Recurring Virus

[HisPowr4U]

My computer keeps downloading Backdoor.Win32.Aimbot.aj every day, MULTIPLE times a day, and AOL's Antispyware program tells me over and over again that it has detected it, and lets me delete it. But I am getting very tired of having to do this so many times a day! It's been happening for probably a couple of weeks now. I have been on another forum and my HijackThis log does not show this virus at all! Is there a way to get rid of it and NOT KEEP getting it again and again?

[fink]

Try booting into safe mode and running your a/v program from there. to get into safe mode hit the F8 key while booting.

Also, while there, empty your browsers cache (temp internet files) and Java cache (Java icon in control panel)

[Tufenuf]

HisPowr4U, If you're running Windows XP or ME it's possible that the virus is hiding in your System Restore files. The only way to get rid of it if it is in the Restore files is to turn off (disable) System Restore then restart your computer. Then run a full virus scan in SAFE mode. If it comes up clean turn on (enable) System Restore again.

How to Disable System Restore in Windows ME or Windows XP

http://www.pchell.com/virus/systemrestore.shtml

Tufenuf

[HisPowr4U]

I have now tried both suggestions, the one from Fink and the one from Tufenuf. Neither worked. Computer still downloaded Backdoor.Win32.Aimbot.aj as soon as I restarted it. And has several times since then, all dealt with by AOL's Antispyware program. But nothing has stopped it from happening.

[Tufenuf]

HisPowr4U, Try the Manual Removal Instructions at the link below.

http://www.spyware-removal-guideline...bot-aj-removal

Tufenuf

[HisPowr4U]

Tried the manual removal, but did not FIND any of the files it says to remove. And I have had to work with the registry before, so I did know how TO find them.

[fink]

You say "downloading" the virus. Do you know where you're downloading it from? is it just one site in particular? Give us the exact message you get from the a/v program.

It's also possible it's a false positive and it's mistaking a legit file for a virus. try some online a/v scans to see if they can duplicate the finding.

there are some listed here..



http://discussions.virtualdr.com/sho...d.php?t=167915

[HisPowr4U]

The AOL Antispyware program puts up a popup that says "We have found and blocked Backdoor.Win32.Aimbot.aj I called it downloading cuz I have no idea what other word to use. I have used Kaspersky antivirus, McAfee, SpySweeper, Panda, ewido, cwshredder, Killbox, nothing has done any good. Can supposedly get rid of it with AOL's Antispyware program but it always comes right back. Have tried running a/v program in Safe mode. Made no difference whatsoever. Have tried getting rid of restore points and creating a new one. No help.

[fink]

Do you use AIM instant messaging? If so try turning it off for a while and then see if you still get the virus message.

Also have a look in the a/v quarantine vault, if it has one, and see if there are any quarantined files in it. If there are submit one here..

http://virusscan.jotti.org/

to see what all these scanners say about it.

And have a look in your a/v logs to see if there's a more detailed message about where it claims to have found the worm.

[HisPowr4U]

I am on AOL, so yes I use AIM. But I don't know if you mean the separate program called AIM, or just AOL's IMs...I have and use both. I don't use the separate program called AIM very often. I use AOL's IMs probably almost every day. The AOL antivirus program has no quarantine vault, nor does it have any log, that I have been able to find. All it does is find individual instances of Backdoor.Win32.Aimbot.aj on my computer and get rid of them, one by one. No other program has ever even DETECTED it on my computer. I went to that site http://virusscan.jotti.org/ but the name of the virus is just its name, I don't have any file to upload onto that page so it can't do anything with it. The AOL Antispyware program does not tell WHERE the virus was found. I sure wish it did!

[DVOM]

AOL's IMs is AIM. When you install AOL it also installs AIM.

A quick look suggests your problem is a worm that targets your AIM program. My guess is that a firewall might solve the problem. I would try either Sygate or ZoneAlarm. Both offer free versions which are available here:

http://www.pcworld.com/downloads/fil...RSS,RSS,00.asp

[HisPowr4U]

I have McAfee's firewall. I have posted also on an AOL Message Board, and was told there that since the "virus" didn't show up in any of the places it should when I tried to remove it using regedit, that means that AOL's Spyware Protection program was giving me "false positives," it was saying my computer had a virus when it doesn't. I have used other anti spyware programs to try to find this virus and none of them found it. So I finally tried to get AOL's Spyware Protection off of my computer, which didn't work because I couldn't find it on the add/remove programs list, and I ended up just having to use msconfig to stop it from starting up with Windows. Thanks for the advice. How can I mark this problem as solved on this board?

[HisPowr4U]

By the way, Fink, AOL's Spyware Protection does have a log, I finally found it, but I just disabled the program because it was apparently giving me false positives. Tried several other antispyware programs, and none found that virus.

[fink]

MSantispy (microsoft), Spysweeper and TrendMicro all make good antispy progs.

For freebies there's spywareguard, spywareblaster and the ubiquitous spybot s&d and adaware, all of which are usefull.

[HisPowr4U]

MSantispy (microsoft), Spysweeper and TrendMicro (formerly Acronis) all make good antispy progs.

For freebies there's spywareguard, spywareblaster and the ubiquitous spybot s&d and adaware, all of which are usefull.

Thanks, I have Spybot, and I have Adaware.