I can't get rid of Comet Cursors

[altotheex13]

I run spybot S&D, it detects Comet Cursors (regestry key). So I fix the problem, (delete it), then I run spybot S&D again seconds later. It detects Comet Cursors again, so I fix the problem. This keeps happening over and over. I also tried to delete it manually by going into regedit and deleting the key "Comet Systems" I exit regedit. Then I go back in to regedit and Comet Systems is back. I tried it again just to doublecheck and the same thing happened. How can I get rid of Comet Cursors?

[alittlebitnumb]

from http://www.kephyr.com/spywarescanner/library/cometcursor/index.phtml

Manual removal
Please follow the instructions below if you would like to remove Comet Cursor manually.
Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {1678F7E1-C422-11D0-AD7D-00400515CAAA}', if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}', if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {D14D6793-9B65-11D3-80B6-00500487BDBA}', if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {FE6BC4EF-5676-484B-88AE-883323913256}', if it exists.
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar'
In the right pane, delete the value called {FE6BC4EF-5676-484B-88AE-883323913256}, if it exists.
Browse to the key:
'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser'
In the right pane, delete the value called {FE6BC4EF-5676-484B-88AE-883323913256}, if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {1678F7E1-C422-11D0-AD7D-00400515CAAA}', if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}', if it exists.
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {D14D6793-9B65-11D3-80B6-00500487BDBA}', if it exists.
Exit the registry editor.
Restart your computer.
Start Microsoft Internet Explorer.
In Internet Explorer, click Tools -> Internet Options.
Click the Programs tab -> Reset Web Settings.

I did not know Comet Cursor was still around ;)

[Fatphantom]

Check this link out-
http://www.spywareguide.com/spydet_428_comet_cursor.html

You might want to get Ad-aware too -
http://www.lavasoftusa.com/

Spyware blaster prevents spyware from being executed in the first place-
http://www.javacoolsoftware.com/spywareblaster.html

[altotheex13]

Thanks,
I already have Ad-aware and when I try to run spywareblaster it says: runtime error 309

[altotheex13]

alittlebitnumb,
thank you but your link is down and none of keys I'm supposed to remove are there. Comet Cursors is still there, though. Advice?

[avdven]

I've personally never had a problem getting rid of comet cursors. I've never had it on any of my machines, but I've had friends and clients who had it. To remove it, I've always used Ad-aware. If I were you, I'd run the most recent version of Ad-aware with "In-depth scanning" enabled. Allow it to clear off any and all instances of the program. Then, restart the computer and run it again. Should work. As I said, I've never had a problem with it. If it keeps coming back, you must be accessing a site which keeps giving it to you.

AJ

[lord_darkside_x]

did you uninstall it before running spybot... i know that the older version came with an unistall, but left the spyware keys in your reg, so after unistalling you would have to run spybot s & d. it sounds to me like you are only deleting the registry key and not the root of the problem, so it keeps placing the key back in your registry

[aeallison]

I don't see any reference to the OS you are running, if it is WinME, Win2K, or WinXP do you have file protection turned on? If so turn it off. Windows file protection stores backups of what it "thinks" are system files and will restore any changes made to those files without any prompting, including registry changes.

<edit>altotheex13, I got the same error...

Thanks,
I already have Ad-aware and when I try to run spywareblaster it says: runtime error 309


Quoted from SpywareBlaster's web page...
Do you get an error that "MSCOMCTL.OCX" cannot be found?
If so, use the following installer to copy the file to your system:


MSCOMCTL Installer (http://www.spywareinfo.com/downloads/tools/missingfilesetup.exe)

</edit>

[Figaro]

I downloaded a comet cursor on the dilbert website once and I couldnt get rid of it and since I am really lazy I just used go back which comes with all editions of eindows XP and that always deletes all the stupid stuff I download all the time, like Kazaa. Although it may be considered impractical, it is VERY easy and should be used if you have no clue what you are doing.

[ShagDevil]

aeallison is close to what I'm thinking.
This Comet Cursor reminds me a great deal of a System Restore based trojan.
I had the same issues once. If you're using Windows ME or XP ,maybe this will help.

You may have to:
1.Disable System Restore (Windows Me/XP).
2.Run a full system scan and delete all the files (registry, etc.)
3.Re-enable System Restore

exerpt from Symantec -
"If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.
Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat"

System Restore Info ME (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239?OpenDocument&src=sec_doc_nam)
System Restore Info Windows XP (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam)

dunno. maybe this will help? good luck anyways.

[altotheex13]

Thank you all, especially Shag and Lord, that fixed it.

[altotheex13]

Oops sorry. You too aeallison.

[saintakaagni]

Please refer to this site for removing spywraes
http://www.cexx.org/startup.htm