Virus - Changes antivirus/spyware scanners update address to loopback.

[Jayce]

So, my buddy got a virus. He's running XP Pro SP3.

He said he was on dailytimes or something of that nature. It's a video web site. He was looking up concert music videos. Then all of the sudden, every time he would search something in google, it took him to a random ad. He tried IE as well (previously using FF) and it did the same thing.

He had old versions of AVG and Adaware. I told him to go into safe mode and update them. Adaware would not update in safe mode. AVG gave him some kind of an error too.

So on his laptop he downloaded AVG, Adaware, and Spybot. He booted into safe mode WITH networking and installed them. By the nature of safe mode, it still gave him problems.

He booted into regular mode and tried to install them. This time, he got no errors, except when the programs tried to access to remote facility to do the updates. I noticed when it tried updating the IP it pulled was his loopback... 127.0.0.1.

I'm clueless on what to do. He has no system restore points so he can't kick it back a week and see what happens. He's done multiple AVG and Adaware scans with the latest editions from download.com, and even still google will send him to other bogus sites when he searches.

It also likes to randomly reboot itself.

Any ideas?

 

[KSoD]

Hello,

First update AVG to version 8. Then have him go thru our guide.

http://www.techist.com/forums/f51/spyware-removal-guide-osiris-updated-8-18-2008-a-165828/

Cheers,
Mak

 

[Jayce]

We did update to version 8.

 

[KSoD]

Jayce,

then there has to be a virus or spyware on there that is preventing it from updating. Have them go thru the guide and post up the log in the analyze area for review so we can get the bad stuff off of there in order to allow updates again.

Cheers,
Mak

 

[Jayce]

Eff it. He's formatting it as we speak.