I know this is quite an old topic, but I thought I'd add a solution I
found as I had the same problem with a computer I was trying to repair
and did a search on Google for a solution, this answer came up so
hopefully my reply might help other people.
First and most important thing to do before starting to attempt to
remove a virus is where possible to take the computer off the network so
it doesn't have access to the internet (if possible pull the ethernet
cable out the back, or remove the wi-fi card or turn off your wi-fi
router). The reason for this is to ensure that the virus itself can't
update itself via the internet whilst trying to remove it (if you get a
recent antivirus program from the internet you might get lucky and find
out they've found a way to kill the virus, but if you leave the computer
plugged into the internet the virus will update itself to get round the
problem, it's a game of cat and mouse).
The problem seems to be in Safe Mode. I think in Safe Mode you can't
run the Windows Installer, the only problem with this is that if your PC
is infected in Normal Mode you can't install anti-virus software anyway
because the virus will stop it (the obvious solution is to install AV
software before you get a virus and ensure it's constantly up to date,
but that doesn't really help when you have a virus and can't get rid of
the thing!).
The way I got the antivirus to install was to locate the files that
were running on startup that belonged to the virus in safe mode and
prevent them from running (just disabling them in MSConfig doesn't
always work, a lot of viruses have other "hidden" programs that
re-enable the programs you've just turned off, so here is the
solution...
Run MSConfig in safe mode, look down the list of programs for strange
programs that are starting up (usually if it is a virus it will be in a
non-standard location - e.g. C:\Windows or C:\Documents &
Settings\Application Data, normally most programs should be in
C:\Program Files, so if it's not in there query it, even if it is in
there and it has a strange name query it.
The easiest way to find out whether the strange program is just some
part of a driver for something or a virus is to use Google, if you enter
the filename that is running e.g. ld08.exe into Google's search there
are about a dozen websites that all give information about what this
file does (and whether or not it's a potential threat).
If it is firstly disable it, then go and find it (just to stop the
virus re-activating itself on restart). When you've found it (either
use Windows Search to find it, or use the path name given by msconfig,
where no path name is given use windows search). Sometimes you still
wont find it, if this is the case ensure that you go into Tools menu of
My Computer and Folder Options, go to the View tab and in the "Hidden
Files and Folders" section ensure that is set to "Show Hidden Files and
Folders", untick the box "Hide Extensions for Known File Types" and
untick the box "Hide Protected Operating System Files [Recommended]", at
this point Windows will warn you that editing these files may cause
problems... just click yes, you should be fine as long as you don't go
playing with any other files other than the ones that are possible
viruses - one important note here though if any of your files is called
svchost.exe do not touch this file at all, some sites claim that this
can be a virus, this is not a virus, it is a vital system file, that
runs quite a lot of different things (sometimes viruses can use it to
access the DLL files, unless you really know what you are doing your
best leaving this one well alone, and not even disabling it in
msconfig).
Once you locate the virus file change it's extension from .exe to
something else e.g. .bak or .vir or something, very important - do not
delete it!
Repeat this for all the other programs that are suspected viruses -
another important note, just because you found one program that is a
virus that most probably wont be the only one, many viruses use numerous
programs to ensure that even when you disable one the others continue on
and re-activate the ones you've disabled, even when you've deleted the
files! Also not all the virus programs will be in the same directory,
some virus program even masquerade themselves as anti-virus programs (if
you suspect your antivirus program is in fact a virus the best
recommendation I can give is to download a 30 day trial of some of the
other top virus killers that sites like pcworld and cnet recommend, I
certainly recommend ESET's NOD32 myself, and only download them from the
companies official site or CNET as these links are usually verified,
where as other links can take you to dodgy sites that try and clone
these top virus killers)
Once you've done this to all the files you think are possibly viruses
restart the computer into normal mode.
Now if all is well the computer should be working and you should have
regained control of the computer.
If this is the case run the anti-virus installer and it should install
fine, then do a complete scan of your system ensuring to clean or delete
anything the virus killer finds as a virus, I recommend doing a complete
scan and not a mild scan (like a "smart scan"), scan every file,
archive, etc, regardless of whether it's an exe file or not (as it's
scanning it should pick up on the files you renamed .vir or .bak or
whatever and delete them, it should also pick up the file you downloaded
that infected your computer).
In addition ensure you clean out your "System Restore" as the virus can
also hide in there, and virus killers can't remove things from there.
--
TheKLF99
------------------------------------------------------------------------
TheKLF99's Profile:
http://forums.techarena.in/members/103949.htm
View this thread:
http://forums.techarena.in/windows-xp-support/930671.htm
http://forums.techarena.in
