Worst computer virus I have ever encountered - need help.

[ddeder]

Norton Anti-virus 2004 detects a virus on my Windows XP Home machine called IEFEATS. It lists two files in my Windows directory that are infected: addzv.dll and fxrsuv.dat. When I tell Norton to delete these files it tells me the delete failed. This happens in safe Mode as well as Normal mode. I set my options to display hidden and system folders and went to look for the files using Windows Explorer - they are not there. Or at least I can't see them. I tried looking for them using the command prompt - again not found. It tried the latest version of CDSHREDDER. It says my system is completely clean. Spysweeper tells me I have a CWS variant but after I tell it to clean it, it just shows up again on subsequent scans. Adaware, Spybot Search and Destroy and Pest Patrol all tell me no problems were found. HijackThis looks clean. Everything run in Safe Mode as well as normal mode - no difference.

How can Norton identify a file as a virus when I can't see the file in Windows Explorer? Again, I have set my options to display hidden files.

 

[LTC8K6]

Xcleaner will defeat iefeats.

Spyware guide

 

[ddeder]

I just installed and ran X-Cleaner. Id did not identify or remove the problem.

Norton scan still shows the 2 infected files. Nice try.

 

[dclive]

Originally posted by: ddeder
I just installed and ran X-Cleaner. Id did not identify or remove the problem.

Norton scan still shows the 2 infected files. Nice try.

Boot in recovery console. Move the files to another directory (say, c:\) and then reboot and see if you can then resolve the issue with a normal scan of those files.

 

[Zepper]

When you are trying to clean viruses etc. under XP you HAVE TO TURN OFF THE RECOVERY FEATURE - else it just brings the files back... Turn off stuff like Norton's protected recycle bins as well - if it were me, I'd uninstall anything Norton...
.bh.

 

[LTC8K6]

Most of the anti-virus sites say they have it handled. Maybe you have a brand new version?

If you haven't done so already, you may want to try manually deleting the registry keys. This Symantec page may be helpful, anyway.

Symantec

 

[ddeder]

I did turn System Restore off before running my scans. Norton Protected Recycle is turned off as well.

 

[Ryoga]

Manual removal instructions:
http://www.inet-mates.com/articles/3_rm_coolwebsearch.iefeatsl.html

Note that you should run the system in Safe Mode while you're cleaning it, and do not open IE until you've finished.

Edit: Symantec manual removal instructions:
http://sarc.com/avcenter/venc/data/adware.iefeats.html

Don't seem to match, so it's possible that what Symantec is finding isn't what was being talked about above. Use the Symantec instructions.