Posted 24 December 2009 - 02:04 PM
Hello and thanks alot for helping us!
I have an XP machine in my home network that got infected with IS 2010. When I start the computer (in safe or normal mode) i get a fake welcome screen (the blue Windows welcome screen) with the "administrator" button. I am sure its fake because I see the desktop "flash" for a split second before the fake screen covers it. I can't get past this fake start up GUI to take your recommended countermeasures. I just need a clue so I can get "in" and get this scourge out! I am a veteren of fighting the AV 2009 war so I know something about these things. Anyway, I have already taken one interesting countermeasure. Since I couldn't get past the fake start screen, i removed the hard drive and attached a raid to USB adaptor cable. I then cleaned the drive by scanning it with MBaum from another machine thru the USB connection. Both Mcafee and MBaum found numerous infections and cleaned them. But upon retrying I still get the fake screen when I reboot with the cleaned drive in the first machine. I repeated the cleaning procedure and the infections had regenerated. Any ideas how to get past the fake screen or to clean remotely with the 2nd machine?