Rylan and Scott

[James R]

Im currently having issues with a virus being blocked by AVG. Its a Trojan Horse Pakes.AW in the process system32\svchost. AVG blocks it but wont remove it and malwarebytes cant remove it either.

Any ideas on a solution thats FREE???

[Tom.]

you can do a system restore

For XP:

Use System Restore

After you've decided to use System Restore to revert your system to a previous state, start the System Restore Wizard and follow the prompts. To use the System Restore Wizard, make sure you're logged on as an administrator, and then follow these steps:

<table class="numberedList" border="0" cellpadding="0" cellspacing="0"><tbody><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">1.

</td><td>Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.

</td></tr><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">2.

</td><td>On the Welcome screen, click Restore my computer to an earlier time, and then click Next.

</td></tr><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">3.

</td><td>On the Select a Restore Point page, select the date from the calendar that shows the point you'd like to restore to, as shown in Figure 2, and then click Next.

Figure 2

</td></tr><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">4.

</td><td>On the Confirm Restore Point Selection page, verify that the correct restore point is chosen, and then close any open programs.

</td></tr><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">5.

</td><td>Click Next if you are ready to proceed or click Back to change the restore point.

</td></tr><tr valign="top"><td class="listNumber" align="right" nowrap="nowrap">6.

</td><td>The computer will shut down automatically and reboot. On reboot, you'll see the Restoration Complete page, and then click OK.

</td></tr></tbody></table>

[Tom.]

or look here

[James R]

I was thinkin about wether or not a restore would cure it?

[Jono]

A system restore is usually settings and programs rather than files like viruses.

[Jono]

Some instructions here: http://www.spywareremove.com/removePakesaw.html

Try Spybot - S&D: http://www.safer-networking.org/

Try AVG Anti-Virus: http://free.avg.com/gb-en/homepage

Try Malaware Bytes: http://www.malwarebytes.org/mbam.php

[James R]

A system restore is usually settings and programs rather than files like viruses.

thats what I was thinking. The problem is with it being svchost is that particular process runs multiple things

[James R]

Some instructions here: http://www.spywareremove.com/removePakesaw.html

Try Spybot - S&D: http://www.safer-networking.org/

Try AVG Anti-Virus: http://free.avg.com/gb-en/homepage

Try Malaware Bytes: http://www.malwarebytes.org/mbam.php

Already have AVG and malwarebytes

[E*F*4L]

try this http://www.superantispyware.com/

or you could try this http://free.antivirus.com/hijackthis/ you will also need to use this forum http://www.hijackthis.de/ be very careful using HijackThis as it will also remove core windows files as it doesn't distinguish between good files or bad ones.

[Tom.]

thats what I was thinking. The problem is with it being svchost is that particular process runs multiple things

thats why i thought that a sys restore would work...

[E*F*4L]

what system do you have ?

do you have the appropriate windows disc ?

[MrDoovdeHaxorz]

I'm surprised one of our good loyal spammers hasn't posted in this about 'best ever antivirus 3.142' yet...

Seriously though, the advice in Tom's link in his second post seems the best, but it needs a lotta scrolling down to like post 10 or 11 in that thread he linked to. Makes a good point about also clearing out potentially infected restore points.

[Ratscallion]

My advice would be backing up all your personal stuff, and trying a system restore. Then if that doesn't work, try something else. In most cases (my parents got rid of a bit of spyware with a sys-restore) it should work... Depends on how sophisticated your infection is.

Then I'd try and just run a complete computer scan with AVG, get it to remove EVERYTHING that it finds.

Also, this is what you get for using Windows.. Tsk tsk.

[James R]

what system do you have ?

do you have the appropriate windows disc ?

XP & No

[James R]

My advice would be backing up all your personal stuff, and trying a system restore. Then if that doesn't work, try something else. In most cases (my parents got rid of a bit of spyware with a sys-restore) it should work... Depends on how sophisticated your infection is.

