Trouble, please help

[Frank]

Hi group,
yesterday I contracted what appears to be a virus that MS
AntiSpyware Beta1 identifies as agobot.spoolsrv32(trojan).
The location is listed as
hkey_current_user\software\microsoft\windows\c...
I have run both quick and detailed searches and have tried
removing and quaranteneing(sic). The MS program tells me it
has sucessfully removed the spyware however it still
remains after many tries. Further, a pop-up window on the
lower right of the screen that originates from the small
yellow triangular sign with an exclamation point in the
center states : Warning: your computer is at risk. Spyware
detected. Windows did not find spyware protection, click
here to choose software.
I have also run Spybot and Norton antivirus to no avail.
Any help would be gratly appreciated. Thank you.

 

[Andre Da Costa]

Your Antivirus solution is more likely to find it that AntiSpyware, I would
recommend updating your Norton Antivirus Definitions, restart in safe mode
and run a scan with it. Remember to disable system restore before enter safe
mode. Right click My Computer > Properties > check "Turn Off System Restore

OK. Restart the system in to safe mode. The reason why I recommend turning

off system restore, sometimes viruses and trojans can restore themselves
through system snapshots.

How restart in safe mode:
www.microsoft.com/resources/documentation/
windows/xp/all/proddocs/en-us/boot_failsafe.mspx

 

[RobbieA]

Hi Frank:

Yes scan twice in Safe Mode as Andre suggests and also
See this link also because this is due to a missed patch
which needs to be fixed:
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.hllw.gaobot.ag.html
And Symantec has an automated removal tool:
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.gaobot.removal.tool.html


RobbieA

 

[Frank]

Andre and Robbie,

Thank you very much for your input. I'll give these a try.

Frank

 

[Andre Da Costa]

Hope it helps.