Unsolved

This post is more than 5 years old

10099

March 2nd, 2009 00:00

A Virus In Restore System Files

I need help big time. I am getting a virus in my restore files and I don't know how it got there. I ran Avira virus scan and nothing came up. I did a complete restore to see if that will help. I didn't install anything else except for Avira Virus Scan. I ran it and it found 2 trojans in the restore files.  I also have bitdefender too. I have the restore system off now. How can I have 2 trojans if I did a complete restore?

651 Posts

March 2nd, 2009 00:00

Viruses will somtimes hide in restore. Turn off  the restore and  scan for the virus and remove it. After it is removed, turn restore back on. That's what I have done and it has worked.

Also, do not have more than one antivirus program on your compuiter at a time. They tend to fight with each other.

4 Apprentice

 • 

20.5K Posts

March 2nd, 2009 06:00

Turn off  the restore and  scan for the virus and remove it. After it is removed, turn restore back on.
That's not such a good idea because if something goes wrong while you are running that virus scan, you have no way to restore -- no restore points -- ouch. It's safer to clean the virus and then FLUSH System Restore by turning it off, Reboot, and turn it on again.

Lizzy, when you say you did a "complete restore", did you restore to factory settings?  Or did you simply use System Restore to go back?

Lizzy please reboot and turn System Restore on again. That will have purged any infected Restore Points. Decide which AV you want to keep and remove the other one.

Scan again. Still finding a problem in System Restore?

 

1.1K Posts

March 2nd, 2009 08:00

I agree with Bugbatter.  Eliminate the virus, then turn off system restore, reboot and then turn on system restore again.  Then after you turn on system restore, then run another scan.  This is what I have done with all viruses found in system restore and it has worked flawlessly in removing them.

 

March 2nd, 2009 11:00

What I meant was after I found the viruses with Avira virus scan,  it removed them. I turned the restore off and reboot. I ran Avira again and it found no virus. I turned the restore back on. Couple days later, Avira popped up saying it found a trojan. I ran another complete scan and it found 2 trojans in restore files. Avira removed them again. That's when I decided to do a factory restore. After I did that, I installed Avira again. I did a complete scan and it found two trojans. The Avira removed the trojans and I turned off the restore. I uninstalled the Avira and install bitdefender. I haven't turn on the restore because I'm afraid the viruses will be there. I don't understand how the trojans be in restore files after you do a factory restore.

5 Journeyman

 • 

15.6K Posts

 • 

45K Points

March 2nd, 2009 13:00

"Couple days later [after having been declared virus-free], Avira popped up saying it found a trojan".

"Couple days later" certainly allows for the possibility that you [or someone using your PC] visited a web-site that RE-infected your computer (as opposed to something "hiding out" among your restore points).

---------------------------

 "I don't understand how the trojans [could] be in restore files [immediately] after you do a factory restore".

To the best of my understanding, that shouldn't happen.  For me, that raises the question:  could your detections here have been FALSE POSITIVES  [an error, on the part of the virus-detection engine]?   Alternatively, after a factory restore, it might still be picking-up on some "PUP" -   Potentially Unwanted Program --- such as the Dell MyWay SearchPage/Toolbar.   In order to consider these possibilities(F/P, PUP), it would be helpful to have the names of the files in question, and the type of virus/trojan allegedly being found in them.   Actually, the best thing to do in such a case would be to submit/upload the file(s) to Jotti or VirusTotal for their analysis by multiple anti-virus engines, and to post the results back here.

http://virusscan.jotti.org/

http://www.virustotal.com/

----------------------------------

by the way, now that you've replaced Avira with BitDefender, does it (BitDefender) find any problems when scanning, or does it assert you're clean?

March 2nd, 2009 15:00

Actually I did what Bugbatter said to do. I ran Bitdefender and it found no virus. I reboot my computer then turned on the restore. I ran Bitdefender again and it found no virus.  I like Bitdefender better because it does a deep scan on your system.

No Events found!

Top