Searching "whole string"? Try searching for "fuc", not "fu*ker". And do some search for "antivirus" or "antivirus.bat", too.
Manually checking these sections (that Bestia(ry) posted) is important. Look for anything suspicious. It needs NOT be "fuc*er" or "antivirus". It just needs to be something out of place.
Checked already (take a look at his screeners). Like I've said before, as long as there isn't every single trace of that s*it removed, it will rebuild itself over and over again ... Btw. ... dun ever let your fren using your PC again. ^^
Yeah, I just saw them. I think he has to screen for every possible iterations of the words fuc*er and antivirus, both in the registry and also the file system.
Guess he won't do, but the best would be killing all partitions and perform a fresh install ... Like I've said, that thing is really uncommon and hardly any1 knows something about it. Checking AVS- and spyware-libraries, it's nowhere to be found.
Ok. will do tat after i finish my supper.. Btw if i format my C drive will it get rid of the problem?
Only if that thing is not nested in other partitions, too. Sorry to say, I think it is. But you can try, you'll see if or if not.
If there is an entry like the one before in each of 'em ... yes. Don't do it when there are other entries, too. If so just delete the string with "fu*ker".
I have deleted the folders and during normal boot i cant find the string in the registry anymore.. But the problem is still there..
So it is still loaded somewhere or else it was enough to load it one time, maybe ... Kill it, fill it. Means, I'd recommend a fresh install.
I guess i have no choices left. I wont be able to reinstall it maybe until April coz i'm having lots of tests this month. Anyway thanks a lot Bestia(ry)!!
Well, I once got infected with a virus. Different than yours but it also utilizes .vbs. I need to uncheck "Hide protected operating system files" to view those .vbs scripts in each and every of my partitions. Try uncheck it and do a search. Well, don't think it'll matter, just suggesting. EDIT: Ooops, I think the virus I got infected uses .vba not .vbs
