UPS email virus?

[Virtual Patient]

Hiya folks ltns,

ok, my bro's computer has been hit by the UPS virus, I assume this is correct because after opening an email supposedly from UPS and clicking a link the computer hasn't worked. The initial behaviour was a warning saying something along the lines of Spyware 2010, and windows has been stopped. Attempts to run AVG failed, it kept stopping the scan before completion. The computer powered off and has been in a non operational state since.

What is happening is when you try to boot the system it comes to a normal looking log in screen (except this computer has no password and therefore should load straight into the desktop). It gives a user to sign in to but as soon as you click the icon it flashes and then logs off (ie saving settings). If I attempt to start in safe mode I get two log on options - user and administrator ...neither of which work, both log straight off.

I tried searching google for information and followed instructions to replace the userinit file with the original on the operating system disk (windows XP Home) via the repair console. This went according to plan, i.e. one file was replaced, but, the system still will not boot, the same symptoms are there.

Any ideas how I go about getting the computer booted enough to actually save off the family photo's??

[jdc2000]

You could remove the hard drive and add is as a slave to another (clean) computer. Then, you could scan it for malware, and also backup data files after scanning them. You might still have to do a repair install after putting the drive back into the original computer.

[Virtual Patient]

Thank you for your reply jdc

I was afraid of that, I have tried two different methods of replacing the userinit file and still windows will not log in.

Any other ideas anybody??

[jdc2000]

If you can get a bootable scan/rescue CD for an antimalware program that can detect and remove the infected files, you might be able to use that to clean off the malware. It might stioll require a repair install though.

[Virtual Patient]

thanks again jdc

have you any idea where I could download one of those?

[jdc2000]

You might check out this link:

http://antivirus.about.com/od/freean...avrescuecd.htm

[Virtual Patient]

Thank you once again jdc for your reply.

I will try those downloads again tomorrow .... I tried today only it seems my cdrw drive has decided to stop working lol.

[buf]

I subscribe to and receive a daily publication from the link this info came from. You might want to try Geek's remedy and I read this just tonight. Good luck.
http://www.howtogeek.com/howto/9207/...-your-machine/

[Virtual Patient]

Thank you buf for your suggestion, problem was I couldn't even get into safe mode so I couldn't follow their instructions.

OK - this is what I have done, I used two of the bootable disks to scan the computer, each of them found and apparently quarantined 18 trojan/infected files. The bitdefender version allowed me to successfully access files that I needed to save. The computer still would not boot to windows after these processes so it has since been formatted and reinstalled.

Thank you once again for your help

[Train]

The bitdefender version allowed me to successfully access files that I needed to save.

Nice to know and thanks for posting that.

I just slave the hdd into another computer and copy/paste what I need off of the problem one.