Recent Changes - Search:


Code:


Social:


My journals will take the place of a blog. If you go to the Journal page there is an RSS feed to subscribe with.

« September 2017 
SunMonTueWedThuFriSat
     12
3456789
10111213141516
17181920212223
24252627282930

Sites I take responsibility for

West Volusia, Florida

Documents

Technical

General

Me

Living

Places I frequent

Hobbies

Humor

Items for sale:


Clipboard

edit SideBar

Windows XP virus removl and detection

Include our styles below Infobox - invoke as >>infobox<< ... >><<

Codebox: - invoke as >>codebox<< ... >><<

warnbox: - invoke as >>codebox<< ... >><<

editingbox: - invoke as >>codebox<< ... >><<

noticebox: - invoke as >>codebox<< ... >><<

Page bread crumbs: Welcome to ke3vin.org! - My Public Technical Notes - Software And Operating Systems - Microsoft Windows - Windows XP - Windows XP Virus Removal And Detection

Pages by tags: (:listtags:)
Subscribe to this wiki: RSS Feed RSS or subscribe to this page for changes: RSS Feed RSS
496 articles have been published so far. Recent changes
Share

2016-03-22: This site is being moved to my main site at https://kevininscoe.com/wiki as part of a consolidation to one domain.


it shows the file like this C:\System Volume Information\...\A0056495.exe

(18:11:52) Looks like a special procedure for this one:

(18:11:56) http://www.bleepingcomputer.com/forums/topic152930.html

(18:12:19) There is also a program I use in XP to delete a file on reboot let me find that.

(18:13:26) I use this:

(18:13:30) http://www.snapfiles.com/get/removereboot.html

(18:13:50) You right click on the file in Explorer and tell it to delete at the next boot before drivers load up

(18:14:18) however if there is a trojan running it likely is morphing into several things so try the first link

(18:15:13) also try searching the registry for that file name as well

regedit?

(18:15:34) yes do an save first

(18:15:51) delete any lines referencing the file name

(18:16:03) usually a load= or run=

(18:16:22) also may be in your startup folder

is there a search i can do inside regedit to find it quicker?

(18:16:57) yes do a find

(18:17:14) Edit->Find

(18:17:37) kMake sure Keys, Values and Data are all checked

(18:19:26) also note this from quietman7

(18:19:32) " The infected RP***\A00*****.exe file(s) identified by your scan are in the System Volume Information Folder (SVI) which is a part of System Restore. This is the feature that allows you to set points in time to roll back your computer to a clean working state. The SVI folder is protected by permissions that only allow the system to have access and is hidden by default unless you have reconfigured Windows to show it.

System Restore will back up the good as well as the bad files so when malware is present on the system it gets included in any restore points as an A00***** file. When you scan your system with anti-virus or anti-malware tools, you may receive an alert or notification that a virus was found in the SVI folder (System Restore points) but the anti-virus software was unable to remove it. Since the SVI folder is a protected directory, most scanning tools cannot access it to disinfect or delete these files. If not removed, they sometimes can reinfect your system if you accidentally use an old restore point."

(18:20:10) so need to clean that up also

How to access SVI volume - http://support.microsoft.com/kb/309531


Kevin's Public Wiki maintained and created by Kevin P. Inscoe is licensed under a
Creative Commons Attribution 3.0 United States License.

Back to my web site - http://kevininscoe.com

Edit - History - Print - Recent Changes - Search
Page last modified on December 23, 2009, at 01:47 PM EST