Recent Changes - Search:


Code:


Social:


My journals will take the place of a blog. If you go to the Journal page there is an RSS feed to subscribe with.

(:blogcal group=Journal:)


Sites I take responsibility for

West Volusia, Florida

Documents

Technical

General

Me

Living

Places I frequent

Hobbies

Humor

Items for sale:


Clipboard

edit SideBar

Windows XP virus removl and detection

Include our styles below Infobox - invoke as >>infobox<< ... >><<

Codebox: - invoke as >>codebox<< ... >><<

warnbox: - invoke as >>codebox<< ... >><<

editingbox: - invoke as >>codebox<< ... >><<

noticebox: - invoke as >>codebox<< ... >><<

Page bread crumbs: Main - MyPublicTechnicalNotes - SoftwareAndOperatingSystems - MicrosoftWindows - WindowsXP - WindowsXPVirusRemovalAndDetection

Pages by tags: (:listtags:)
Subscribe to this wiki: RSS Feed RSS or subscribe to this page for changes: RSS Feed RSS
496 articles have been published so far. Recent changes
(:addThis btn="custom":)

2016-03-22: This site is being moved to my main site at https://kevininscoe.com/wiki as part of a consolidation to one domain.


it shows the file like this C:\System Volume Information\...\A0056495.exe

(18:11:52) Looks like a special procedure for this one:

(18:11:56) http://www.bleepingcomputer.com/forums/topic152930.html

(18:12:19) There is also a program I use in XP to delete a file on reboot let me find that.

(18:13:26) I use this:

(18:13:30) http://www.snapfiles.com/get/removereboot.html

(18:13:50) You right click on the file in Explorer and tell it to delete at the next boot before drivers load up

(18:14:18) however if there is a trojan running it likely is morphing into several things so try the first link

(18:15:13) also try searching the registry for that file name as well

regedit?

(18:15:34) yes do an save first

(18:15:51) delete any lines referencing the file name

(18:16:03) usually a load= or run=

(18:16:22) also may be in your startup folder

is there a search i can do inside regedit to find it quicker?

(18:16:57) yes do a find

(18:17:14) Edit->Find

(18:17:37) kMake sure Keys, Values and Data are all checked

(18:19:26) also note this from quietman7

(18:19:32) " The infected RP***\A00*****.exe file(s) identified by your scan are in the System Volume Information Folder (SVI) which is a part of System Restore. This is the feature that allows you to set points in time to roll back your computer to a clean working state. The SVI folder is protected by permissions that only allow the system to have access and is hidden by default unless you have reconfigured Windows to show it.

System Restore will back up the good as well as the bad files so when malware is present on the system it gets included in any restore points as an A00***** file. When you scan your system with anti-virus or anti-malware tools, you may receive an alert or notification that a virus was found in the SVI folder (System Restore points) but the anti-virus software was unable to remove it. Since the SVI folder is a protected directory, most scanning tools cannot access it to disinfect or delete these files. If not removed, they sometimes can reinfect your system if you accidentally use an old restore point."

(18:20:10) so need to clean that up also

How to access SVI volume - http://support.microsoft.com/kb/309531


Kevin's Public Wiki maintained and created by Kevin P. Inscoe is licensed under a
Creative Commons Attribution 3.0 United States License.

Back to my web site - http://kevininscoe.com

Edit - History - Print - Recent Changes - Search
Page last modified on December 23, 2009, at 01:47 PM EST