Virus

I usually have success by fixing my problems in Safe Mode. Take these steps:

If you know what virus it is, go to http://securityresponse.symantec.com/avcenter/tools.list.html and get the approproate application to clean the virus. If not, follow these steps:

1. find out what files are causing this problem (and the file locations)
2. if you can, download the virus definitions from the Symantec's web site (http://www.symantec.com/downloads) to manually install them later.
3. restart the computer. While the computer is restarting, keep tapping F8 until a menu appears. From there, choose Safe Mode and boot the computer.
4. Once inside Safe Mode, update Symantec and then run it to see if it is able to remove the virus. If not, manually delete the files you found to be suspect earlier. But, be VERY CAREFUL that you do not delete critical Windows files. I would probably use Google.com to verify that the files aren't critical Windows files.
5. Reboot.

This should take care of your issue. If not, let me know.

In addition to checking for viruses I would install and run a malware app like AdAware or Spybot Search and Destroy. These apps might not be detected as viruses but are pesky malware apps. If the user cannot get onto the web you will need to put them on a cd for him and let him install them from Safe Mode (although he won't be able to update them initially unless you can dowload the current update and put it on the cd too). After runing them ad cleaning things up then he can boot normally, go on the net, do an update and run them again.

Here's some links:

http://www.lavasoftusa.com/support/download/

http://www.safer-networking.org/en/download/index.html

Cheers.

RW

Typically viruses are much easier to deal with than spyware. We're getting systems in our shop now that have adware trojans running on them that even our experts cannot get rid of. Unfortunalty there is NOT a silver bullet answer to your question or a single magic program that you can run that will solve your issues despite the claims.

Our usual course of action involves editing the registry, pulling the drive and slaving it to a good system and scanning it that way, manually removing files and so on. Not a task for the faint of heart. I would recommend obtaining a copy of a free utility called HIJACK THIS and run a check. there is an option to save the results as a log.

DO NOT START CHECKING AND REMOVING ITEMS!!. Unless you know what you are looking at, you could seriously hose your system. Submit the log file to this discussion and we can help you a little more in depth. Chances are good that you have some nasty spyware and the only way to effective way to deal with it is to have a more experienced persion look at the Hijack This log and make recommendations. Much of the time, removal also may require editing the registry, going to extreme measures to remove trojans that "heal" themselves because they are running in memory and so on. Depending on your skill level, it may be that the only effective way to deal with it is to re-format and start over.

In summary, submit a hijack this log and lets see whats happening. By the way, forget system restore, that will not help but only hurt in a viral situation.

hope this points you in the right direction.

Robert

did you try downloading and running Stinger from www.mcafee.com. it will go on floppy. boot in safe mode and run it.