Bloody,
"I also found a sav and a SAV.* in the registry which I left alone. Do you think that I should have deleted everything with a "sav"? Or could those virii that were detected by Norton (and deleted by me) have disguised themselves as LEGIT sav files?"
I'd honestly have to see the entire string of where the SAV was at ... if it was in a folder named "SAV", well, then I'd probably delete depending on the registry string in the right hand column ... but there are a LOT of SAV* files in every registry ... most are 'good' and are part of your OS and not BHO or trojan related, such as:
HKEY_CLASSES_ROOT\SavedDsQuery
... the *Sav* there is part of the "SavedDsQuery" and is a good file ... don't delete those.
... if the yellow folder on the LEFT is named "Sav" or "SAV", well, cut & past it and then I can give you a more solid answer on it.
AGAIN - f'ing with the registry entries can be DANGEROUS .... but it is also the most sure way to get rid of malicious software without spending $$ on programs designed to take care of it.
- after ANY time you delete registry entries ... reboot your system and then update your antivirus and spyware software and run a complete system scan with both ... they will generally then be able to pick out and remove any remaining strings or remnants of the MALWARE ...
- feel free to contact me off-line as well if you need any walk-throughs on something .... but the more that is posted here may help the others that run into the same problems ...
