| mat
The following worked for me:
The Trojan had installed itself into mtwirl.dll in the windows/system32 folder. NAV can't touch it, because it's already in use when the PC is running.
1. Identify the location infected file with an anti-viral.
2. Disable System Restore (important).
3. Re-boot in safe mode.
4. Drag the infected file to the desktop.
5. Delete and emtpy rubbish bin.
6. Normal re-boot.
That kills the virus, but then you have to fix the damage it did. It leaves several registry keys and values affected, which continue to screw up Internet Explorer. I manually fixed some (see Symantec's instructions for removing Trojan.startpage, only to find out that the Trojan had also installed a hijack over IE by redirecting my searches. To fix that, I suggest downloading Ad-Aware (available widely and freely) and run it. Then CWShredder (also available widley and freely), just to make sure. The hijack is clever in that it blocks access to CWShredder, but it didn't block access to Ad-Aware, so I downloaded and ran that first, which isolated the remaining hijack registry entries.
After you've done all the cleaning, go back to IE and delete cookies, temporary files, and history, and re-set your home page.
Finally, don't forget to re-enable System Restore. |
|