I'm in the process of cleaning up a virus from a friend's computer and so far I've managed to have the windows runtime clean. However, after a reboot the malware reappears. Another symptom is that the infected computer can't boot in safe mode.
My suspicion so far was that it's a malware service or a driver that's causing this, the latter being the most favorable option esp. given the safe mode problem.
However, after repartitioning, reformatting and reinstalling windows, the virus-related processes are still there. Not initially, but shortly after the first boot.
Just to mention - it's a Win XP box, has 2 partitions and the reinstallation and formatting was done on the partition where the OS was installed. The other one has only data but as I haven't started anything from this partition, I can't think of some automatic system process that could have executed an already infected EXE file.
Can anyone propose ideas on how/where this thing is hooking up so that it reappears after reboot and reinstall? I've checked the standard registry entries (Run* for HKLM and HKCU), all suspicious services are disabled, nothing fancy in the INI files (through MSCONFIG), etc.
ANY ideas are welcome! This is the most irritating malware I've ever had to deal with... (I'll write some other time how I cleaned up the runtime :))