Help!!! Cannot remove viruses from Uncle's Computer!!!

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Your Registry is probably fu**ed up. They probably re-download as soon as
they notice they are missing.

Two Things You can do...

1. Run msconfig.

Start>Run>msconfig

Check the "Services" tab. Click "Hide Microsoft Services" checkbox.
Uncheck any services that you are leery of.

Also, check the Startup tab. Uncheck any startup programs you are un-aware
of.

2. A DRASTIC APPROACH - So, if the files are deleted, they come right back.
First, when doing the scan, DISCONNECT FROM THE NET! This way, they can't
phone home. Second. Make a new text-document. Open it, save it as
"filename.exe", where filename is the name of the virus exe. Do this for all
the Viruses, and then swap the files, delete the bad, and replace with the
phonys. This way, if they try to do a status check, an exe still shows up.
It may work...

Good Luck
BMR777

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

If they keep coming back, then you either have NOT cleaned the system or you are being
reinfected. Please perform the following directions...

1) Download the following two items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt307.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM .

2) Update Adware SE
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore...
4) Reboot your PC into Safe Mode then shutdown as many applications as possible.
5) Using the Trend Sysclean utility and Adware SE, perform a Full Scan of your platform
and clean/delete any and all infectors found
6) Restart your PC and perform a "final" Full Scan of your platform
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point


* * * Please report back your results * * *

Dave
BTW: Adaware is for non-viral malware and you have not indicated EAXTLY what the "...17-25
viruses.." are called.




"Unknown" <levevidgea@Charter.net> wrote in message
news 9411BDA-B667-4695-81A1-FA1C03C487AC@microsoft.com...
| Hello...
|
| I 'm having a bit of a problem here:
|
| I use AVG 7.0 (updated every week or so) and when I scan my Uncle Mario's
| computer with BOTH Ad-aware SE Personal and AVG I remove about 17-30 viruses
| from it and then in about 3 minutes another 17-25 viruses show up again and I
| can remove them but they keep coming in.
| Does anyone know how to get rid of those viruses once and for all?
|
| My Uncle Mario's computer is running an up-to-date AVG 7 and Ad-Aware SE
| Personal.
| Can U help me?
|
| --
| Sicerely,
| Unknown
|

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

When its reporting the presence of the infections is it by chance reporting
them in the system volume folder ? If so then
Go to Start>Run and type msconfig Press enter.

When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.

Check the box labeled Turn off System restore on all Drives.


Reboot. Go back in and Turn System Restore Back on. A new Restore Point will
be created.

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

did it report the location as "System volume" by chance ? If so then:

Go to Start>Run and type msconfig Press enter.

When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.

Check the box labeled Turn off System restore on all Drives.


Reboot. Go back in and Turn System Restore Back on. A new Restore Point will
be created.