Win32:SdBot-2975 [Trj] and Win32:Trojano-3005 [Trj]

[plainplow]

I have included the virus warnings received on a computer named MMILLER.  She had a virus/malware attack from a virus associated with AdTech.  I ran a virus and anti-spyware scan at that point, but the pop-ups she is still exeriencing did not go away.  What should I do to rid her of these pop-ups apparently caused by these two viruses?


avast! [MMILLER]: File "C:\windows\srvsc.exe" is infected by "Win32:SdBot-2975 [Trj]" virus.
"Resident protection (Standard Shield)" task used Version of current VPS file is 0550-0, 12/10/2005

avast! [MMILLER]: File "C:\WINDOWS\adtech2006.exe" is infected by "Win32:Trojano-3005 [Trj]" virus.
"Resident protection (Standard Shield)" task used Version of current VPS file is 0550-1, 12/13/2005

avast! [MMILLER]: File "C:\Documents and Settings\khairston\Local Settings\Temporary Internet Files\Content.IE5\SLYNO9ER\Myspace_11[1].com" is infected by "Win32:SdBot-2975 [Trj]" virus.
"Resident protection (Standard Shield)" task used Version of current VPS file is 0550-1, 12/13/2005


Paul Weir
Fort Atkinson, WI

[Lisandro]

Is she you using Windows XP? Can she schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives.
Boot.

Other option is scanning in SafeMode (repeatedly press F8 while booting): http://support.microsoft.com/default.aspx?scid=kb;en-us;315222

Other good thing is disable System Restore, boot, enable it again. If you find a virus keeps coming back after you delete it, it's most probably infected the System Restore folder, the best way to solve this is to disable System Restore, reboot your machine and then enable it again. After all, run a full avast! scanning. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k.
Enable/Disable System restore on Windows ME: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887
Enable/Disable System restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

Oh, last thing, clear Recycle bin and the Internet cache (temporary files)