A coworker of mine alerted me to a window claiming that she was infected with trojans/viruses/malware, and if you buy now, your system will be cleansed! It appeared to have launched itself following a visit she made to a .gov domain. I immediately recognized that it was not AVG, which is our installed AV of choice, and pulled the network cable from the back of the system. I am afraid I do not remember the name of the program, other than it was something like "Antivirus XP" or some other generic security sounding name. Using Process Explorer, I found, I think it was called aup.exe, in the C:\Documents and Settings\usernamehere\Local Settings\Application Data directory. Just a single exe file, sitting there, today's date stamp (3-30), time matching roughly when the window appeared. I stopped the process and deleted the exe, and it never came back. What did happen is a bit more annoying. It seems to have removed the system's ability to run any programs, as well as deleted some vital system tools like msconfig, regedit, and the help center. I tried doing a manual system recovery (rolled it back to Monday morning) from the XP install CD recovery console, but that didn't appear to restore any functionality. Obviously this makes it difficult to run any tools such as MBAM or hijackthis, but I think at the same time it may also be preventing the malware from loading up again. At present the system does boot up, but no startup programs, either in the start menu group or in the registry load. There is very basic functionality, like task manager and Windows Update will work, but trying to run something like Notepad just gives me the "what program do you want to use to open this file" dialog box. I really don't want to reinstall the whole thing, but it's looking like I may have to if you guy don't have any ideas on how to get this computer back on track. Whatever this thing is, it got past the most recent version of AVG, so it's either new or it's a new variation on something else.
I'm just about to leave work now, so I won't see or be able to respond to any replies for the next 2 hours or so. Any ideas would be appreciated.
Back to top
