AntiVirus XP

[tommy2k8]

Yesterday, a client of mine rang me and said he's clicked on the greeting card email - the scam that's going round at the moment, and he clicked on the link. Needless to say, AntiVirus XP downloaded itself, and the fake antivirus program popped up with 672 fake 'infections' found. This then tries to dial-up (he uses a SpeedTouch 330) every two minutes. I tried to remove it by following the instructions on 2-spyware.com, so I went into Safe Mode.
The mouse refused to work (it's a wireless mouse) when attempting to go into Safe Mode, so I installed USB mouse, and even that didn't work.
Is this a side-effect of Antivirus XP?

[Mr. Chris]

As far as I understand, USB doesn't work in Safe Mode. Try a PS/2 mouse.

Recommend to your friend either AVG by Grisoft, or the one I use, Anti Vir, by Avira. Both free and very good. Don't forget Spy Bot Search and Destroy, and Ad Aware, for spy and ad ware junk. I use Spy Bot's Tea Timer to detect any changes to the registry, kind of a pain sometimes but works very well. Chris.

[tommy2k8]

Unfortunately, his computer doesn't have any ps/2 ports!

I tried a Windows Repair, but (even with the Windows XP SP2 in, it says it cannot find 'asms' ? Nor can I!
I can't do what Microsoft say either as I can't access the Registry! Or can I, from the Recovery Console?

I'm running out of ideas!

[Mr. Chris]

How did you attempt doing a Repair? With the Recovery Console? If so it never works. Let me know and I'll give you the steps to do a Repair the "right" way.

No PS/2 ports? Must be a newer mainboard. If that's the case then no reason a USB mouse won't work unless the BIOS got hammered. Chris.

[tommy2k8]

I managed to get the USB back, and I ran a Windows Malicious Software Removal Tool, which found nothing. However, while it was scanning I got four BSOD's:

PAGE_FAULT_IN_NONPAGED_AREA

GUS_DRIVER

NIX_STACK_SWITCH

SYSINTERNALS_GREAT_SITE

I cannot find the minidump folder either!

[Mr. Chris]

"SYSINTERNALS_GREAT_SITE" WTF???????????? Oh man that's weird.

The first BSOD error is common to RAM problems, the other 3 are the virus playing jokes. You may have to format and reinstall Windows to get rid of everything. But try this first:

Change boot drive to CD/ DVD drive. Boot up with the Windows CD in the drive. Windows will start to install, then will stop and ask you what you want to do? Tell it to repair an existing installation of Windows.

That's the repair method that has worked for me a dozen times or more. Chris.

[Midniteoyl]

do a search for *.scr first and erase every screen saver you do not recognize. The turn off/delete all System Restore folders.

[tommy2k8]

Another problem has arisen now. I did a Repair, and everything was fine, until I did a Windows Update, after which it wouldn't startup properly. I dad a Repair which worked fine. Then it wouldn't recognise the CD drive, so I followed a procedure from Microsoft, rebooted, then it recognised it again.
On Sunday night, John turned it off, and it said it was installing an update on shut down (the same update it had installed twice before) and on Monday morning it just crashed on the initial loading screen again.

I think it is going to be quicker, and more affordable for him, for me to do a rebuild.

[Mr. Chris]

I never let Windows automatically update. I let it download but not install, then I choose "Custom Install" and I uncheck any updates that I don't want or need. I wonder what it is that Windows is trying to install that his machine doesn't like?

You could reinstall Windows, but like I say if this is an update that is causing the problem, it will just happen again. Chris.

[tommy2k8]

The virus that I posted about originally might still be in there, which is what might be running a script thats making Windows download the same updates at shut down. However, all scans done now are clean