Then I'd try and just run a complete computer scan with AVG, get it to remove EVERYTHING that it finds.

Also, this is what you get for using Windows.. Tsk tsk.

AVG blocks it but wont pick it up on a scan.

[Ratscallion]

AVG blocks it but wont pick it up on a scan.

Odd.. Maybe try a free trial of something (McAffee, Norton) and then uninstall when it's all fixed.

Or back it up and borrow a disk from a friend and re-format.

[James R]

Restore didnt work. Mcafee wont download and Nortron is only a trial of which you have to provide payment details :x

[Ratscallion]

Restore didnt work. Mcafee wont download and Nortron is only a trial of which you have to provide payment details :x

What's the exact problem again? I had to tell AVG not to warn me about some time of Cookie as MSN classes as one when it logs your conversations locally.

[James R]

What's the exact problem again? I had to tell AVG not to warn me about some time of Cookie as MSN classes as one when it logs your conversations locally.

Im currently having issues with a virus being blocked by AVG. Its a Trojan Horse Pakes.AW in the process system32\svchost. AVG blocks it but wont remove it and malwarebytes cant remove it either.

Spy doc didnt work, malwarebytes didnt work, avg wont cure it

[Ratscallion]

Im currently having issues with a virus being blocked by AVG. Its a Trojan Horse Pakes.AW in the process system32\svchost. AVG blocks it but wont remove it and malwarebytes cant remove it either.

Spy doc didnt work, malwarebytes didnt work, avg wont cure it

Ok.. That's not good. svchost is basically the process that makes everything work. If you kill it, you get a BlueScreenOfDeath (BSOD) and yeah. If it's infected, you die, basically. If there's a computer shop near you, they should fix it. I'd go about it by doing the following:

1) Try a system restore. You've already done this.

2) Back up everything and anything that you want to keep.

3) Format the hard drive (wipe it)

4) Reinstall Windows (or use Linux, if there's no programs that you need for work or other such things that need Internet Explorer/only work on Windows..)

5) Import your stuff back..

6) There is no step 6!

[E*F*4L]

he cannot re-install windows as he doesn't have a xp disc.

i have had a look around & it seem seems to be a rather complected fix

where did you get your PC from, it may have a factory restore (i did one on a dell pc last week) or it may have something called pc angel on it, when you turn on your pc does it say 'protected by pc angel' on the bios start-up screen (the black screen with white text).

just found this;

http://answers.yahoo.com/question/index?qid=20100214153049AAuoFtq

[James R]

he cannot re-install windows as he doesn't have a xp disc.

i have had a look around & it seem seems to be a rather complected fix

where did you get your PC from, it may have a factory restore (i did one on a dell pc last week) or it may have something called pc angel on it, when you turn on your pc does it say 'protected by pc angel' on the bios start-up screen (the black screen with white text).

just found this;

http://answers.yahoo.com/question/index?qid=20100214153049AAuoFtq

question is will the method described by wiseman in the last post of yahoo answers work. Bearing in mind it deletes all restore points

[Ratscallion]

Bearing in mind it deletes all restore points

Yeah.. You really don't want to do that if you want Windows to see tomorrow.. That's suicide.

[James R]

Yeah.. You really don't want to do that if you want Windows to see tomorrow.. That's suicide.

my thoughts exactly

[-sophie-]

Is this relevant at all?

To remove Pakes.aw, you must first stop any Pakes.aw processes that are running in your computer's memory. To stop all Pakes.aw processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Pakes.aw, then right-click it and select "End Process" key.

To delete Pakes.aw registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Pakes.aw." Right-click this registry key and select "Delete."

Finally, to completely get rid of Pakes.aw, you must manually remove other Pakes.aw files. These Pakes.aw files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Pakes.aw might create a file like

%PROGRAM_FILES%\Pakes.aw\Pakes.aw.exe. Locate and remove these files.