Struck by Live Security platinum

masplin said:

I have run Malware, Rootkiller, Windows Defender offline (which found some things to remove).

Do you remember the name of these items it found? The name of these viruses will be a deciding factor in what actions you should take.

Some viruses do remove restore points or deny access to them. And they also like to embed themselves in restore points, usually the first one. If you can access a restore point after an infection, it's best to go back 2 or 3 points. Unfortunately, some viruses corrupt the entirety of restore points.

You could try the restore point in Feb, but that does seem odd there are no others, since you've no doubt had updates from MS and they, by default, make a restore point before installing.

Personally I would not use any restore point because they can be infected. I also would not use any back ups that where made any where the time of the found infection. Infection can be installed with a time delay or a action related start. Example: When and if you hit the Windows Flag Key you could activate the infection. It could be anything along that line.

Good point Layback. This is why when I make system images, I keep the last 4 of them on file so that if I do inadvertently make a backup with a virus, I can go back even farther.

When was this system image made? Was it made before or after the infection?

Being that the only restore point you have is Feb, it's a good chance your restore points are infected.

Open an elevated command prompt, then type or copy/paste:

net localgroup Administrators /add networkservice
press enter
then type:
net localgroup Administrators /add localservice
press enter
then type:
exit

press enter and restart your computer

Open services and make sure the service is started.

It might be wise to re-run Windows Defender Offline, just to verify that nothings left on your system. If it finds anything, write the name down.

WDO is good at getting a lot of things, however it can not remove certain items, including some rootkits. If you've been infected by the Sirefef rootkit, MS is recommending a clean install as this alters some of the OS files & leaves them in a irreparable state.