Computer virus help?

Question

Windows XP - HP computer - using CA security

I run my anti-virus and spyware daily - Thursday, the computer said I have the Win32/kollah.ME virus but it won't remove it.

Updated it - still same thing

Went thru the Program>Accessories>System Tools>System Restore

set it back to Tuesday when I didn't show a virus - still showed up

set it back to a week ago 7/26 - still show the virus

set it back to 7/19 - still show the virus

Tried downloading Panda - it won't finish

Tried MicroTrend - you now have to buy an offer from an advertiser

Tried AVG - got it on the desktop but it won't open

I know I"m only supposed to have one Anti-virus program but I can usually remove it after I get fixed.

Then tried RUN>and typed in regedit - then did a search for kollah

found one under

My Computer\HKEY_Current_User\software\micr...

the line looks like this:

under NAME - ab (000

under TYPE - REG_SZ

under DATA - kollah

Can I just delete that and be done with this? or will I be shooting myself in the other

Answer 1

So far you have done very well !

Now, just a couple more things.

Yes, delete the entry.  It's a trojan.

Obviously your current anti-spyware and anti-malware did not do well with this one.

You DO need to remove those tools and get the one I HIGHLY recommend.

It will do a through search, and clean up any problems.

When it is finished, I want you to also do a restore point.

START > Accessories, > System Tools > System Restore >

Go back to BEFORE this problem occured.

You'll only lose the most recent files you created or downloaded.  Which is good.

--------------------------------------...

I like this FREE tool that does an EXCELLENT job.

Avast free Home Edition

Get it here:

http://www.avast.com/eng/avast_4_home.ht...

And please do a "thorough" scan as soon as you get it downloaded. The user interface is simple. Click the left side, and in the top menu that comes up, select thorough scan.

When it finds a culprit it throws up an alarm, then you DELETE the culprit, (do not quaranteen).

Then allow it to run all of the time, and you will be completely protected. It will "automatically" update itself, also for free.

You only need to renew your registration once a year, also free.

Note: I KNOW of several people who have used AVG and Norton and have gotten a virus anyway.

Don't go with Zone Alarm as it is hoggy and conflicting.

I've tried them all, and have had wonderful results with DEPENDABLE AVAST for the last 5 years.

The corporation I work for uses the Pro version, and has never has an incident. Avast is your answer.

--------------------------------------...

After you've done system restore, try your programs that did not work for you. If they are also corrupted, such as HijackThis, etc.

in Add Remove Programs > Delete the old and

then go online and get the newer version.

--------------------------------------...

Glad to help

^j^

Answer 2

You should never delete reg keys without knowing what they are so leave it for now.

You need a program called Malwarebytes - http://www.malwarebytes.org/mbam.php

The 2 others programs that could remove it are:

SuperAntispyware - http://www.download.com/SUPERAntiSpyware...

SmitfraudFix - http://siri.geekstogo.com/SmitfraudFix.p...

Download, Update and Scan with Malwarebytes and SuperAntispyware.

Answer 3

You need to open the Registry and locate:

HKEY_CURRENT_USER\software\microsoft\w... {3e7a1818-971b-793b-e1f6-3bbf372a733f}  and delete it.

Type regedit into Run command, when reg editor open click on Edit, then Find and enter this as it is, including brackets:

{3e7a1818-971b-793b-e1f6-3bbf372a733f}

Also tick Match whole string only then click Find Next.

Also use the search function in Windows to find and remove the following files:

ntos.exe

ups_invoice_978172.exe

ups_invoice_978172.zip

ups_invoice_978172.exe

ntos.exe