Nasty ransomware disables system

A coworker of mine alerted me to a window claiming that she was infected with trojans/viruses/malware, and if you buy now, your system will be cleansed! It appeared to have launched itself following a visit she made to a .gov domain. I immediately recognized that it was not AVG, which is our installed AV of choice, and pulled the network cable from the back of the system. I am afraid I do not remember the name of the program, other than it was something like "Antivirus XP" or some other generic security sounding name. Using Process Explorer, I found, I think it was called aup.exe, in the C:\Documents and Settings\usernamehere\Local Settings\Application Data directory. Just a single exe file, sitting there, today's date stamp (3-30), time matching roughly when the window appeared. I stopped the process and deleted the exe, and it never came back. What did happen is a bit more annoying. It seems to have removed the system's ability to run any programs, as well as deleted some vital system tools like msconfig, regedit, and the help center. I tried doing a manual system recovery (rolled it back to Monday morning) from the XP install CD recovery console, but that didn't appear to restore any functionality. Obviously this makes it difficult to run any tools such as MBAM or hijackthis, but I think at the same time it may also be preventing the malware from loading up again. At present the system does boot up, but no startup programs, either in the start menu group or in the registry load. There is very basic functionality, like task manager and Windows Update will work, but trying to run something like Notepad just gives me the "what program do you want to use to open this file" dialog box. I really don't want to reinstall the whole thing, but it's looking like I may have to if you guy don't have any ideas on how to get this computer back on track. Whatever this thing is, it got past the most recent version of AVG, so it's either new or it's a new variation on something else.

I'm just about to leave work now, so I won't see or be able to respond to any replies for the next 2 hours or so. Any ideas would be appreciated.

An update on this issue.

I went browsing through the Spyware Removal pages here, and I found one that matched what I have. It is the XP Security Tool 2010. I'm working the steps to remove it now. Luckily, I did not empty the recycle bin after I had deleted the nasty exe, so I was able to restore it, and became able to run MBAM, which is scanning now. I do want to note, that this copy of MBAM was unable to update it's files since I did not plug the network cable in, but since it is a newly downloaded copy, it shouldn't be a problem, right?

Anyways, keeping my fingers crossed here that this goes well.

You can "manually" update Malwarebytes using this file:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Download the file, copy it over to the problem computer then double-click it to install the updates.

You can "manually" update Malwarebytes using this file:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Download the file, copy it over to the problem computer then double-click it to install the updates.

Thanks, but it looks like the installed one did the trick, as the system no longer is plagued by that stupid thing. Just to be sure, once the system rebooted from the repair, I plugged in the cable, updated MBAM, and ran a 2nd scan that came back clean, so I guess this topic can be closed. I love this site. Who needs Google when you've got bleepingcomputer.com.