rontokbro.X@mm. it will affect many files as what you did. I only have 25 clicks of pop-up once

it came from Attactment. worse, the sender address is spoofed.

after you remove this files, either the virus is not completely destroyed or it open holes for further damagae like my.

this virus have special trick which disable you from burning-in(CD) and using removable drive (thumb drive)

this virus don't stay at C:\document and setting\user\... but it go directly to your OS files.

My advise is backup your files, it could get worse and prepare to reformat your PC as I don't think any Firewall or Anti-virus will help when this virus already enter your system does damage to your OS.

The one who understand this virus is not the Firewall, AV company but the one who got hit by it.

Answer 7

There's no warranty. It is dependent upon whether or not kaspersky's virus definition already includes the trojan you could have. There is NO anti-virus application that may entirely shield you from viruses. The trouble is that anti-virus is regularly at the back of the virus. They can not shield in opposition to it till they recognize approximately it. Try kaspersky. If it does not paintings, you can have got to uninstall and check out an extra one till you uncover an anti-virus that is aware of approximately the trojan you could have.

Answer 8

Norton Removal Instructions
http://www.symantec.com/security_response/writeup.jsp?docid=2005-092311-2608-99&tabid=3

Other Removal Instructions (since Norton sucks donkey balls)
http://www.2-spyware.com/remove-rontokbro.html

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FRONTOKBRO%2EB&VSect=Sn (includes Automatic and Manual removal)

Answer 9

Do a online scan from the link below in safe mode.

Answer 10

Removal instructions: http://www.precisesecurity.com/computer-virus/avwrx-mar039.htm