Help, Comodo CIS is not detecting any virus, but my computer IS INFECTED

Hi everyone

I recently installed Comodo CIS, because my previous AV product failed to protect me from a USB virus. The problem is that it is unable to find the virus, thus won´t protect me at all.

A few details:
Im a Windows XP SP3 user
Running on a limited account (can switch to admin)
I know my computer is infected because all the root folders are hidden and have the system file attribute. Also there are executables with the same name, and folder icon on the root folder (to fool me to double click it, and run the virus again)
It seems a Romeo virus, or Win2x was running (I disabled it from startup by using msconfig) Although it might be running as a different process now.
The task manager, and regedit had been disabled (Ive enabled them back)
My session would be closed after a few minutes of starting it (I had to stop the Romeo process to prevent it from closing automatically)
I´ve ran a complete virus scan (using Comodo CIS) but it failed to find any virus at all.

I fear the virus might be blocking Comodo CIS from detecting it.

What can I do?

Any suggestion would be highly appreciated

Download Superantispyware (Download SUPERAntiSpyware 10.0.1246 for Windows -
Update it

Download AntiVir (Download Avira Free Antivirus 15.0.2003.1821 for Windows -
(With Out The Guard)
Update it

Boot In Safe Mode
(Press F8 After BIOS Boot Screen)
Select “Safe Mode”

Do Complete Scan


and try MalwareBytes Anti-Malware while you’re at it :wink:

Thanks! It seems the virus has been finally wiped of my computer!

I used the 3 programs, and these were the results:
SuperAntiSpyware found rootkit.romeo/Save
MalwareBytes found about the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
Avira antivir found TR/Crypt.CFI.Gen (which was related to Win2x.exe and all the disguised executables on the root)

Thanks again!

Btw, now that I’m at it… does anyone know how can I completely disable the “autorun” or should I say “autoinfect” feature for every device (including CDs, DVDs) on Windows XP? I had disabled Autoplay, but it doesnt really help… those U3 devices keep running without even prompting me, and the last virus didn’t have any trouble installing at all. Thanks in advance

Are you using D+? D+ should recognize every executable from other devices as unsafe and prompt you if they try to run.

There are instructions here: