Deleted virus still trying to start

Ok, I have norton antivirus, I scanned my comp last week, and it found a virus, cant remember the name, but it was deleted. Now when I boot windows I get a popup saying "Windows cannot find 'virushere' Make sure you typed the name correctly... blah blah blah. See attachment for the name (attachment didn't seem to upload...), it's odd charicters. Anyway, I checked my registry, startup folder, and MSConfig. I find no reference to this file ANYWHERE. Is there somewhere else I should be looking? I"m running winxp Pro, sp1.

Thanks in advance!

here is the attachment, i hope...

check your win.ini file for anything in the load or run sections

[windows]
load=
run=
NullPort=None

there is no load or run in win.ini in windows XP...

It's attached to another process....probaby a bogus copy of svchost or a new service. Type services.msc at the run line and look for anything out of the ordinary. After that, run the system information utiliy (start>all programs>accessories>system tools>system information) Go to tools>file verification utility and run a scan. Last, open a command prompt and type sfc /SCANNOW to scheck for missing/altered files. Hope this helps.

jenjen is right...type sysedit at the run line....yes it's still in XP. Go through each page.

Also check your registry for whatever windows can't find.

For instance, if your error is "can not find R32.dll", search the registry for R32.dll, and delete any keys that call for it. (back up your registry first in case of a boo-boo)

Send another screen shot of the task manager.... but this time show the processes tab. I think Wazz is on to something here with the process thing.

thing is groovicus.. is that it's some wierd characters.. look at his attachment.

cross.. do you remember what norton called this thing ?

edit : it'd be interesting to see what hijackthis reports.. download that and post a log.

http://www.tomcoyote.org/hjt/

The characters are ASCII. Don't mean much to me, though. I'm more interested in the processes that are running. Also, I agree that it would help greatly if we knew what norton called it. Can you look at or post your scan log?

I must be blind.. I didn't see that cross said he forgot what norton had called it..
But good call, 5768........ norton's log should still have it.

I don't think it's been asked, but if you have Win XP, even if you delete the virus, it'll be saved in Sys Restore, one of the joys of XP. Turn off System Restore and run your AV again and that should get rid of it once and for all.

I learned that from someone else when I had a virus on this computer, removed it, and it kept returning. I was told to do the above and it worked.

And now to bring the thread down to my intellectual level :)

1. Update your AV
2. Reboot in safe mode
3. Run AV and it should do the job?

It seems to be loading something at boot up, so you can't delete it? neither can NAV.

jenjen..........that guy never came back with the details of his computer that opens setup with the Tab key........if he does I will let you know.........it is intriguing me :)

Cheers

nihil> you forgot the.... turn of system restore part :)

if you don't turn off system restore, the AV will find the virus, delete it, reboot your system, XP will say "oo look xxx system file was changed" and put it back to the old version (with the virus call in it).

LOL.. yes souleman.. almost everyone BUT Chuck56 forgot to mention that.. "our collective bad"
oh well, you sometimes get distracted by the issue to remember the proper steps.. I see that cross hasn't been back, so either he's fixed it or will see the rest of the steps when he returns.

nihil.. tab key.. tab key.. my memory is almost failing me.. oh yeah that guy that claimed he entered his bios screen by using the tab key. And both of us were wondering "what the, who the, why the? which bios type could that one be ?" (forgive my poetic nature, I truly suck at poetry)

Greenies to the man who spotted that :)

I did promise to bring the thread down to my level though?...so I did not lie?

:D

Cheers