I recently became infected with a virus posing as an anti-virus program. It was immediately detected as a threat, so I ran SuperAntiSpyware to remove it. SAS detected several trojans and tracking cookies, which it removed to the virus vault. I deleted these from the vault and the message came up to re-boot PC to complete the removal of the threats. After re-booting not only was the virus not gone but I could not open any programs in either normal or safe mode. Consequently I reloaded an Acronis image of the OS and everything was restored to normal. The same day a friend rang to say he had been infected with the same virus with the same result as myself. I said he would probably need to format the hard drive and re-load windows. However, he has a lot of data that is not backed up, which would be lost. He is running XP Pro OEM. 1. Is there any anti-virus program that can be run from the RAM on boot-up without opening the OS to try and remove the virus? 2. What would be the best way of saving his data if the OS cannot be cleaned? I had thought of doing an Acronis image onto an external hard drive, and after formatting his original HD, reloading windows and then retrieving the data from the Acronis image. However, I wondered if the data would be infected/corrupted and likely to re-infect the new OS? 3. Is there a program that can be run from RAM on boot up which allows selected parts of the infected OS to be saved onto an external media? And would this data be free from infection? I'm thinking of stuff like video clips, photos, word documents, etec. Any help would be appreciated.