[Hidden-tech] Ack! 'System Media Codec' virus

[Kiernan G-S]

I second the suggestion for Malwarebytes (www.malwarebytes.org)
(download to a usb flash drive and install/run in safe-mode of course)

There is also a great tool released by AVG (for free)  called the AVG
rescue CD -- a bootable virus/spyware scanner CD:
http://www.avg.com/ww-en/avg-rescue-cd

If neither of these work, I recommend downloading Hiren's Boot CD
(http://www.hirensbootcd.net/)  -- the latest version comes with a
small bootable "mini-windows XP" environment.   You can boot into this
and manually delete the files that you are having trouble removing
from within Windows.

Good luck,
~Kiernan

Head Technician - Green Earth Computers
www.greenearthcomputers.us
Kiernan at gmail.com
413-282-TECH


On Sat, Apr 17, 2010 at 6:09 PM, David F. Farkas <david at farkas.com> wrote:
>   ** Be sure to fill out the survey/skills inventory in the member's area.
>   ** If you did, we all thank you.
>
>
>
> I've been trying to sanitized my desktop from the System Media Codec virus. It intercepts anything and everything with a popup that goes to thier web site.
>
> I've worked in Safe Mode with SpyBot, Registry Cleaners, and a special tool for this virus that I download. And... the I'm still getting pop ups and the machine is compromised... now it's even defaulted to 640 x 480 desktop with blue background. <sigh>
>
> Help? Puleeeze?
> Thanx
> David
>
> --
> !¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!
>
> DAVID  FRANKLIN  FARKAS
> www.HouseHealing.com
>  Remote Healing for Real Estate, People & Business
>
>  Web Site:  www.HouseHealing.com
>       Email:  david at HouseHealing.com
>      Twitter:  http://twitter.com/HouseHealing
> FaceBook:  www.facebook.com/d.f.farkas
>   FB Page:  http://tr.im/HouseHealingFan
>
>  Snowmen  Fall  From Heaven...  Unassembled
>
> !¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!¡!
>
> No trees were destroyed by sending this message.
> However, many electrons were sorely inconvenienced!
>
> _______________________________________________
> Hidden-discuss mailing list - home page: http://www.hidden-tech.net
> Hidden-discuss at lists.hidden-tech.net
>
> You are receiving this because you are on the Hidden-Tech Discussion list.
> If you would like to change your list preferences, Go to the Members
> page on the Hidden Tech Web site.
> http://www.hidden-tech.net/members
>