- just to keep this stuff in one post -
goto START
then RUN
type REGEDIT
then EDIT
then FIND
then type in: howstuffworks (or whatever the BHO or MALWARE/TROJAN is named)
ONLY DELETE the ACTUAL string on the right that has "howstuffworks" listed in it and ONLY delete a folder if it's named "howstuffworks"
you'll probably find several registry entries ...
... don't delete anything else ...
**********************************************************************
I found it in a start up file under TOOLS (there was a picture of Wheelrite there), BROWSER OPTIONS, and START UP OPTIONS.
Deleted howstufworks, and clicked OK.
Should that by itself work?
**********************************************************************
15. Author: [email protected] Date: 01/04/2009 07:55 PM Reply
^ ... possibly ... but don't count on it ...
... you still need to check the registry entries ...
**********************************************************************
My Norton discovered the very bothersome sav.exe & sav.cpl (virii/trojans?) but had been unable to delete them.
I followed the advice that you gave 8Track, found them, and quickly deleted them. Then restarted my pc.
Everything appears to be normal again thanks to you.
I also found a sav and a SAV.* in the registry which I left alone. Do you think that I should have deleted everything with a "sav"? Or could those virii that were detected by Norton (and deleted by me) have disguised themselves as LEGIT sav files?
**********************************************************************
Bloody,
"I also found a sav and a SAV.* in the registry which I left alone. Do you think that I should have deleted everything with a "sav"? Or could those virii that were detected by Norton (and deleted by me) have disguised themselves as LEGIT sav files?"
I'd honestly have to see the entire string of where the SAV was at ... if it was in a folder named "SAV", well, then I'd probably delete depending on the registry string in the right hand column ... but there are a LOT of SAV* files in every registry ... most are 'good' and are part of your OS and not BHO or trojan related, such as:
HKEY_CLASSES_ROOT\SavedDsQuery
... the *Sav* there is part of the "SavedDsQuery" and is a good file ... don't delete those.
... if the yellow folder on the LEFT is named "Sav" or "SAV", well, cut & past it and then I can give you a more solid answer on it.
AGAIN - f'ing with the registry entries can be DANGEROUS .... but it is also the most sure way to get rid of malicious software without spending $$ on programs designed to take care of it.
- after ANY time you delete registry entries ... reboot your system and then update your antivirus and spyware software and run a complete system scan with both ... they will generally then be able to pick out and remove any remaining strings or remnants of the MALWARE ...
- feel free to contact me off-line as well if you need any walk-throughs on something .... but the more that is posted here may help the others that run into the same problems ...
