Forum Home
Press F1
 
Thread ID: 104911 2009-11-12 11:03:00 Help removing virus infection? (Kido/Conficker I think) Agent_24 (57) Press F1
Post ID Timestamp Content User
829522 2009-11-12 11:03:00 I have a separate install of windows XP on a different drive specifically for the new Entropia Universe game.

Since I need to upgrade to run the game properly and I haven't yet, I used nLite to remove as much of XP as I could and then I didn't install anything except drivers to keep RAM usage down as much as possible

Now, by way of an infected USB drive I forgot to clean first, I have infected it with Conficker I believe.


I thought I had removed it, I removed all the files, and registry entries but I still can't change the "show hidden files" option to actually show hidden files.


I have since installed the latest Avast! beta and also scanned the drive offline with Comodo and ClamAV and Nod32 web scanner, they all came up clean.

I thought it was just a registry entry I hadn't seen BUT it would seem that something is changing it back every time. Which is disturbing because nothing I scan with seems to detect anything
Agent_24 (57)
829523 2009-11-12 19:44:00 Well I haven't used this but you could try:

www.bdtools.net

also, more here:

www.bleepingcomputer.com
zqwerty (97)
829524 2009-11-12 19:54:00 Disable system restore, see if this removes it (www.symantec.com) Speedy Gonzales (78)
829525 2009-11-13 00:15:00 System restore was already disabled,

I have deleted the dll from system32 but something keeps changing registry entries

I cannot view hidden files no matter what :(
Agent_24 (57)
829526 2009-11-13 00:19:00 So, did you try that removal tool? Speedy Gonzales (78)
829527 2009-11-13 02:09:00 Tried the Bitdefender one, it just said there is nothing there.

I am running the Symantec one now
Agent_24 (57)
829528 2009-11-13 08:45:00 May not even be conflicker.

Check this reg key out - Click Start/Run type in regedit Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

Find a key called CheckedValue.

Double Click CheckedValue key and modify it to 1. (This is to show all the hidden files.)

If that doesn't work, have a look at These suggestions (www.technize.com) the one above is also listed. You may need to alter other reg keys, or re-register certain files.
wainuitech (129)
1