Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: The restore folder virus that will not go away

  1. #1
    gary_m_mugford Guest

    Question The restore folder virus that will not go away

    Hi,

    I've been finding (or more accurately, ZoneAlarm has been finding) a virus called Trojan-GameThief.Win32.OnLineGames.vkir deep within the bowels of the System Volume Information\_restore folder. I mark it for delete on rebooting, reboot and think I am done. A day or so later, a ZA deep scan shows me with the file, usually with a slightly different number, right back in the restore folder system. Today's version of the virus is A0063335.exe. This, theoretically, implies that another program I am running is recreating the virus-infected file, or that ZA isn't deleting it as indicated.

    By the way, don't play games on this computer. In fact, I don't play any on-line games, save BridgeBase OnLine and haven't been on that in weeks.

    Any ideas, anyone?

    Thanks, GM

  2. #2
    findley Guest

    Smile Re: The restore folder virus that will not go away

    Hi,

    Two suggestions:
    1 - see how to clean your computer of malware http://www.zaforums-stg.com/showpost...07&postcount=2
    or
    2 - Seek help from a malware expert. Post your HijackThis log for the malware expert's review and they will work with you to remove any malware from your computer. One forum where you can post your HijackThis log is spywarehammer. See their guidelines in the links below:

    How to Create and Post a HijackThis Log
    http://spywarehammer.com/simplemachi...fs6&topic=88.0

    Then Register and Post Your HijackThis Log at
    http://spywarehammer.com/simplemachi...fs6&board=10.0

    I hope this helps you,
    findley

  3. #3

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by gary_m_mugford View Post
    Hi,

    I've been finding (or more accurately, ZoneAlarm has been finding) a virus called Trojan-GameThief.Win32.OnLineGames.vkir deep within the bowels of the System Volume Information\_restore folder. I mark it for delete on rebooting, reboot and think I am done. A day or so later, a ZA deep scan shows me with the file, usually with a slightly different number, right back in the restore folder system. Today's version of the virus is A0063335.exe. This, theoretically, implies that another program I am running is recreating the virus-infected file, or that ZA isn't deleting it as indicated.

    By the way, don't play games on this computer. In fact, I don't play any on-line games, save BridgeBase OnLine and haven't been on that in weeks.

    Any ideas, anyone?

    Thanks, GM
    Hi,

    Basically this means that the malware has been removed, but as you did not disable System Restore prior to the removal, some remnants still exist in your old restore points.

    Here are instructions on flushing System Restore:
    http://safecomputing.umn.edu/guides/systemrestore.html


    Let me know if you need further help on this.

  4. #4
    gary_m_mugford Guest

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by findley View Post
    Hi,

    Two suggestions:
    1 - see how to clean your computer of malware http://www.zaforums-stg.com/showpost...07&postcount=2
    or
    2 - Seek help from a malware expert. Post your HijackThis log for the malware expert's review and they will work with you to remove any malware from your computer. One forum where you can post your HijackThis log is spywarehammer. See their guidelines in the links below:

    How to Create and Post a HijackThis Log
    http://spywarehammer.com/simplemachi...fs6&topic=88.0

    Then Register and Post Your HijackThis Log at
    http://spywarehammer.com/simplemachi...fs6&board=10.0

    I hope this helps you,
    findley
    I've been coping with the virus that broke out into the Delphi community this week and haven't had the time to get back here and thank you for your suggestion. I did adopt the suggestion of the following reply, which seems to have worked, but I appreciate the time you took to help me out. Thanks. GM

  5. #5
    gary_m_mugford Guest

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by chiaz View Post
    Hi,

    Basically this means that the malware has been removed, but as you did not disable System Restore prior to the removal, some remnants still exist in your old restore points.

