Can not remove Trojan Domcom

[Joe van Raamt]

I tried to follow all the steps proided by symantec, but when I got to the "run" part of the registry, I did not see the file "loader32" = "%AppData%\Sysdown\sys[5 random numbers].exe" in the right hand column. Neither any of the HKEY_Clas _Root subkeys. I will post the Norton help file

[Joe van Raamt]

the Norton File attached

[Joe van Raamt]

HJT log attached after rescan with Norton.

[Pat · Accepted solution]

Try running Trojan Scan - It's free

http://www.windowsecurity.com/trojanscan/

Did you delete your temporary internet files?

Try doing this in Safe Mode:

Start>Control Panel>Internet Options>Delete Files
Next, Search for *.tmp
Delete all items found
If a message appears in use, click OK

Look for

Command32.exe

loader32 sys*****.exe [***** = random digit] It's added by the DOMCOM TROJAN!

It's a Startup Program and not a Task Manager Process

Pat

[Joe van Raamt]

Thank you for your patience Pat. last night I finally got a clear scan with Norton. I can not remember exactly what I did, but it worked.
I did use that a sqaured scan you recommended, and it found three more additional mal-ware items(not serious stuff).
I appreciate all the help I get from all forum members.

[Pat]

You're quite welcome. Glad to hear your scan was clean. Good luck.

Pat