Is it possible you're being reinfected as soon as you go on line? Or do those boogers show up in your Hosts before you go on line?

Safe Boot and Selective Startup means the same thing for Windows XP.

If you type redgedit in the run command line you will get:




if you click on the boot.ini tab



just so you know.


and no, there aren't supposed to be any "=" signs there in the registry... that symbol was only meant to be for communication to you.


it only meant that in the "KEY" or FOLDER located in the left window of "regedit".

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Run

if the "VALUE" which would be located on the right window pane after you double click in "RUN"


for ex.


"Service Host Process"="spoolsvc.exe"

The VALUE NAME or Value itself is Service Host Process

the VALUE DATA is spoolsvc.exe

Norton wants you to delete both. The "=" was just a way to explain it.


Inferno

YOu need to uninstall or delete Norton and then reinstall it, while in Normal mode.

Remember that "Host file I had you download? you could try that.


In Selective Startup or Safe Mode (remember that they are one and the same)
Instead of deleting all the files one at a time ... just delete the whole Host files ...replace it with the "new host file" on that floppy I had you download last night. Just use Windows Explorer and copy the unzipped new Host file into the directory which originally housed your bad file. Delete the registry values and keys once again like before.
Go to your desktop and delete the contents of the recycle bin
Use Windows explorer and delete all Norton files (you have nothing to lose now as Norton has been diabled anyway)

Go to regedit once again and choose Nornal Startup. Close out of all open programs and SHUT OFF your system.

Turn on your system .... Install Norton and try running live update. If this is successful then run a full system scan. Delete any files that it finds regarding the worm.


See if this works ... This happened to me last year with the Wehlacia Worm. I wound up removing it from my system but I had damaged my registry because I deleted the wrong file. I wound up having to reinstall Windows XP. I lost all my data
I really and empathize with what your going through. MArita can tell you just how upset I was.

Inferno

and reboot to Normal mode.

Ok I'll give another shot.

I have now deleted the Hosts file in Safe Mode and unzipped the downloaded file into that folder.

However, I still cannot findanything in the Registry that conforms tothe values you've indicated. I never have!

There is one value in Current Version/Run that is close:

scvhost=svchost.exe, but that is not the same as the one in the list.

Should I delete this??????? I don't dare try anything else until I know because if it's wrong I'm hooped. I will have to leave my computer on and in Safe Mode because once I go back into Normal, if the virus is till there I will have to download the file again and this computer I'm on right now is a royal pain; dial-up connection, and a space bar that does not work.

I do not think I keep getting re-infected because I have had my internet connection unplugged for most of the last week. The virus is lurkingsomewhere but my registry doesn't have those values or the keys.

Also, I think I have more than one problem here.

That TrendMicro scan I downloaded on Saturday,which I have run about 50 times, all of a sudden found Nachi.b TODAY. It's never done that before, and NACHI.B was was supposedly removed by the on-line scan I used last Saturday. I haven't seen it since then.

As I say, my registry does not contain the keys and values for AGOBOT, although the TrendMicro scan has dound it several times in the past (but is not finding it right now). That same scan has in the past found Sasser a few times, but it does not find it right now.

But with my computer not linked to the Internet I don't know how I could have been reinfected with NACHI.B. I just don't understand it.

Too bad I can't install Norton in SafeMode.

Hagathaone,

Is this your only computer? Would it be possible
for you to attach this drive as a slave (or 2nd
master on the other IDE chain) of another
computer?

The only reason I suggest this is because you seem
to be so deeply mired in difficuties here that you
might be better off to scan the drive for a virus,
worm, etc. from a working system. In that way you
can isolate, remove, repair, etc. from that
system. You could also simply copy all your
important data, files, favorites, etc. to the main
drive and reinstall XP (I assume) on your drive.

Hi there. In the end that is likely what will happen with my system but it won't be me who's doing it. I know someone who is a genius with this sort of thing and I guess I'll have to let him work it out for me. Thanks to everyone who tried to help. I know a heck of a lot more about computers now than I did before, that's for sure.

On the very much brighter side, I did go out and buy a second computer just for games and not to connect to the Internet. I dropped a fair bit of cash on it, and bought a 19" screen, and my word, does that thing fly! I can hardly wait to see how Morrowind and its expansions performs on it. My old system can be for older games - I think I'll put Win 98 back on or maybe have both 98 and XP on it. Since I still play a lot of BG/IWD and things like Thief and Deus Ex, that would be worthwhile for a few more years, anyway.

And anyway, a girl can't have too many shoes, handbags or computers, I always say. And my partner can't complain about my profligate spending because he has three computers himself(not as many shoes or handbags, though).

This may be impossible, but with WINDOWS???? Who knows.

Could your 'puter somehow be set to do an automatic 'Back UP', (going back to a previous date) to before you started deleting these files & programs???

I feel silly asking, but it soulds like you are stuck in a loop.