    Here are instructions on flushing System Restore:
    http://safecomputing.umn.edu/guides/systemrestore.html


    Let me know if you need further help on this.
    This resolved the situation, so far as my tests indicate. I thank you for steering me to it. I am humbled again that a tool I KNEW was in the control panel offered the solution, but I kept looking for 'more difficult' answers. Thanks, GM

  6. #6
    stormsy Guest

    Default Re: The restore folder virus that will not go away

    I had a similar problem. Except I had the virus called "Virus.Win32.Induc.a" - not sure how it got onto my PC as I ran a scan one day, then the next had to reinstall ZASS only to do another scan to find that I had this virus on my system localted in an .exe file which was downloaded from a reputible website just a week ago!

    I deleted it, but then the next day the On-access scan said it had found the same virus in a system volume .exe. file which I deleted that too, and then saw the post about flushing the system restore - this seems to have worked.

    After the little incident, I have now downloaded Malwarebytes Anti-malware and Spybot - to which I have ran both of them with updated databases and found nothing. So all-in-all everything is looking okay. (If not, I will format and reinstall XP - I have done it before and it doesn't take long...)

    I have read about this virus from Kaspersky Labs, and apparently this virus only infects the Delphi community who writes programmes. It intalls itself into the programme being written and then it distributes itself as the programme is distributed to everyone (I think - not sure about the exact details.) However, it has no real affect on the computer, leading to suggestions that this is a new way to distribute viruses - and has yet to be picked up and tweaked by cybercriminals...

    Thanks,
    Stormsy.
    Last edited by stormsy; August 22nd, 2009 at 06:15 AM.

  7. #7
    tony_a Guest

    Default Re: The restore folder virus that will not go away

    I had the same problem. The solution was to run ZA, delete Win32.induc.a, set a new restore point, then using the C:\ disk properties tools, clean the disk including removing all but the last restore point (which you've just set) and that cleans out all the old restore points that may have been infected.

    Tony

  8. #8
    Join Date
    Aug 2009
    Location
    Texas Gulf Coast
    Posts
    1,647

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by tony_a View Post
    I had the same problem. The solution was to run ZA, delete Win32.induc.a, set a new restore point, then using the C:\ disk properties tools, clean the disk including removing all but the last restore point (which you've just set) and that cleans out all the old restore points that may have been infected.

    Tony
    Malware today is advance against detection and removal.Your method is not effective because you could have running processes that are still infected.

    In disabling System Restore and cleaning in Safe Mode assures adsolute minimum programs running, with all the other components disabled when running a scan for virus in Safe Mode.

    You can also connect to the network in " safe mode with networking " if you have internet connection to update anti-virus software.

    Have a nice Day

  9. #9
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,287

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by Sky Soldiers View Post
    You can also connect to the network in " safe mode with networking "
    You must connect in Safe Mode with networking to scan with the ZA antivirus, otherwise the antivirus will not be functional.
    Is it by choice that your PM is turned off? Sometimes it is useful to communicate directly and thus avoiding hijacking the thread.

    Thanks,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  10. #10
    Join Date
    Aug 2009
    Location
    Texas Gulf Coast
    Posts
    1,647

    Default Re: The restore folder virus that will not go away

    Quote Originally Posted by fax View Post
    You must connect in Safe Mode with networking to scan with the ZA antivirus, otherwise the antivirus will not be functional.
    Is it by choice that your PM is turned off? Sometimes it is useful to communicate directly and thus avoiding hijacking the thread.

    Thanks,
    Fax
    I always assume the only time you need to do Safe Mode with Networking is when you are currently unable to browse the Internet and download files while at the Desktop in normal start up mode, but are able to browse and download in safe mode with networking to get updates, drivers, or other files to help troubleshoot your issue.

    I will do Live Chat to confirm the anti virus will not be functional in just Safe Mode.

    I looked in ZoneAlarm help menu and could not find a reference of even Safe Mode or Safe Mode with Networking for that fact.

    Can you point me to that reference.

    Have a nice Day

    BTW : No need to point me to that reference.It's been a good ride.I'm out of here.
    Last edited by Sky Soldiers; August 22nd, 2009 at 02:38 PM. Reason: EXIT

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •