How-To Geek

I have not run across this, but I would be inclined to try Windows Defender Offline and/or Kaspersky Rescue disk. These both run from outside windows and may be able to clear the problem.

You won't know unless you try. Av's do not depend on file names they depend on bit patterns in files.

You are giving too much credit to the offender and not enough credit to the good guys. If it were as simple as you say none of these viruses could be fixed.

Forgot about this thread :)

Ok here's how you can go about beating it if you ever find yourself locked out of the system.

1. Download a rescue disc (I used Avira rescue and recovery but any bootable version should work).

2. Update (is important as the virus works as a backdoor for other Trojans).

3. Run full scan.

At this point I noticed about 28 serious alerts, the reason being the machine was left hooked up to the net.

4. After scan you will have to restart your system.

5. Because of what I noticed in the alerts, I decided to turn off System Restore as they were infected.

6. If you have a decent anti spyware programme installed nows the time to use it, I used SuperAntiSpyware at this point I couldn't update it so I just ran a full scan.

Programme picked up a number of Disablers including :

Task.Disabler = disables Task Manager.

Security.Disabler = disables AV software.

Rebooted machine.

Unfortunately I still couldn't get into the Registry so I restarted in safe mode but safe mode froze up, so I restarted machine normally. Used the Run box to bring up "msconfig" and selected SafeBoot (if you have the same problem in NO WAY TRY THIS for reasons you will understand shortly).

Restarted machine waited for it to go to the Advanced Options menu so I could select Safe mode (it would not do it on its own), selected it and it started to go through the usual safe process then when it came to loading windows it stopped and restarted. Now this loop went on and on I could not get round it, so I tried to boot from an install disc to see if I could get into the desktop that way (to disable SafeBoot) no chance.

So I had no way to get into the registry. (I knew what files I had to look for incase I had to manually delete them).

Anyway to set a long story short it was decided that a clean install was the easiest solution.

So if you ever get this virus and it locks you out, first disconnect from internet (remove internet cable), and gather your bootable and USB virus tools then use them attach network cable and update (if necessary).

Otherwise your machine will be absolutely buggered.

@ CompWiz,

Yea I have but as I say couldn't get into the comp to use it, as system was badly infected.

Microsoft’s own Windows Defender Offline (http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline) sorted it for me.

You need a blank CD or a USB drive to create the boot disk, but the process was very simple, and it worked a treat.