RBCalc BS still on my machine

[Tk79]

[ QUOTE ]
Check out the stickied threads (edit: well, there used to be a sticky) for instructions on removing the registry entries associated with RBCalc.exe. After you've cleaned up the registry, and run full scans, then take a system restore checkpoint. Name it telling you that you cleaned up viruses.

[/ QUOTE ]

I have already gone through all the steps in the old sticky. None of the 4 files are present any more but when I restart my computer the 2 things in the registry are back. When I run the eTrust scan and delete the RBCalc it deletes the entries in the registry. Upon restart they are there again. Is this due to an old restore checkpoint? I havent restored from an old checkpoint manually. Would my computer for some reason continue to restore from an old checkpoint upon restart?

NOTE: I do have XP

[TomR]

Have you checked for rootkits? Rootkits are not reliably detected by anti-virus software and could cause this type of issue.

Here are two free, reputable rootkit detection tools:

BlackLight by F-Secure
RootkiutRevealer by Sysinternals

[rt1]

use the links posted above by TomR.

make sure you anti virus is up to date. you should be fine.

what file / where is it detecting rb calc, go manually delete it.

[Tk79]

Tom-

I used rootkitrevealer. After the scan it shows that I have 9 different things showing up. In the help menu it tells me that I need to verify that each one can be accounted for. This seems like a task that needs to be performed by someone more qualified than me. Is there a more userfriendly way to go about this. Also if this program installed some kind of rootkit wouldnt it have installed on everyones computer and not just mine. Is anyone else having this problem?

Ryan-

As I said, my anti virus is up to date and I have manually deleted everything several times. It just keeps coming back. The location it comes up as is Key: hkey_local_machine\system\controlset001\services\n dsdavsrv. I have tried to manually delete this and delete it through my AV. No such luck.

Im not so sure Im comfortable with this
[ QUOTE ]
you should be fine

[/ QUOTE ]