What a mess! HELP!!

[bgjon5]

Ok so I have this laptop that a friend ask me to look at for him, so I can usually fix mostly anything virus/ trojan related but this one is pretty bad lol, so here are the basics:
Its a Gateway laptop running XP, it is infected with AntivirusPro_2010 I know the history behind these fake antivirus programs and can usually get rid of them with Combofix etc, but its so bad on this Machine that it freezes everything on startup in either Safemode or reg mode..Ive downloaded Hijackthis off of a cd and combofix but cant get either of them to run, I cant access the task manager (since its taken over that too) to disable the processes that are ran by Antiviruspro so where do I start? how can I get the system stable enough to be able to run the programs to remove the trojan?

[Paul Komski]

I recently removed AntivirusPro_2009 from a client PC. ComboFix didn't get it; it appeared to clean-up but the thing always came back. It did however run - even if things took a very long time to complete. MalwareBytes however worked to a perfection but ComboFix had at least run beforehand.

It sounds as if AntivirusPro_2010 is even worse so no promises and no guarantees that any security apps will even run. Perhaps you could remove the drive and USB-it to your own PC and try and scan it from there with MalwareBytes; no guarantees once again. The risks are all yours as well.

It was removed apparently at this forum (http://www.atribune.org/forums/index.php?showtopic=5801) but if you hang-on I expect that one of our own experts will advise.

It is a sort of heresy here but, depending on the complexity of the system, it can often be quicker and cleaner to backup data, wipe the drive and clean reinstall.

PS Found a removal page at Beeping Computer (http://www.bleepingcomputer.com/virus-removal/remove-antivirus-pro-2010).

[mjc]

It is a sort of heresy here but, depending on the complexity of the system, it can often be quicker and cleaner to backup data, wipe the drive and clean reinstall.

Unfortunately, the fact that these things are getting harder to remove without causing major damage in the process is making the wipe & reinstall route a much more viable/recommended option. The key is data protection, though. If there is anything you absolutely need to preserve, you will need to get it off the machine with the infection, before you wipe and reinstall. This can be done with slaving the drive (preferably in a USB enclosure) or with a bootable disk, like a Linux LiveCD and a portable storage drive.

[bgjon5]

Unfortunately that was what I was thinking would be the best option....