I need to fix my PC. There is some sort of trojan downloader program running in the task manager called LOL with a generic program box icon. Going to the process, it’s called liveonline_308 with some more numbers after that, can’t remember what they are. I have read about this LOL.exe and it supposedly has been known by other ‘program’ names and capable of rewriting a number of registry keys.
Anyway, Spybot Search & Destroy and AVG anti-virus got rid of it once in safe mode. It came back. Anti-virus doesn’t detect it now even though the process still runs when I start the system up. Anti-spyware doesn’t detect it. I’ve tried Spybot S&D again, SUPERAntispyware, and Lavasoft’s AdAware (which on a full system scan) stays stuck about 7 minutes on scanning a registry key – don’t know if that’s the problem or not.
I’ve tried looking it up on the internet and everything I’ve read so far says to delete the value in the registry edit which I can still get to. Yet when I look in the registry for the value that Symantec says to delete, it’s not there. So where is it? I’ve tried using search to find lol.exe and it comes back with nothing.
I’ve currently got the PC in safe mode.
I thought the worm was W32.HLLW.Reckus. But maybe it’s not because I can’t seem to find it anywhere. Many sites say to delete entries that end in CurrentVersion/Run and similar sounding entries. Should I?
What else can I do?
Should I try doing a system restore next since I can’t seem to find it or, are there other ways of searching for it first that doesn’t sound like I’ve tried yet?
|
