Norton 360

[jigneshdesai]

How can i forcefully remove  above registery key created by some virus.

I tried to boot vista in command prompt and tried to move key, but it still denies to remove key.

Please Advice.

[huwyngr Norton Fighter]

Is this part of the same problem that you posted about just 1 minute previously?

[jigneshdesai]

Yes, I had submitted fiew files to norton  and they reported

File: 886100.dll Machine: Machine Determination: This file is detected as 'Backdoor.Trojan, ' with our existing Rapid Release definition set. URL: http://www.symantec.com/avcenter/venc/data/backdoor.trojan.html

Now I wonder why norton 360 left those files on my c:\

should not it catch and delete them?

which means norton did not performed well.

Now can anyone help me to remove this registery and its related registry entries.   I also see a service that is added in services control panel and i am unable to remove that too.

Regards

[jigneshdesai]

Even after installing symrapidreleasedefsv5i32.exe  as suggested.

The registry keys still exists and has not been removed.

Kindly Advice.

[dbrisendine Norton Fighter]

You have to take ownership of the Legacy key in order to remove it.

Right click on the key and select Permissions.  Click ADD and add your user name and click OK.  Click ADVANCED and select the tab for OWNER; select your user name you just added and click APPLY.  Select your user name on the main permission window and (in the bottom window) click on FULL CONTROL in the Allow column.  Click APPLY on the main window (and OK if it does not close automatically).  Do the same for any sub-branches (keys) under the main key.

Right click and select delete to remove the key(s).

[jigneshdesai]

Excellent. The Registery Key is removed Successfully.   ThankYou.

But yet another problem remains.   [see attached screenshot]

This is the service entry created by the same virus.  I tried to delete that entry using "sc delete" command

but it did not worked.  ( I do was at cmd prompt opened using "run as administrator" )

I suspect there are other registery reference that is holding this service entry.  so i want to do two things

1. Force remove the service.

2. Want to know how to search all references of the service in registery and manually deleting them.

Regards

[dbrisendine Norton Fighter · Accepted solution]

You can remove the service from the registry by going to ControlSet > services and searching for the name of the service.  You will have to change the permissions as you did to remove the Legacy key.  Make sure you search through all numbered ControlSets (i.e. - ControlSet001, ControlSet002, etc.).  You do not have to do the CurrentControlSet as long as you do all the numbered ones first.

[jigneshdesai]

To my fellow Norton 360 Users.    I am trying to remove virus form my PC and i am putting some information that I come accross to help someone who is similar victim like me.

Regards

[jigneshdesai]

To my fellow Norton 360 Users,

Here is another screen shot of this virus's registry entry, that you should remove.

Not sure what "FailureActions" key does, but I personally would be interested to know what "value data" is about.

Also what " svchost.exe -k imgsvc "  is all about ?

Regards

Finally after removing all these registry entries.  I was able to remove Service entry from services.

using     sc  delete "Gcxxkf Laufnipi Gbd".

Good Luck Friends.

[Quads]

---

jigneshdesai wrote:

To my fellow Norton 360 Users,

Here is another screen shot of this virus's registry entry, that you should remove.

Not sure what "FailureActions" key does, but I personally would be interested to know what "value data" is about.

Also what " svchost.exe -k imgsvc "  is all about ?

Regards

---

"Not sure what "FailureActions" key does, but I personally would be interested to know what "value data" is about.

Also what " svchost.exe -k imgsvc "  is all about ?"

Simple answer, do not play with what you know nothing about,  opps deleted a key or file and now Windows or a program won't run / load properly.

Quads