How do I remove the Fake SCANDISK virus 2

[gezster]

Hi,
One of my users "got a message says they needed to upgrade their antivirus, so clicked on the the Popup". DOH,.. and how has the the Fake scandisk Virus.
I maged to get rid of most of it, but after a reboot,the files appear again.
These files ar c:\windows\system32\xloadg66.dll,c:\users\USERNAME\AppData\Roaming\xloadg66.dll, c:\users\USERNAME\Appdata\Roaming\Windows\Startup\Scandiskg66.dll,c:\users\USERNAME\Appdata\Roaming\Windows\Startup\scandisk.lnk.
In MSCONFIG, there are startup reg values that, when I disable them, reactivate themselfs.
When I run regedit and manually delete the keys under RUN, they re-appear straight away.
Run32dll.exe is running (with xloadg66.dll) and I'm unable to stop it (even as admin).
From another PC, I can connect to the the pc's c$ and delete the files, but as soon as the the user logs in again, the files appeer.
SO,... the obvously a rouge service, exe, batch files that I can find running on start up that keeps re-infecting this PC.
AVG is run and "removes files on reboot", but they come back.
Same thing happens using malwarebytes and spybot.

PLEASE....does anyone know what I missing, or a free prog to delete the re-infecting element ?

If more info is needed, LEt me know and I will supply.

Cheers

 

[edfair]

There is a service running whose sole purpose is to reinstall those programs when you delete them.

You might try killing system restore, then reboot to safe mode and run microsoft's anti-malware.

These for starters.



Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[goombawaho]

1. MalwareByte's Anti-Malware if the above doesn't work
2. Combofix if nothing else works.

Keep system restore until after removing malware. Then turn off system restore, reboot, turn on again.

Better safe than sorry with S.R. If you whack them before malware removal and there's a big problem, you can't use them. I know there's a philosophical difference about whether to remove them ahead of malware removal or after. I always do it after.

 

[goombawaho]

More on the S.R. debate:

http://msmvps.com/blogs/spywaresucks/archive/2005/09/17/66724.aspx

 

[gezster]

goombawaho - BRILLANT. Thank you. Virus eradicated and "tale Tale" signs of it being back (ie Xload etc) are not visable.

Thank you edfair for your advise and quick response, goombawaho's was easier to do remotely.

 

[goombawaho]

I would definitely say NOT brilliant - that's my standard answer when anyone even whispers the word malware. But, glad you got it fixed and thanks for the star. I be lovin' them stars.