Blaster virus back?

[rocye]

Hi to all! Newbie here.
A friend of mine is runnign XP on a PC. Last week he went around clicking on used car sites and ended up with a problem...
NT Authority is shutting down the system in 60 seconds....
From what i read here on the forum, this was a big issue back in 2003 & 2004.
It seems that it was a hit-or-miss as to who was able to get rid of it and who could not.
Well, it seems to be back. He was getting the shutdown every 15 minutes.
It also successfully turned Avira AV OFF and deleted the registration so it could not update.
i did the following (got all this from posts on this forum from 2003:
Disconected from Internet
Went into Admin Tools and set Services - Recovery - 'Take No Action' on all
Turned System Restore OFF
Emptied Recycle Bin
Emptied PreFetch folder
Checked Processes for Blaster (or variations) - None Found
Checked Registry for Windows AutoUpdate entries in MS\Current Version]Run - None Found
Attempted to load MS Patch (from 2003). System rejected install based on a newer version already present
Ran Avira System Scan - Removed 8 Trojans
Ran AdAware - current Version---Clean
Restarted Computer
Turned System Restore ON
Connected to Internet
Updated Windows - No updates required
Updated Avira A/V
Pop-Up for NT Authority came on.
Executed START - RUN - "shutdown -a" to stop shutdown
Ran Avira full system scan - Clean
Ran AdAware - Clean

The only thing I did not do is turn the Recovery settings back to normal. Just forgot.

Can anyone shed any light on what I might try next? Has anyone encountered this issue again? I don't know what else to do.

 

[Tmagic650]

Run Combofix, but follow the instructions carefully:
Combofix Download and Instructions

 

[LookinAround]

Run Combofix, but follow the instructions carefully:
<snip>

Ummm.... "Follow the instructions carefully?"

But the combofix "instructions" clearly state

A bug appears to be present in ComboFix. Please do not use it until the bug is resolved.

And, equal if not more important, they also state

due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

So how does one point someone to it (let alone a newbie?) and tell them to use it and they're on your own?

/* edit */
just trying to say, i don't think this is a good "standalone" link to pass along...