(Originally posted 2013-05-29)
Man, I’m so tired of dealing with scamware… fortunately I don’t have to do it much, but when your mother calls…
So the latest variant of this Internet Security malware is out and infecting people, and there are already guides on how to fix it. Most of them are fine, use Malwarebytes, re-run your AV afterwards etc… the problem is, if you are running WinXP, it plays a nasty trick against your AV software: it changes the files to junction points. In Vista+, this isn’t a problem, since the system can handle it. XP can’t, and also sees the junctions as corrupted. I’ve seen this with MS Security Essentials so far.
There are two ways to fix this: 1) Slave the drive to another computer or use a Linux-based rescue CD to remove the junctions.
Or, if you are running XPSP3 (which you should be!) you can use the ‘fsutil’ tool to delete the junction point and restore the file.
If you try and reinstall MS Security Essentials without fixing the junctions, you’ll get odd error codes.
To remove the junctions:
Command window (cmd)
Switch to the directory containing the junctions ( C:\Program Files\Microsoft Security Client\ for example)
Dir /p
You should see a list of files/directories with the type <JUNCTION>.
For each file, run ‘fsutil reparsepoint delete filename‘
After that is done, you can remove and reinstall the software.