| I did what you all said and removed my trojan. Before I change the values for the Shell in the registry to what you said, I'll repeat my current values to check if they are like yours:
"Explorer.exe C:\WINDOWS\Config\lsass.exe"
I'm assuming I have to change that to
"Explorer.exe C:\WINDOWS\explorer.exe"
However, I went to the windows directory, found the file, and when I clicked on it a documents window opened up. Does that mean the trojan changed the explorer file to open up to documents? What happens when you click on the explorer.exe file in the windows directory?
Also, I'm not sure the registry items in the Norton database are correct because Vista uses a different registry setup than XP/Me/98, right? (I've noticed that for example this key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
Policies\Explorer\Run] doesn't exist!) |