XP Antivirus 2012 - repeated infections - what to do?

[MobileTechie]

Often the virus turns it off but you can turn it back on again.

If I can use it, I too use system restore as the first port of call. If you can get it working and if it's not infected then it's the best possible fix - quick and complete. Obviously it's not always like that.

 

[OldSchoolPC]

+1 for using System Restore first. Then, after restoring it run whatever antivirus/antimalware programs you have plus HijackThis and Autoruns etc.. Alternatively, use the Registry Restore in UBCD4WIN and then run such programs remotely.

 

[glricht]

OK, so I've had 3 more PCs with this same virus now. Removal is easy, but I have now found where its coming from. All of my customers who have brought in a PC with this virus have said they were on their Hotmail when they got infected. I did some Googling and others have said it comes from Hotmail. Does anyone know a bit more about this?

I've had a few customers with this and they all came in via an email with a "PDF" attached. Wasn't really a PDF, it had a name such as "See This File.PDF.exe" - people with extensions turned off only saw the PDF extension.

Two of the customers got it from a phishing-type email supposedly from the IRS that said their recent payment had been canceled.

 

[mraikes]

OK, so I've had 3 more PCs with this same virus now. Removal is easy, but I have now found where its coming from. All of my customers who have brought in a PC with this virus have said they were on their Hotmail when they got infected. I did some Googling and others have said it comes from Hotmail. Does anyone know a bit more about this?

Hotmail, MSN, Yahoo, etc are not unusual sources.

Here's a thread that may shed some light: http://www.technibble.com/forums/showthread.php?t=28552