Is there a way to install an antivirus program while in safemode?

[Woozie]

My friend brought her laptop over to figure out what was wrong with it. Her computer wont booty normally, so I have to boot in safe mode. (When I try to boot it normally I get an error that says "a problem has been detected" - something about "driver_irql_not_less_or_equal".)

Her problem is that she tried to download a game through limewire. It came as a rar file, but when she tried to extract it, it would get to 97% and then quit. So she downloaded two more files and got the exact same issue on those two files. I copied those files to a flash drive and scanned them, and all three of them come up as trojans.

She has norton internet security on her laptop but it doesn't work (from what I understand, it never worked, even before she had the viruses it didn't work). If I could somehow install an antivirus program on her laptop I think I could get rid of her problems. Is there any possible way to install a program while in safemode? When I try I get errors, as I expected.

Edit: Vista home edition, by the way.

[Seraph]

I honestly don't know, but my suggestion would be to reformat and install XP or Linux instead.

If you can identify exactly which trojan it is, can't you just DL a program like malwarebites and try to remove it in a more manual fashion as opposed to trying to install something far more complicated? I am assuming your focus is to remove the immediate threat, not future protection.

[Woozie]

I honestly don't know, but my suggestion would be to reformat and install XP or Linux instead.

If you can identify exactly which trojan it is, can't you just DL a program like malwarebites and try to remove it in a more manual fashion as opposed to trying to install something far more complicated? I am assuming your focus is to remove the immediate threat, not future protection.

I'm not sure how to do this. If I get a program, like malwarebites, and try to remove it manually, will I be able to get this program onto her computer while in safemode? I'm going to try it out.

[Woozie]

I tried, but I can't run that on her computer for the same reason that I can't run the other programs I tried. The computer wont let me run the installers while in safe mode.

Is there a way to install programs or to remove a virus manually without having to install a program?

[Seraph]

Is there a way to install programs or to remove a virus manually without having to install a program?

In theory, you can replicate what the programs will remove, but you would need to know exactly what you are dealing with. This often involves removing the 'bad files', and corrupted files, and restoring your registry to some normal state.

Honestly, it would probably take less time to reformat. Take the time to beat your lady friend, and explain to her never to touch limewire ever.

[Bartylby]

^

dban ftw

[Woozie]

I found a portable version of malwarebytes that does run without being installed. It's scanning right now, and hopefully it works.

[Seraph]

I found a portable version of malwarebytes that does run without being installed. It's scanning right now, and hopefully it works.

I'll pretend that I knew about that. >_>

[Woozie]

The only thing the scan found was adware.zango, which doesn't seem like it can cause the problems she had (slow computer/unable to boot/etc). It definitely doesn't seem like it's the same malware I found in her limewire files.

[Rockstaru]

A guide and tutorial on using ComboFix

Try combofix.

[Day]

system restore enabled by any chance?

[Woozie]

system restore enabled by any chance?

Unfortunately, no.

Thanks Rockstaru. I'm going to try this out.

After I took the adware.zango off the computer, it still wont boot in normal mode, but the nature of the error is different. Instead of getting that blue screen with the drivers error thingy, it stays on the welcome screen with that swirling circle thingy.

[Day]

=(

Sucks.

[Woozie]

I can't run combofix in safe mode.

[Day]

Whats the exact error?

[Woozie]

I had it typed out, but I think I might have deleted where I had it typed. Something along the lines of "a problem has been detected" "driver_irql_not_less_or_equal". An error in that file or something like that. I googled the error but didn't find anything that both made sense and was helpful. But I don't even get that anymore. Now I just get stuck at the welcome screen.

[Woozie]

I'm backing up her files now. She had a LOT more infected files on her computer that my scanner is catching, which means the malwarebyte scan really really really sucked.

And these are extremely obvious viruses too. I can't believe she actually tried to run these programs (or even unzipped the archives).