Inactive Virus posing as anti-virus

[Poppa Bear]

I recently became infected with a virus posing as an anti-virus program. It was immediately detected as a threat, so I ran SuperAntiSpyware to remove it. SAS detected several trojans and tracking cookies, which it removed to the virus vault. I deleted these from the vault and the message came up to re-boot PC to complete the removal of the threats. After re-booting not only was the virus not gone but I could not open any programs in either normal or safe mode. Consequently I reloaded an Acronis image of the OS and everything was restored to normal.

The same day a friend rang to say he had been infected with the same virus with the same result as myself. I said he would probably need to format the hard drive and re-load windows. However, he has a lot of data that is not backed up, which would be lost. He is running XP Pro OEM.

1. Is there any anti-virus program that can be run from the RAM on boot-up without opening the OS to try and remove the virus?

2. What would be the best way of saving his data if the OS cannot be cleaned?

I had thought of doing an Acronis image onto an external hard drive, and after formatting his original HD, reloading windows and then retrieving the data from the Acronis image. However, I wondered if the data would be infected/corrupted and likely to re-infect the new OS?

3. Is there a program that can be run from RAM on boot up which allows selected parts of the infected OS to be saved onto an external media? And would this data be free from infection? I'm thinking of stuff like video clips, photos, word documents, etec.

Any help would be appreciated.

 

[Bobbye]

3. Is there a program that can be run from RAM on boot up which allows selected parts of the infected OS to be saved onto an external media? And would this data be free from infection? I'm thinking of stuff like video clips, photos, word documents, etec.

Not as far as I know. This is why we tell users to backup before here's a problem!

It sounds like you (and maybe your friend) has a rogue fake antivirus. This is pretty common. IF you had come here before the reimage, I would have suggested going through the Preliminary Virus and Malware Removal thread HERE.

After re-booting not only was the virus not gone but I could not open any programs in either normal or safe mode

I suspect that you either had a badly infected computer or one with more than just thee rogue program.

I recommend that you suggest this removal to your friend and tell him there is no assurance that what he backs up will be infection free. The depth of the infection would also depend on what the malware infection is.