03-26-2013 09:17 PM
I've been running Norton 360 but still picked up a "Department of Justice" virus that locks up the computer. I've restarted in safe mode and run a full scan with Norton 360 with no luck.
I also tried to run the Norton Power Eraser, but, it requires a reboot and the DOJ Virus takes control before it can run.
I Googled for advice on removal and all I see are ads for other security programs that claim they will remove the virus, but, I an leary of using programs from an unknown source.
Is there a way to remove this virus with a Norton product?
03-26-2013 10:13 PM
Try MalwareBytes. I've had this virus before and it removed it. Even though I know you don't want to install other programs, you might need to. http://www.malwarebytes.org/products/malwarebytes_
03-27-2013 01:11 AM
Norton does not appear to detect the DOJ virus yet. Follow these steps:
1. Restart your computer and the second the screen goes blank to reboot start pushing the F8 key twice a second until you enter 'safe mode'.
2. Select safe boot with or without network access.
3. Click the 'start button' and type in regedt32 and if that is not found type in regedit (depends on os).
4. Once the registry editor is up expand out the following:
5. Find an entry under that you don't recognize as a valid program to run at startup. Mine was 'DisplaySwitch.exe'
6. Leave the registry editor open and use a windows explorer (file folder navigator) to locate the file you suspect is bad.
7. Check the date on that file. If the file date/time corresponds to the first time you saw the virus delete it.
8. Remove the corresponding entry in the registry editor.
9. Reboot the computer in normal run mode... Your done!
Use caution when accepting requests from the OS to allow the registry to be edited, even if it looks safe. I'm not certain but it appears that the OS and Norton are allowing the virus to make changes to the registry without permission.
03-27-2013 08:58 AM - edited 03-27-2013 09:03 AM
Please post your issue to one of the following malware remediation forums for assistance. Unless you know the variant of the infection you have, and know the specific system changes it has made, I would not recommend deleting any registry entries - especially on the basis of circumstantial evidence alone.