Not very cool virus

[Anonymous Danny]

Hey, not quite sure where to post this, so I guess here will have to do. Big problem that I'm helping a friend with. Yesterday, a friend of ours on AIM had a virus. This virus sent a link to everyone on his contact list without his consent, including myself and my needy friend. Stupidly, we both clicked on this link and downloaded the strange file. Again, stupidly, we ran this file. After I got a warning that this was a virus I immediately went to work on it, stopping from what I can tell, everything it was going to do. My friend however, was not so fortunate. The virus on his computer has now disabled him access from the internet and prolly is doing some other stuff. Now I'm trying to help him out but am looking for advice. Should he do a system restore primarily? Or should I get him a copy of Hijack This and have him send a log file? I know the information is sketchy but is there anything anyone can advise?

 

[mikescorpio81]

Sounds messed up ...

Sounds like your friend may have to format ... although thats my answer to everything!!

lol! :haha:

 

[RealBlackStuff]

You could try a system restore with a date from BEFORE the infection.
Try if it's OK. Then switch OFF System Restore to flush all the junk, and switch it ON again.

If that does NOT work, go to this post here first, and follow the instructions EXACTLY, especially about UPDATING and HJT-location.
How to remove Begin2Search/Coolwebsearch and Other Nasties

Burn all those programs and the instruction file onto a CD and take that to your friend.

Then see How to post your Hijackthis log-files as an attachment.