Cannot change system restore settings

pureuser · Aug 6, 2006

This is my second go-round with the antispyware popup. First time was corrected by following your directions. This time however when getting to the step of disabling the System restore I cannot change any settings.

Do I have a second problem or has the antispyware malware gotten smarter? I will redo all your steps (plus logs) but was curious to find out if I had a second problem. Sorry no logs to post since I was confident of the fix based on it working perfectly 6 months ago.

It is interesting that the pop ups are now coming in pairs in quick succession. I will get two popups within seconds followed by the two website links.

Major Attitude · Aug 6, 2006

Have you tried disabling it in safe mode? Yes, the malware has gotten very smart by running as processes, renaming themselves and many other tricks.

Basically, if you can not disable system restore, continue all the steps and if you need to post Hijack This log, at that time let us know System Restore would not allow you to disable it.

chaslang · Aug 6, 2006

Welcome to Majorgeeks!

Just like malware is constantly changing, so is our READ ME procedure. We no longer have you disable system restore until we are sure ALL malware has been removed. If you are still having problems, you must refer to the current online guide and complete ALL steps below.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

[*]runkeys.txt - the log from GetRunKey.bat
[*]newfiles.txt - the log from ShowNew.bat

CounterSpy - ONLY IF you were not able to run Windows Defender

Bitdefender - from step 6

Panda Scan - from step 6

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

pureuser · Aug 8, 2006

Major Attitude said:

Have you tried disabling it in safe mode? Yes, the malware has gotten very smart by running as processes, renaming themselves and many other tricks.

Basically, if you can not disable system restore, continue all the steps and if you need to post Hijack This log, at that time let us know System Restore would not allow you to disable it.
Click to expand...

Major, thanks, yes the system restore in Safe mode worked. Now all is well, malware is gone...again.

Log in or Sign up

Cannot change system restore settings

pureuser Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

pureuser Private E-2