topic Re: Can not remove Trojan Domcom in Operating System - Microsoft

Can not remove Trojan Domcom

Joe van Raamt — Fri, 27 May 2005 15:03:29 GMT

I tried to follow all the steps proided by symantec, but when I got to the "run" part of the registry, I did not see the file "loader32" = "%AppData%\Sysdown\sys[5 random numbers].exe" in the right hand column. Neither any of the HKEY_Clas _Root subkeys. I will post the Norton help file

Re: Can not remove Trojan Domcom

Joe van Raamt — Fri, 27 May 2005 15:04:50 GMT

the Norton File attached

Re: Can not remove Trojan Domcom

Joe van Raamt — Fri, 27 May 2005 15:09:00 GMT

HJT log attached after rescan with Norton.

Re: Can not remove Trojan Domcom

Pat — Sat, 28 May 2005 12:02:27 GMT

Try running Trojan Scan - It's free

http://www.windowsecurity.com/trojanscan/

Did you delete your temporary internet files?

Try doing this in Safe Mode:

Start>Control Panel>Internet Options>Delete Files
Next, Search for *.tmp
Delete all items found
If a message appears in use, click OK

Look for

Command32.exe

loader32 sys*****.exe [***** = random digit] It's added by the DOMCOM TROJAN!

It's a Startup Program and not a Task Manager Process

Pat

Re: Can not remove Trojan Domcom

Joe van Raamt — Sat, 28 May 2005 17:30:47 GMT

Thank you for your patience Pat. last night I finally got a clear scan with Norton. I can not remember exactly what I did, but it worked.
I did use that a sqaured scan you recommended, and it found three more additional mal-ware items(not serious stuff).
I appreciate all the help I get from all forum members.

Re: Can not remove Trojan Domcom

Pat — Sat, 28 May 2005 18:31:36 GMT

You're quite welcome. Glad to hear your scan was clean. Good luck.

Pat