[Ex-Dem]

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html

[Reeses]

You can remove her disk drive and temporarily attach it as a slave to your computer. This is about 10 minutes work. You can then access her files, restore her registry to a prior version, restore damaged files or entire directories, or delete virus files.

[proxy_user]

I usually just reinstall the OS and reload all the programs when this happens on one of my machines.

[Agnes Heep]

It's going to be tough to do anything if your keyboard doesn't respond. But I can't see how the virus would do that with a DOS boot. Check to see that your keyboard is plugged into the right place, i.e., that you haven't inadvertently switched it with your mouse. If that turns out to be the case, you might be able to do a fresh installation of windows on the same, or another, partition, which will allow you to boot the system and get rid of the offending files. If you're using Windows 2K (which I suspect is the case, based on the C:\WINNT folder you mentioned) run the installation again and specify that you want a new installation, and give the system directory a different name, such as WINNT2.

[lafroste]

Thank you all for the responses. Unfortunately, None of them worked. The little prick re-wrote all my registries so that it has to be viable to allow any other executable to function. Once I used the Task Manager to find the little ba$tard and shut it down, almost none of my other executables would function, giving a "file not found" error message. On investigation I discovered that it had re-written all my executable paths by inserting a long string similar to a registry string into the path. I couldn't get to the registry because regedit does not function (along with IE Explorer, Netscape, copy, move, delete, chkdisk, format, etc. etc besides all other commercial software)

Clearly, her computer needs to be lobotomized, which I am going to do now by swapping hard drives. Oh well...