First off: Why won't the administrators update the antivirus products on it?
If it is simply a budget problem, ask them to use some of the better
FREE ones For freebies, I prefer: AVG Free, MalwareBytes, and Ad-Aware.
I run them ALL, on ALL of my systems. You need several, because many
of the newer virii know how to fool one or another, or intercept the AntiVirus
updates and fool them into thinking they've been updated. Running several
(overnight, daily) tends to minimize that problem, because ONE of them should
catch any new virus that got in that day. (My systems now run from 3-6 hours
of AntiVirus products every night. <sigh>)
BTW... Once you have it cleared, there are several ways to keep yourself safe, but
many require either discipline, or Admin Access.
A) Save all nonexecutable data files, then Ghost the system. (IOW, Flush and
reload the entire HD nightly. Guaranteed to kill anything! Requires Admin
access, though.)
B) Make Frequent Backups on external media, in case you have to flush the system.
Modern virii now also infect System Restore Files when they first attack to
keep you from reverting to an earlier save state, so flushing is a safer bet.
Anyway, If you can't get the Admins to do anything (because the biz is in
Shutdown Mode and everyone is On Their Way Out and working on resumes):
1) Can you get to the BIOS during Startup, or is that locked too?
If so, can you set it to boot from a CD, or a thumb drive?
If you have THAT kind of access (many Admins forget to set BIOS passwords),
see if it is possible to temporarily change the Boot Order to start with a
CD, or a thumb drive. IF so, then you can create a basic XP disk (or a
virtual PC on a thumb drive) on another machine, and install your favorite
antivirus to it. Boot from it, and scan the system. Then change the Boot Order back.
2) There are free downloadable disk images out there of basic
utility disks that include both an OS and antiviral product executables.
Search for them. (Again, you will need to be able to switch the boot order.)
But the biggest challenge these days is that SOME Windows virii simply
can NOT be extracted, because they have edited the OS WAY too much,
or destroyed critical system files and replaced them with Re-Infector versions.
Also, other viruses often run in SETS, where as long as ONE is still running,
each one can rebuild the others' files AS each are being extracted, foiling removal.
Unfortunately, in those cases, you have to temporarily physically remove
the HD and slave it to another CLEAN system (that has AutoPlay disabled,
for safety) as a Secondary Drive, to make sure the virii are not running.
These days, that is almost the ONLY way keep Virus Teams from thwarting
your removal efforts, as many have figured out how to run even during
limited operating modes that used to be Safe.
Once the disk is slaved to another system, you then pull off any files you
want to keep, use a Key Extractor utility to find all of the original keys
of programs currently installed on it for re-installation, and wipe the
drive all the way down to the partitioning. Remount it into the original
chassis, repartition and reformat it from scratch, then reinstall the OS
and every utility from scratch using their original disks & keys (or for
missing disks: use any original copy, and the recovered keys).
Overall, a VERY painful process... It also requires AT LEAST physical access
to the chassis, AND of course the true owner's permission to DO this.
(In your case, it sounds like that may not be an option.)
That's why IMHO you are still best off trying to convince the current
Admins to let you either
- update the current anti-virus software, or
- add in some freebies like AVG and MalwareBytes and let THEM take a
crack at it (especially if you have limited time left on the project).
But I can tell you though, if there are a LOT of virii on the system, it is
often a good indication at least ONE advanced virus has hit you,
which knows how to cripple your current anti-virus product.
It's almost like Computer AIDS, where one virus allows others to enter.
If that has happened, I'm sorry to say that you may already be at
the "Better Off to Wipe It ALL and Reload" stage.
Good luck, and let us know what you finally do!
- Keith Mc.