Hijack.FolderOptions Infection

[Compbck]

I have just completed cleaning a laptop that was badly infected with various Trojan Horse Variants, and good old Malwarebytes has done a great job of eradicating all but one:

Hijack.FolderOptions (Registry Value)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions Value1

Repeated scans detect it, but it appears MAB is unable to clear it from the system, even after the statutory re-boot.

Has anyone any suggestions as what other applications I could try in order to clear it from the Windows XP system.

Regards to all.

 

[iptech]

Why not use regedit?

 

[Compbck]

I've tried deleting the offending item from the registry using REGEDIT, but it just re-appears after re-booting.

 

[iptech]

I've tried deleting the offending item from the registry using REGEDIT, but it just re-appears after re-booting.

Then you haven't cleared off the root infection, you need to be looking for rootkits or a winlogon entry.

Apart from using consumer-focused scanning software, what have you done to identify & remove virus infections from this computer?

 

[Galdorf]

Try scanning from a boot cd my favorite is sardu on a usb stick i have 10 rescue virus scanners and ubcd4win atm bitdefender live cd is fastest but gdata cleans more in one pass finds just about everything.
Seems most rescue virus scanners run really slow gdata catches more rootkits it has a rootkit scan on rescue cd.

 

[Compbck]

This matter has now been resolved. Thank you for the responses, especially Galdorf for your recommendations on useful software, which I will keep in mind for the future.

Regards to all.

 

[iptech]

This matter has now been resolved. Thank you for the responses, especially Galdorf for your recommendations on useful software, which I will keep in mind for the future.

Regards to all.

So what was the cause?

 

[Xander]

So what was the cause?

Enquiring minds want to know. Reg entries don't bring themselves back.

 

[iptech]

Enquiring minds want to know. Reg entries don't bring themselves back.

I guess it's a secret only known to those who randomly throw scanning software at an infected computer will know.

C'est la vie