Drift0r

Ok, so she came to me saying that she has this virus, Antivirus System PRO, and she's tried every single trick in the book, downloading repair programs, deleting the files, deleting the registry files. The place where it's supposedly installed, she says it's not there. She's running XP and she keeps getting popups. She's also deleted many of the reccomended files from the sites in safe mode. I'm completely stumped, and I'm usually good at this stuff. Can anyone help me and her?

__________________

AMOCO

the way i solve this problem is to reformat the computer to ensure that all the virus is gone

__________________

Quantum Reality

I remember hearing that one of the antivirus sites has a bootable ISO image you can burn to a CD and boot off of to have a clean environment in which to try and eradicate a virus.

The very last resort would be to buy another hard drive, slap a fresh install of (insert preferred OS here) and then install an antivirus program, then reconnect the suspect HD and scan it with the AV program before copying any files. After all clean files are copied (i.e. data, etc), reformat the infected HD.

__________________

xshadowfeverx

Solution

__________________

OMG MILD OVERCLOCK ON MY PROCESSOR?! 3.0 to 3.4

Windows 7║Fan Club

Demented

Run the Task manager and see what the process is called. Then boot into safe mode, do a search for that process, and attempt to delete it that way. If not, run Regedit and look for any instance of that process as well as anything that is related to it, and delete those registry entries. Then, redo a search of the system for that process, and anything that is related. If it doesn't show up then, you can also attempt to do a system restore to an earlier point.

These things are nasty, and usually get the novice user. Always inform your users (people that you set up computers for), the name of the anti-virus program you installed on their system, and inform them if they see a pop-up or window that doesn't have THAT software's name in it as the program that found the 'problems', that pop-up or window is BOGUS, and to use Alt-enter to close that window. Usually, even clicking a 'cancel' or similar button in these 'bogus' windows, will still cause something to be installed/run on the system.

__________________

TurboTurtle

Securedrom2k.

Download it, boot to it. Loads a Win7 environment that allows for ESET's Online scan to run. Run the scan, then boot into safe mode. Run MalwareByte's, any free version of a major AV like Avira, Avast, AVG, etc..., then run ComboFix.

Make sure you disable System Restore before doing any of this. Rogue AV's like to nest themselves in there.

__________________

Drift0r

I showed her this one, did it, didn't work.

I told her to check the process with the ones I found online, but she said it wasn't there. I'm thinking she made an honest mistake, she's actually quite computer literate.

__________________