Expert: Lorry - 2/17/2006

Question
I've got Windows XP Home Edition 2002 and I own a Dell Dimension Desktop that I bought in 2002.  After experiencing many problems, I reformatted my computer about 2 months ago (wiped it all clean).  Since then the only major things I've downloaded of the internet have been Adobe Acrobat an AIM and a program for my account on partypoker.net.  Using Norton Systemworks 2003 I have removed 3 viruses repeatedly from my computer:W32.Ifbo.A, Backdoor.Berbew.N, & Trojan.Dropper. I assume the first two are gone since it's been 10 days since I got anything on those, but the Trojan virus seems to still be popping up.  The methods I've used to remove this virus have been the instructions on the Symantec webpage:
1. Restart the computer in Safe mode or VGA mode.
2. Disable System Restore (Windows Me/XP).
3. Update the virus definitions.
4. Run a full system scan and delete all the files    detected as Trojan.Dropper        

Since following these instructions, every now and then I'll get a pop-up from Norton (the red warning one) that says it detected a trojan.dropper virus and had automatically deleted it.  This is weird since I thought I had already removed it but then to top it off something about a Microsoft windows error comes up and if I want to send an error report, followed by a notice that my computer is going to automatically restart in 60 seconds.  Needless to say I can't use my computer if it decides to restart every time this happens, which is quite common (3 times  alone in the course of typing this letter which is frustrating since I can't save). So I was just wondering what to do and how to REALLY get rid of this virus since it doesn't seem to be gone. Thanks, much help appreciated-Billy  

Answer
Hi Billy,

Verify that the other viruses are gone - totally. Check out the following:

http://securityresponse.symantec.com/avcenter/venc/data/w32.ifbo.a.html

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.berbew.n.html

Start the computer in Safe Mode and run a virus scan, after running LiveUpdate. Check out the following:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.dropper.html

Using Internet Explorer, go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Go to Windows Update and download the available updates.

Hope this helps!
Lorry