PEpatch.ao

[Hevendor]

So I was doing nothing special when my AVG alerts me about win32/PEpatch.ao in my svchost. I went to google to try and find some info about it but not much luck. I wasn't going to delete svchost or move it anywhere, so I decided to ignore the message, and guess what... more alerts. Looks like it's in explorer, winlogon and spoolsv too.

From what I've read on some tech support forums, my computer is going to stop booting next time I shut it down, so does anyone have any ideas? Would a repair install fix this? I've saved most of the stuff I can remember (after scanning it) to an external HD, so I'm not too desperate, but would still appreciate a fix. Thanks in advance.

 

[shiroun]

I say hard erase your drive twice if it doesn't boot. Safest and most effective way to destroy the virus.

 

[___]

Safest and most effective way to erase everything else, too!  Give me a sec, I'll look into it and see if I can think of anything that will help you.

Edit:  Okay it sounds like you will be able to boot into safe mode, from what I read you're going to lose your amdk7 driver, which is your processor driver.  Since it's pretty much never updated and built into Windows it should be flagged to be scanned by system file checker, so you may get away with just running SFC from the command line in safe mode to restore it.  There's not a lot of info on that guy out there so I don't know how accurate that is, though.

Before anything else, back up your important files, just in case!
Don't forget bookmarks, address book and contact list and game saves, I always forget something simple like that I end up being frustrated about later.

Assuming you're running XP: You'll do this by choosing the "Safe Mode with Command Prompt" option in the boot menu (if you don't see it listed, press F8, that will give you the full list of options).  Once the command line comes up just type "sfc /scannow" and let it do its thing, see what happens.

If you have no luck you should still be able to run a repair install just fine.  There is really no reason to ever do a clean reinstall short of a crashed drive.  If sfc doesn't help you and you still can't boot into normal mode, or you still have the virus, post again.  I'll have you get me a Hijack This! log and do a couple other things that might narrow down the bugger, then I'll tell you how to remove it manually.