need help to remove xp antivirus 2008

Hi All,
I am no computer genius, and am trying to remove xp antivirus 2008 from my partners computer, running windows xp. I used malwarebytes remover, and it seems to have worked though i am in the process of running the full scan. But, all documents and files are GONE! All pictures are gone, everything is gone. When i first went to do a system restore, there were no restore points, all gone. Also, when the virus was running and i went control alt delete, it said that had been disabled by the administrator. On the start bar, the shortcuts are all gone. Everything is gone! Help!
Is the virus still there? Can i get anything back? AARGH!
How? Help!
Thank you!
Misho

Hi,
I cannot download the hijackthis file and run it on the machine with the problem as that machine now cannot connect to the internet. Its our second machine, and it has the xp antivirus program. I was able to use the malewarebytes antimalware and clean up most of the xp antivirus 2008 but my files are all gone, the wallpaper is gone, and the start icons such as my documents are gone and that folder is empty! I tried to cntrl alt delete while the xp virus was running and it had been disabled and still does not run now that i have tried to get rid of the virus. I also tried restore to a previous time, and all restore points are gone! OMG!
Can anyone please help me get rid of this virus and get my files back? and the computer working like it did yesterday? Thank you so much for your help,
Misho

Hi misho,

Your machine sounds like it is in a bad way, I can't guarantee that we will restore your files or the functionality of your machine, but we'll have a go. However, our expertise is in the area of malware removal, and if the main issues appear to be not related to the infection then I may need to refer you for further help.

Before doing anything on the sick machine, please try and make sure System Restore is enabled:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like Start of cleaning then press the Create button and once it's done press Close
If you have any problems with this please let me know.

Next, a couple of questions:
How does this machine connect to the internet? Is it connected to a router?
Do you have a USB drive or any other way to transfer files between computers?

Hi Silver,
Thank you for replying and trying to help.
I do have system restore, and i also have recovery console as a start up option. I have checked the restore points, and it seems they are all gone except for after the malware virus removal removed most of the virus.
I looked in the hidden files, and the snapshot folders are all gone from the previous restore points.
I tried to manually replace the system reg from before, following the microsoft directions, and no go - the registry seems screwed up. Everytime i run the malware virus removal it says it is there, catches the files, then cant delete them all.
Do i have to redo my whole computer? This is a very malicious virus, and i wonder if the malware virus remover actually is what took my restore points? ARgh.
It is connected to the internet via cable, and i have my other laptop connected with wireless, and i have thumb drives and can transfer files back and forth no problem.
currently the sick machine is working, but no wallpaper, and i am worried there is spyware still on there.
thank you again,
Misho

Hi misho,

It's up to you as to whether you should reformat, but I can say that if it was my machine I certainly would.

If the registry has been "screwed up" there is no telling what problems you will have, or even whether it's possible to resolve the problems. In any case it's very likely that recovery will take a much longer time than reformatting, so I would only recommend recovery if you have no way to reformat.

As I mentioned, I will be happy to help clean the malware from your machine, but to get it up and running normally it may take a bit more than that. For this type of general troubleshooting it's best to deal with a specialist in the area and there are plenty of other forums for this which I can refer you to.

Please let me know how you would like to proceed.

HI Silver,
I would like to try to recover if not a major headache.
I did not post earlier because I got a call that my other computer that i lent to a friend got infected also, and i went and got it and brought it home. It has the bluescreen of death, and I can get into system recovery but cannot get it to boot from teh dell cd. I do not know command lines so it is probably me. When i ask it to go to safe mode, it is very very very slow and then goes to blue screen of death, saying there is a possible infection and for my own protection windows wont start.
I guess when it rains it pours. I dont know where to start to fix this, not my weekend.
If recovery of thefirst machine is very difficult (is there a registry recovery program? ) then i will have it redone from scratch. I think with the second machine it looks like it has to be redone, but even putting in teh windows cd to redo it, still cant get to it but to blue screen. I did get into a diagnostics from the other windown cd dell cd but it said there were problems with the files.
Huh.
Okay, where do i start? this is crazy, there must be some really bad viruses going around right now.
Thank you sooooooo much,
Misho

Hi Misho,

I would like to try to recover if not a major headache.

I presume you are referring to the first machine. As I mentioned, it is likely to be a headache, but I'm happy to try and help with the malware issues.

If so, then I would like you to check System Restore again. You said that the service is running but there are no Restore Points, in this case I would like you to make one now so we have one to fall back on should there be any problems:

Create a new System Restore point in case of problems during cleaning:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like Start of cleaning then press the Create button and once it's done press Close

After this, please check that there is in fact a new Restore Point present before continuing.

Then, download the HijackThis installer from here and transfer it to the infected machine.
Then run HJTInstall.exe and follow the prompts.
After installing, HijackThis will open automatically
Select Do a system scan and save a logfile - this will produce a HijackThis log in Notepad. Check in Notepad that Format->Word Wrap is UNchecked.

Please transfer it back and post it in your next response.

lack of response,