DUN Settings keep changing after a virus attack

I have just cleaned up virus Trojan.ByteVerify from a client after a great deal of digging and rebooted. Subsequent scans using Norton show no virus. However, his DUN Settings keep replicating and replacing the proper number/login with a premium rate one. The Original one then appears as _OLD

How do I find and kill the payload the virus has left behind? I am planning to run a spyware killer as well as soon as I get back to his desk.

I'm no expert on Windows 2000 SP4 so any help would be good.
LVL 1
asparakAsked:
Who is Participating?
 
makanaConnect With a Mentor Commented:
This is very simple and easy. Forget Norton(!). Run any online scan:
download this CWshredder and Run it. Update it regularly.

http://www.spywareinfo.com/~merijn/downloads.html

makana
A+ MCP Cisco Acad Sem-1
0
 
asparakAuthor Commented:
Ran Ad-Aware and it picked it up. The payload of the variant G Trojan seems to be coulomb Dialer
0
 
makanaCommented:
Thank you very much ! I hope my suggestions helped you.

makana
A+ MCP Cisco Acad Sem-1
0
All Courses

From novice to tech pro — start learning today.