Help please with Win32 Purityscan-Q

[kcampbell]

hello, can anyone help me get rid of a Trojan called win32purityscan
-Q [trj].  Avast catches it but it keeps coming back.  I delete it and put it into chest.

These are the files names that are infected !update.exe, A0026968.exe, chdsk.exe (multiple !update. exe are in the chest)

I have tried cutting off the restore in system, it is currently off.  deleted all temp folders, history,searches and delete avast and reloaded it.

[DavidR]

You don't give the location of the infected file ?

A0026968.exe looks like it could be in a _restore point as that is the type of file name in there.

Have you rebooted after disabling system restore, that should clear ALL _restore points.

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode,
 Ewido anti-spyware If using winXP. or a-Squared free if using win98/ME.

[Spiritsongs]

   Hi kcampbell :

  How to Remove PurityScan ?

PurityScan provides an uninstaller on its web site, click the following link to download the uninstaller and follow the instructions to uninstall it.

http://www.purityscan.com/ps_uninstaller.exe

If you want to manually remove it , follow these removal instructions:

Open the Registry Editor (Click Start > Run, type 'regedit' and click Ok).
Navigate to the following registry key:

HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run

In the right pane, delete the entry named ContentService.

Delete the following keys:

HKEY_CURRENT_USER\software\purityscan

Reboot the computer.
Search and delete the file winservn.exe from the System directory (by default the System directory is c:\windows\system for Windows 98 or c:\winnt\system32 for Windows 2000) .
Open the Program Files folder, find and delete the folder PurityScan and all the contents in it.