[js1138]

The bugger disabled my system restore feature.

The list of thing it can disable includes:

• System Restore
• Task Manager
• The local drives listed in Explorer (no "C" drive)
• Windows Update
• All programs in the Start Menu
• All antivirus websites.
• Windows Backup

These are just a few of the things I noticed. They can be fixed by editing the registry, but how do you know if you got them all? Time for a clean reinstall.

[Riley]

They can be fixed by editing the registry, but how do you know if you got them all? Time for a clean reinstall.

Not necessary to go through all of that. Try the Combofix utility linked in post 2.

[backspace]

I usually am able to clean these off without much trouble but my son’s pc was infected with a variant of this XP Antivirus that required wiping the hard drive.
The computer was so compromised that it was easier to just reinstall windows. Could not access (directly) c:\; could not access control panel; system settings; all user accounts were restricted; run command and command prompt were blocked; blocked updates from legit spyware and antivirus scanners - this thing was NASTY!

[MarkL]

These are just a few of the things I noticed. They can be fixed by editing the registry, but how do you know if you got them all? Time for a clean reinstall.

In the strain I saw, it also disabled regedit and regedt32. I was able to bring the system up using BARTSbut what I found was that these issues were not done through the registry, but through policies. I also found that it disabled control panel, mmc, and the ability to run programs...

And like you, I did a clean install: But since this was an HP with the installation files on the hard drive, I checked out some of the cab files and noticed that a few files have been changed, so I had my buddy order the recovery DVDs from HP, and completely wiped the disk and did a fresh install.

Mark

[zeugma]

These are just a few of the things I noticed. They can be fixed by editing the registry, but how do you know if you got them all? Time for a clean reinstall.

Yup. The only solution when you've been rooted is reinstall from trusted media.

[Gondring]

It asked me whether I wanted to d/l the file...does it not give the option to some people?