[Yosemitest]

I had a hard time getting rid of this problem.

Spyware Terminator detected it, and it's attempt to remove it wasn't successful.

I had to find a clean copy of "atapi.sys" and save it to my documents. Then I had to use RootRepeal and use its tools to force-wipe the infected copy of "atapi.sys" from two locations.

File: C:\WINDOWS\system32\DRIVERS\atapi.sys


Registry HKLM\SYSTEM\CurrentControlSet\Services\atapi located at

File: c:\WINDOWS\ServicePackFiles\i386\atapi.sys

After that, I copied and pasted the clean copy of "atapi.sys" into those locations and run a full scan again.

Spyware Terminator then reported:

Program: Rootkit-2660 C:\WINDOWS\system32\drivers\SET1A5.tmp Action: Auto Deny Shield: File Access shield

Process: Rootkit-2660 (Trojan Detected by ClamAV)

So, to clean this temp file out, I used CCleaner. First I changed the settings under "advanced settings" to delete ALL TEMP files, not just the ones older than 24 hours.
Then I run the cleaner. And after that, I run the registry Cleaner.

Then I scaned again with Spyware Terminator, and it came up clean.

Finally, I run Norton Ghost" and made a clean backup of my computer to an external drive.

Good luck, and I hope you don't have this Nasty RootKit.

[mad_as_he$$]

bttt

[DollyCali]

BTTT