I remoted in and ran Microsoft Forefront. It found the infection and removed the Trojan.

I rebooted and began restoring the computer back to normal. I was able to find a way to enable the task manager and to re-enable the desktop.

I found the files moved by the virus by searching for files modified the day the Trojan attacked. Since they were all hidden and missing for the user previously, he wouldn’t have been able to modify them, so it would have to have been the Trojan. They were located in %profilepath%\Local Settings\Temp\smtmp\* and I moved those back to the start menu.

Finally, from the start menu, I ran:

cmd
cd\
C:\>attrib -s -h -r /s /d

All his files and folders were then back to normal. I also checked IE to verify he didn’t have a proxy enabled.

These steps restored the PC back to normal.