Friday, May 28, 2010

rogue virus leading to antispy-guide.net

My wife's computer was infected by a rogue virus. It's constantly asking to buy anti-virus software from antispy-guide.net. And it blocked the execution of other program by saying they are infected.
The only exception is browser. You can still open a browser. Apparently, they don't want to block the way so that the infected user can purchase their software.

Here is how I dealt with it:

In explorer, copy \windows\system32\taskmgr.exe to some other place. Then rename it as firefox.exe and run it. Now the task manager appears. In the task manager find and kill a process with a very strange name which unfortunately I forgot what exactly it is. And I also deleted the corresponding .exe file from the file system.

Now everything is back to normal. I am not sure this is a permanent fix. But so far so good.