Malware Stopping all Repair Tools

[RegEdit]

I agree on using the AVG Rescue disc or try Karpariscy (sp ?) rescue cd.

-1
I don't. I've tested a lot of boot CD's and all too often they render the system unbootable. I suspect that they don't load the registry hives.

If you can't find ERD Commander on the web for download then learn how to use BART PE.

From the BART PE desktop:
START > run > Type Regedit
Select the HKEY_USERS hive
File > load hive
C:/Windows/System 32/Config/Software
Open
Give it a random name such as “Hello”
When done editing the registry:
File > unload hive

The startup locations that you want to edit are in the Comp TIA book. Here's a few...
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\shell (sometimes "shell" has been changed and this will prevent booting to the desktop)

 

[Knightsman]

I would say this one needs to be a nuke and pave. Mainly because your going to spend more time standing in front of it than anything.

Sent from my DROID2 using Tapatalk

 

[Encrypted Existence]

did you try renaming the removal programs (mbam for example) to explorer.exe and then running them? also, try launching process explorer from sysinternals' live share(\\live.sysinternals.com\tools) and suspending 93820198843:9389343123.exe. I would start with that. I would try a live cd next.

 

[Rosco]

I would say this one needs to be a nuke and pave. Mainly because your going to spend more time standing in front of it than anything.

I would first try to just rename it in safe mode and stop it from booting in msconfig. I have done this a few times with problem viruses!

there is always a place for "nuke and pave" if it is in the best interest of the client! This just might be one of those rare times(only because your time is worth $$$). I am all for fixing it if possible nuke and pave is a last resort.

 

[Rosco]

just realized this is a old post that has been commented on lol! hope the problem was solved but i guess my advice is mute!