I'm no expert on removals but to add some unwelcome pessimism, be sure to check your system carefully after system restores. Even a full format & reinstall of the OS can be reinfected in seconds after the first full boot up. Some of the more sinister packages out there are now downloading fake bios updates for components. These infected components (once untouchable) remain infected and can trigger the reintroduction of the unwanted package.

For those wondering WTF I am talking about, I'll try to explain.
One of the nice things about being connected to the Internet is that if you buy buggy hardware, there is often an update available as a download to fix it. What used to be permanent ROM on motherboards and components is now up-datable and the extremely ambitious villains are now taking advantage of this.

As a very recent axample that I have seen first hand, a former workmate of mine has been struggling for over a month now after realizing his laptop was hijacked by some malicious code. Even though he is a computer geek of the elite kind, he only became aware of this after becoming a waypoint for a DOS attack and had his ISP send his IP to nullsville land for a while. In short, he was denied any and all Internet access and was told he was part of a DOS attack when he called the support line to see what was up.

After multiple failed removal attempts, restore points, system wipes, installing alternate OSs from USB sticks, etc. He used a utility in Linux to look at all the BIOS loads on his hardware and discovered that the BIOS for his onboard video card had a suspicious looking name to it. Further research showed that this was indeed an infected copy of the manufacturer's BIOS and was likely loaded by a trojan like zeroaccess that has the ability to download and install other items.

So far, the code in the BIOS is holding open thousands of ports that any software firewall can't seem to overcome and if you go so far as to try and format your machine clean, it simply waits happily on the video card for you to reboot and then re-downloads an appropriate virus package for your OS. So far it has instantly infected WindowsXP, Windows 7 and 2 flavors of Linux.

Running an OS from a read only USB drive prevented the full package be reinstalled but its' not perfect and his ports are still wide open so his laptop can only be used for limited functionality.

He tried downloading the BIOS update from a clean machine, placing it behind a hardware firewall, booting from a protected USB and then finally running the BIOS update but the BIOS no longer allows itself to be updated. He tried calling the makers of the card but could not receive anything past the usual scripted support answers to his very specific questions on BIOS updates.

He still has it isolated behind a hardware firewall to keep it clean from the secondary infection that makes him a DOS relay but he can't close his ports or remove the bad BIOS.

My super advanced technical advice was to brick the damn thing. It's a 2 year old laptop that was under 400.00 new. He is determined to figure it out as a personal challenge now. So far, he remains defeated.

Rewriting a BIOS would be no simple task and the location the DOS attack was targeting combined seem to indicate that this was more than just the efforts of a muddling teen in a basement trying to get a few VISA numbers.

ANYWHOOOO
I know that didn't help at all but I thought some people on here might find it to be an amusing story.


With great power comes Awesome irresponsibility.