I can't get rid of Comet Cursors
Page 1 of 2 12 LastLast
Results 1 to 10 of 13

Thread: I can't get rid of Comet Cursors

  1. #1
    Junior Member
    Join Date
    Jan 2004
    Posts
    19

    Angry I can't get rid of Comet Cursors

    I run spybot S&D, it detects Comet Cursors (regestry key). So I fix the problem, (delete it), then I run spybot S&D again seconds later. It detects Comet Cursors again, so I fix the problem. This keeps happening over and over. I also tried to delete it manually by going into regedit and deleting the key "Comet Systems" I exit regedit. Then I go back in to regedit and Comet Systems is back. I tried it again just to doublecheck and the same thing happened. How can I get rid of Comet Cursors?

  2. #2
    from http://www.kephyr.com/spywarescanner...or/index.phtml

    Manual removal
    Please follow the instructions below if you would like to remove Comet Cursor manually.
    Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {1678F7E1-C422-11D0-AD7D-00400515CAAA}', if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}', if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {D14D6793-9B65-11D3-80B6-00500487BDBA}', if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {FE6BC4EF-5676-484B-88AE-883323913256}', if it exists.
    Browse to the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar'
    In the right pane, delete the value called {FE6BC4EF-5676-484B-88AE-883323913256}, if it exists.
    Browse to the key:
    'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser'
    In the right pane, delete the value called {FE6BC4EF-5676-484B-88AE-883323913256}, if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {1678F7E1-C422-11D0-AD7D-00400515CAAA}', if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}', if it exists.
    Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {D14D6793-9B65-11D3-80B6-00500487BDBA}', if it exists.
    Exit the registry editor.
    Restart your computer.
    Start Microsoft Internet Explorer.
    In Internet Explorer, click Tools -> Internet Options.
    Click the Programs tab -> Reset Web Settings.

    I did not know Comet Cursor was still around

  3. #3
    Senior Member
    Join Date
    Jun 2002
    Posts
    311
    Check this link out-
    http://www.spywareguide.com/spydet_4...et_cursor.html

    You might want to get Ad-aware too -
    http://www.lavasoftusa.com/

    Spyware blaster prevents spyware from being executed in the first place-
    http://www.javacoolsoftware.com/spywareblaster.html

  4. #4
    Junior Member
    Join Date
    Jan 2004
    Posts
    19
    Thanks,
    I already have Ad-aware and when I try to run spywareblaster it says: runtime error 309

  5. #5
    Junior Member
    Join Date
    Jan 2004
    Posts
    19
    alittlebitnumb,
    thank you but your link is down and none of keys I'm supposed to remove are there. Comet Cursors is still there, though. Advice?

  6. #6
    The Iceman Cometh
    Join Date
    Aug 2001
    Posts
    1,210
    I've personally never had a problem getting rid of comet cursors. I've never had it on any of my machines, but I've had friends and clients who had it. To remove it, I've always used Ad-aware. If I were you, I'd run the most recent version of Ad-aware with "In-depth scanning" enabled. Allow it to clear off any and all instances of the program. Then, restart the computer and run it again. Should work. As I said, I've never had a problem with it. If it keeps coming back, you must be accessing a site which keeps giving it to you.

    AJ

  7. #7
    Senior Member
    Join Date
    Nov 2001
    Posts
    681
    did you uninstall it before running spybot... i know that the older version came with an unistall, but left the spyware keys in your reg, so after unistalling you would have to run spybot s & d. it sounds to me like you are only deleting the registry key and not the root of the problem, so it keeps placing the key back in your registry
    Learn like you are going to live forever, live like you are going to die tomorrow.

    Propoganda

  8. #8
    Gray Haired Old Fart aeallison's Avatar
    Join Date
    Jul 2002
    Location
    Buffalo, Missouri USA
    Posts
    888
    I don't see any reference to the OS you are running, if it is WinME, Win2K, or WinXP do you have file protection turned on? If so turn it off. Windows file protection stores backups of what it "thinks" are system files and will restore any changes made to those files without any prompting, including registry changes.

    <edit>altotheex13, I got the same error...

    Thanks,
    I already have Ad-aware and when I try to run spywareblaster it says: runtime error 309
    Quoted from SpywareBlaster's web page...
    Do you get an error that "MSCOMCTL.OCX" cannot be found?
    If so, use the following installer to copy the file to your system:
    MSCOMCTL Installer

    </edit>
    I have a question; are you the bug, or the windshield?

  9. #9
    Junior Member
    Join Date
    Dec 2003
    Posts
    26
    I downloaded a comet cursor on the dilbert website once and I couldnt get rid of it and since I am really lazy I just used go back which comes with all editions of eindows XP and that always deletes all the stupid stuff I download all the time, like Kazaa. Although it may be considered impractical, it is VERY easy and should be used if you have no clue what you are doing.
    Sweet.

  10. #10
    Some Assembly Required ShagDevil's Avatar
    Join Date
    Nov 2002
    Location
    New Jersey
    Posts
    718
    aeallison is close to what I'm thinking.
    This Comet Cursor reminds me a great deal of a System Restore based trojan.
    I had the same issues once. If you're using Windows ME or XP ,maybe this will help.

    You may have to:
    1.Disable System Restore (Windows Me/XP).
    2.Run a full system scan and delete all the files (registry, etc.)
    3.Re-enable System Restore

    exerpt from Symantec -
    "If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.
    Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat"

    System Restore Info ME
    System Restore Info Windows XP

    dunno. maybe this will help? good luck anyways.
    The object of war is not to die for your country but to make the other bastard die for his - George Patton

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •