I've been trying for the last several days to remove nCase, Look2Me, etc., manually, looking for specific files, keys, values, etc. I finally found a specific key in the registry I was looking for, but am reluctant to delete due to differences in cases in the letters. All the letters in the registry are capitals, in the removal instructions they are small case, otherwise the keys are identical. I suppose it's possible the writer of the instructions simply didn't bother to make the letters all caps, but of course I'm wondering, are these keys case sensitive?
Indeed, this is one of the true wonders of Windows. I remember having gone through this circus a few years ago in order to get Norton Antivirus going again. You find stuff all over the place like dog p**p. A hackers' dream. Mind boggling!
Before any of your attempts to remove these warms, did you remember to disable System Restore? Did you run your scans, removal tools, etc, in Windows Safe Mode?
Without working in Safe Mode, programs in your Run, RunOnce, Windows Startup and other areas will start up before you get a prompt. This allows viruses to morph and reinstall. YOU MUST WORK IN SAFE MODE in most cases. Good luck.
Just download Microsoft's beta antispyware. Removed all my viruses better than any $ anti-virus. Go to Microsoft.com
when you start cleaning your windows at the registry level, It is time to make a backup and format and re-install.
This is just what I've been thinking this morning, that I'd like to reinstall XP and start with a clean slate. But for some reason I am unable to back-up files from My Documents to a CD. It says the D drive is not accessible.