Hey, a friend of mine got this virus that appears as a fake antivirus that denies access to all programs. How can I go about removing it? Is this going to require a full OS reinstall?1 person got this answerI do too

What is the name of the fake antivirus? See the Malware Removal Guides at BleepingComputer.com . Use another computer to download the removal tools, then transfer them to the infected computer.Boulder Computer Maven Microsoft Most Valuable Professional

You may have to use a non-infected computer for any downloads specified below, until your malware is removed. Use a USB Pen drive or burn to CD or other means to carry the necessary utilities to the infected computer and copy to the Desktop.Microsoft® Windows® Malicious Software Removal Tool download here off-line.1. Follow to the letter all the directions in this thread: How to get rid of malware2. If still no joy you can find Microsoft MVPs and other trained analysts at the following help sites:Aumha.org Atribune.org SpywareHammer BleepingComputer Safer-Networking 3. If you need more help with virus-related issues, contact Microsoft Product Support Services. For support within the United States and Canada, call toll-free (866) PCSAFETY (727-2338). For support outside the United States and Canada, visit the Product Support Services Web page. 4. If you need more assistance for the virus/worm post to the Microsoft Newsgroup - Security - Viruses.Via your newsreader:news://msnews.microsoft.com/microsoft.public.security.virusVia Web:http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.security.virus Hope this helps, Vincenzo Di Russo Microsoft MVP Windows Internet Explorer, Windows Desktop Experience & Security - Since 2003. Moderator in the Microsoft Answers Forums Italy My MVP Profile: https://mvp.support.microsoft.com/profile/Vincenzo

Here is how I got rid of the fake antivirus popup. Btw, I am running windows XP Pro1) Restart in safe mode. (hold F8 down during restart)2) Go to Contol Panel -> Folder Options3) Click the "View" tab4) Choose the "Show hidden files and folders" radio button5) Open: My Computer -> Local Disk C -> Documents and Settings -> (The Folder that is your login name) -> Application Data6) Look for a file that is called "sawamn.exe"7) You cannot delete this file because it is in use but you can change the name. I deleted the ".exe" and changed the name a little and then confirmed in the following dialog box that I wanted to do that.8 Restart again in safe mode and locate that file again and delete it.9) Restart in normal mode and you're good to go.