The Invincible Virus

[Carnage311]

Well to make a long story short I was on myspace and a virus installed some files on my pc (trojans) and now I cant get rid of them. I had zone alarm when it happened. I have tried za, avg, norton, macafee, spybot, adaware, and ewido but nothing works. It has a flashing icon in my quick launch bar that wont go away. The process in the controll panel is guard.exe, but I cant terminate it or find it in my system files. It will pop up like a windows update or something and it says critical system error, virus detected or some shit like that. And nothing is detecting it, oh and its one of those icons that when you click on it it takes you to some companies website to remove it (scam). I have also tried system restore but that didnt work either. It looks like I am gonna have to reformat but I really dont want to, do you guys have any ideas.

 

[Heliocentrical]

These guys have helped me on numerous occasions...

http://www.spywarewarrior.com/index.php

Good luck.

 

[Lethal]

What happens is that the virus/trojan/whatever wheedles its way into your system restore, so even if you remove it, it'll be back on reboot.

odoe told me about Autoruns, check it out. It can help you pinpoint where the nasty is residing.

http://www.sysinternals.com/Utilities/Autoruns.html

 

[RaisedBlock]

Do any of the antivirus programs find anything, or are they just unable to completely remove it?

 

[MiXdNuTs]

Press F8 before windows loads. That will allow you to choose to boot into safe mode. Try that and see if the process still loads. Also, goto start and run "msconfig" and then "services.msc" and make sure that the process isn't listed anywhere there. You may have gotten hit with a rootkit and in that case you need to reformat.
Enjoy

 

[zeplar]

guard.exe could be part of ewido.

If the safe mode suggestion doesn't work, you could also try virus scanning from WinPE or BartPE. I'd be too paranoid, but you could also try moving the drive to another computer as a slave to scan from there. Or rootkitrevealer.

 

[Domingow]

Time to do a XP repair install.

 

[BBA]

http://safety.live.com/site/en-us/default.htm

 

[dBTelos]

You should disable system restore before trying to remove your malware.

 

[digital_exhaust]

Have you tried running HijackThis and posting the log? There are automated analyzers, as well as alot of support forums that offer help with understanding the results as well.
It's always worth a try.

 

[dBTelos]

Have you tried running HijackThis and posting the log? There are automated analyzers, as well as alot of support forums that offer help with understanding the results as well.
It's always worth a try.

I have heard some very bad things about the "automated analyzers" Probably best to get a actual person to read it. But a HJT log is a great idea.

-dB

 

[dBTelos]

Penrow, please edit your post to normal caps. Ty.

-dB

 

[digital_exhaust]

P.S. I LIKE TYPING IN CAPS IT REALLY GETS ATTENTION

Um, wow.

After giving my eyeballs a few minutes to re-adjust, I must say that is some decent advice, although advice that will not exactly help the op solve his immeidate problem.

 

[number69]

If you can't pop that drive into a second machine as a slave or put it in a external drive enclosure(or don't have one) then as mentioned boot into safe mode and try scanning. Disable system restore.

Try this program it's great:

http://www.emsisoft.com/en/software/free/

 

[IceDigger]

Try out NOD32. It works wonders.

 

[dBTelos]

Try out NOD32. It works wonders.

Your talking about NOD32 like it's a pain medication

 

[Carlosinfl]

Can you post a screenshot? I am thinking about blocking Myspace from our corp. firewall & need to know if this comes up on anyones PC. Myspace and Youtube I think are using up way too much bandwidth...