Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HELP PLEASE!


  • Please log in to reply
4 replies to this topic

#1 shadowrose

shadowrose

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Location:WEST VIRGINA
  • Local time:08:30 PM

Posted 18 May 2004 - 10:15 AM

HELLO EVERYONE. I RUN WINDOWS XP HOME EDITION AND EVERY TIME I GET ON MY COMPUTER, A VIRUS ALERT COMES UP SAYING: TROJAN HORSE DOWNLOADER.KEENVAL.C IS FOUND IN C:\SYSTEMVOLUMEINFORMATION\_RESTORE(E0C22E00-D318-4D95-967D-A5C2B4653ED05\RP1/A0000126.EXE. I RUN MY AVG AND IT DOES NOT FIND ANY THING. HOW CAN I GET RID OF THIS VIRUS?? PLEASE HELP ME... ANY INFORMATION YOU CAN GIVE ME WILL BE DEEPLY APPRECIATED. HAVE A WONDERFUL DAY... SHADOWROSE

BC AdBot (Login to Remove)

 


m

#2 Sasquatch

Sasquatch

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:30 PM

Posted 18 May 2004 - 04:01 PM

Shadowrose,

You need to disable the System Restore feature of XP.

1. Click Start > My Computer.
2. Click Properties.
3. Click the System Restore tab.
4. Check Turn off System Restore.
5. Click Apply > click OK.
6. Restart the computer.
7. Ensure you have the latest updates to your antivirus
8. Verify that your AV is set to scan all drives.
9. After cleaning the infected files, repeat steps 1 through 6, except in step 4, uncheck Turn Off System Restore.

Good luck

#3 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,395 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:08:30 PM

Posted 18 May 2004 - 07:49 PM

Your antivirus is finding the files in your system volume information folder that is used by system restore. By default applications, and users, are not able to access that directory so it detects it but cant fix it.

Follow Sasquatch's good advice to get rid of this issue.

#4 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,522 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:30 PM

Posted 18 May 2004 - 10:48 PM

Hi shadowrose,
If you had an indication of that trojan in your restore points that means you were at one time infected with that trojan and still may be. It could have changed its name so that AVG doesn't see it anymore. If you could post a HijackThis log we may be able to catch it and get rid of it. Or see if it's even there.

Download HijackThis from here: HijackThis

Please follow THESE INSTRUCTIONS to put HT into it's own folder & unzip it. It is important that HijackThis.exe not be run from the desktop or a temporary folder.

Double click HijackThis.exe to open them click "Scan". The Scan button will now become a "Save Log" button. Click that and save the log somewhere convenient like "My Documents". Then copy and paste the entire contents of the log file into your next post.

BTW welcome to BC.:flowers: Believe I recognize the name from the MW board. Could you do me a favor? Don't type in all caps--it's hard to read. :thumbsup:

The fate of all mankind, I see

Is in the hands of fools

--King Crimson


#5 harrywaldron

harrywaldron

    Security Reporter


  • Members
  • 509 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Roanoke, Virginia
  • Local time:09:30 PM

Posted 19 May 2004 - 03:19 PM

These articles might help ... Try AVG in SAFE MODE and turn SYSTEM RESTORE off also. The good news is that your restore area is inassessible to normal Windows processing, so you're past configuration is what is infected.

HOW TO START YOUR PC IN SAFE MODE
http://forums.mcafeehelp.com/viewtopic.php?t=601

HOW TO DISABLE SYSTEM RESTORE for Windows ME or XP
http://forums.mcafeehelp.com/viewtopic.php?t=668

This might also help if needed:

HOW TO CLEAN A DIFFICULT VIRUS
http://forums.mcafeehelp.com/viewtopic.php?t=679




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users