Having trouble getting rid of a virus

suppafly

So today i did a scan of my comp with Norton Anti-virus 2002, and found that i had a virus on my comp. I when to the symantec website and this i this is the info they had on the PWS.Trojan.hooker virus that i'm after getting on my comp. They to do a full scan and then delete anything it finds. Did that, but then it alos says that have to delete something in the registerty. So i tried that but i couldn't find the file. Any help very much appreciated

Ste-

Have you used the search tool in regedit ?

suppafly

yeah but it doesn't seem to come up with the file? i cut and pasted in the file that and later the file path and it didn;t bring it up. I also just browse to the location that it said to go to (something like software/microsoft/windows......./runonce) but all it had in there was some kind of default file and the the one i needed to delete? whats the story?

Ste-

Originally posted by suppafly
yeah but it doesn't seem to come up with the file? i cut and pasted in the file that and later the file path and it didn;t bring it up. I also just browse to the location that it said to go to (something like software/microsoft/windows......./runonce) but all it had in there was some kind of default file and the the one i needed to delete? whats the story?

Why not deleate the one that needs to be deleated ?

NOTE: Back up Regedit before you edit anything.

tman

if you want to back up the registry, open regedit, go to file/export.
set the export range to 'All', and save the file somewhere handy...
if it fuxors up, just double click on the file you saved to restore your registry.
once you've backed it up you should be able to delete the dodgy key without any worrys

suppafly

Originally posted by dj_ste
Why not deleate the one that needs to be deleated ?

umm...cuz i couldn't find it, like i said. this is what i was following to try and get rid of the bad regisrty file.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

4. In the right pane, delete the following value:

kernel32 C:\%System%\kern32.exe

5. Click Registry, and click Exit.

except i couldn't find that file! When i go to the location all thats there is NAME *little ab icon thing*(default)
TYPE: REG_SZ
DATA: (no value set)

any ideas?

3D

The virus is an offshoot of bugbear - go to: http://www.mcafee.com/anti-virus/virus_removal/bugbear.asp download and run the removal utility and this should fix things for you.