Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Nod32 Message


  • Please log in to reply
7 replies to this topic

#1 Barking Spyder

Barking Spyder

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:58 PM

Posted 27 March 2008 - 03:24 PM

To: Those who have skills which I lack.


This came up when doing a scan.

C:\System Volume Information\_restore{8BDB6564-5E8C-4254-94E1-83EFC1596AAB}\RP225\A0082984.exe »RAR »Toolbar.exe - Win32/Toolbar.AskSBar application


How do I get rid of it.

Thanks

Barking Spyder

BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:58 PM

Posted 27 March 2008 - 03:59 PM

This procedure will delete all your Restore Points when you do it. Make sure that your system is stable and that you make a new Restore Point once you complete the process.

Go to Start...Run...and type in "sysdm.cpl" (without the quotes) and press Enter
Click on the Advanced tab
then on the Performance Settings button
then on the Advanced tab
then on the Virtual Memory Change button

Copy down the settings that it has (you'll want them when you restart your pagefile later on)
In that window, select "No pagefile" and then press "Set"
Click OK to exit the dialogs and then reboot.

Then go back in using the above instructions and put in the settings that you wrote down in the beginning.
Reboot to restore your pagefile.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 Barking Spyder

Barking Spyder
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:58 PM

Posted 27 March 2008 - 04:22 PM

Thanks for the prompt reply.

Is it going to matter that I turned off system restore when I found I had this?
I do that since I've been told that if you don't, you wind up getting re infected.

TIA

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,962 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:05:58 PM

Posted 27 March 2008 - 04:37 PM

Hello Barking Spyder,

Here at BC we leave System Restore turned on until the computer has been cleaned. The reason for this is if something goes haywire, there is a working restore point, albeit infected one, to go back to. If you have turned System Restore off, please turn it back on. Infected files in System Restore are not a problem UNLESS you use system restore.

What we do when the computer has been disinfected is flush the restore points to prevent reinfection. The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point. NOTE: The directions in this link are for XP Pro. If you use XP Home, Disk Cleanup will start right away calculating the amount of space that can be saved. Wait until it's finished calculating. Then click on the More Options tab as outlined below.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
Incidentally, the file that Nod32 found was in the System Restore.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 Barking Spyder

Barking Spyder
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:58 PM

Posted 27 March 2008 - 09:17 PM

Realizing that the file found by NOD was a restore file is why I wanted to clear it.
I'd already run both NOD32 and Zone Labs AV programs as well as Spybot and Adaware2007.

I was and may still be having a problem with my router that caused the folks at Linksys to send me a new one but it has the same problem which is what prompted me to run the Av programs and search for trojans etc. It seems that when I go to the set up page for linksys there are no tabs. Hopefully the next time I try to set it up, it will have the page as it should be.

#6 karbo1

karbo1

  • Members
  • 172 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:04:58 PM

Posted 28 March 2008 - 08:31 AM

The C:\SYSTEM VOLUME INFORMATION folder is used by System Restore

To flush the restore points, I simply use this procedure:

Clear your 'System Restore' points by doing the following:
Right-click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
Select 'Turn Off System Restore On All Drives'.
Select 'Apply'.
You will then get the following warning:
"You have chosen to turn off System Restore.
If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer.
Do you want to turn off System Restore?".
Then select 'Yes', your 'System Restore' directories will be purged.

Restart your pc.

Turn 'System Restore' back on:
Right click on 'My Computer' and select 'Properties'.
Select 'System Restore'.
Unselect 'Turn Off System Restore On All Drives'.
Select 'Apply',then click 'Ok'.
Please post back if we found the solution

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,962 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:05:58 PM

Posted 28 March 2008 - 10:30 AM

Hello karbo1,

That is indeed an alternate method of clearing the System Restore points; however, the method I outlined in my previous post does not involve rebooting and is rather safer. I'd hate for something to go wrong while system restore was off.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#8 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:58 PM

Posted 28 March 2008 - 04:05 PM

When you disable System Restore it deletes the restore points.
Do you need to get rid of this? Well, that's a judgement call on your part.
Do you think that you'll need an infected System Restore point?
You won't be infected until you access it, but you'll still have it on your system.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users