Comments on: How To Eradicate Boot.com Trojan

By: Ed-ward

Ed-ward — Sun, 04 Jul 2010 08:27:46 +0000

Thanks! You saved me a lot of time and maybe money…I was infected and was about to pay a thechie guy to remove Boot.com Trojan

By: James Trader

James Trader — Sat, 29 May 2010 18:20:23 +0000

I would advice you not simply download some unknown application but simply install Kaspersky antivirus it is the most powerful one.

By: craps gambling

craps gambling — Fri, 20 Mar 2009 07:59:11 +0000

If you want to remove this virus, you have to be very careful and use your common sense, for you to find it. So you have to try and identify one name that the virus uses, then use that name to get every other name that it may also be using to run. Get Avast download and install; at the end of the installation, you’ll be asked if you want to do a boot-scan. Select Yes. This will restart your PC, and Avast will scan your system *before* Windows loads, thus being able to delete files that are started as services.

By: Lestere

Lestere — Sat, 17 Jan 2009 03:22:14 +0000

I wonder if I might add my two cents worth here after having this trojan twice. the first thing to do is download Malwarebytes, the next thing to do to stop it replicating is to work in safe mode, F8 at reboot in XP then look at all your drives and partitions for the RESYCLED folder and the autorun.inf files and delete them, and any USB storage too. Then check C:\windows\system32\dlcache for boot.com and delete it if it’s there.
Next check C:\windows\prefetch for boot.com and if its there delete it.
Next delete all files in C:\windows\temp some files may not delete they are being used so don’t sweat it to much.
Next delete all files from C:\documents and settings\your profile\local settings\Temp again don’t sweat the ones being used.
Now run regedit, for you nervous about touching regedit I’ll make it as simple as possible to do for you.
OK here goes, click Start, Run, and type regedit then highlight “my computer” right at the very top of the panel on the left side. Then click EDIT and scroll down to find and click it, then in the find box type boot.com and click find next. when it finds boot.com press delete and send it to the recycle bin, and press F3 to continue to find the next one and delete it until you find them all and regedit says no more entries or something like that. Then go to the top of the left panel again and highlight my computer once more and click EDIT again and the find button again and this time write RESYCLED and click find next, repeat deleting and clicking F3 until you have found them all.
Close regedit and check your drives again to see if they are clean of the resycled folder and the autorun.inf file.
You should be able to reboot after this to find your computer is clean again, if not you may have to do this again only this time you may have to turn off your system restore in control panel\ system folder until your computer is completely free of this bastard Trojan.
Hope this helps someone,
Lestere.

By: Coyote

Coyote — Sun, 11 Jan 2009 19:57:31 +0000

To be honest I’m not sure. I didn’t come across that when I was getting rid of this trojan, but a quick internet search resulted in less than 10 references to “boot.coom” gobally, and most of them were in Russian so I’m none the wiser.

If I were you I’d get rid of that as well, just to be on the safe side. If you can’t recognise it and you don’t have any installed software that rings a bell with that registry key – then zap it.

Just my 2c worth

By: steve sarazin

steve sarazin — Sun, 11 Jan 2009 16:38:49 +0000

while looking for boot.com files in registry i found boot .coom is this a variation of the same virus..????this was in the search assistant folder also in this folder is a autorun.inf file that was mised during previous reg scan….???what should i do whith this file .also i havent checked to see if there are any more boot.coom in the registry i stoped there till i find out if this is supoistto be there… thanks for any help in advance… steve

By: Coyote

Coyote — Sat, 10 Jan 2009 00:55:14 +0000

I don’t mean this to sound like a stupid question, but….

Did you follow the instructions in the sequence outlined above? Because if you do it in any other sequence the little bugger gets a chance to reinfect your system. It’s really important that you clean out the registry before runing the MS-DOS commands to display and then delete the files on the root folders of your disks.

I know when I was doing it I had to run through the registry a few times before it came up clean. That includes searching for all variants of boot.com, resycled.com etc.

Hope this helps.

By: Lorena

Lorena — Fri, 09 Jan 2009 22:14:13 +0000

I’ve tried this fix about 5 times, and it doesn’t work. I can see the resycled and autorun.inf files on my 2 partitions and external hard drive. I run antivirus and malware scans and they all come up clean. I’ve deleted them from the registry close to 10 times by now, and still it’s there.

It’s driving me mad. Does anyone else have any other ideas/methods to get rid of it?

By: c0y0te

c0y0te — Tue, 06 Jan 2009 16:34:46 +0000

Hevghirl – you’re very welcome and I’m delighted my article was able to help resolve your issue. It’s the very reason I bothered to record the steps in the first place, because I didn’t want anyone else having to go through the crap I did if it could be avoided. Please feel free to spread the word and link back to the article if you think it can help anyone else.

By: Hevghirl

Hevghirl — Tue, 06 Jan 2009 12:35:53 +0000

Thank you for helping me solve this problem. I hunted the net trying to find a solution and there wasn’t much on boot.com. Someone on a forum posted a link to this page, for which I am truly grateful.

Apart from not being able to access any of my drives directly, I was also unable to do a system restore after this thing infected my system. I got a hold of malwarebytes, though had real trouble getting it as well, but got there in the end, and it seemed to do the trick for me. So far, my sysem seems to be running smoothly. Huge huge thanks for this article