trojan downloader help removing please

lynette00 · May 12, 2007

Hi, well i have spent a few days cleaning up my friends pc, i have one trojan left its in the E:\system vol information\restore and says is infected with trojan downloader agent RS. I have run bitdefender, DR WEB, spybot, adware, ccleaner, superantispyware, she has had this on here for awhile,
i am abit confused as she did a fresh install of windows, wondering if it only reformatted the C:\ drive an not the other 2 drives she has recently had installed E:\ and D:\ ??? after running bitdefender i thougt it may have been deleted, i set a new restore point and deleted all old restore points and run diskcleanup. not sure what to do now, If i need to post a highjackthis log form, do i start a complete new thread or can i post it under my txt??

Nod32 is picking the trojan up.

thanks

DavidGP · May 12, 2007

HI

Seems this malware is stuck in the E drive System Restore point and not on C, which the re-install of the OS will have cleared, when you delete all restore points is E drive not listed?

The malware stuck is system restore is dormant and not a threat unless you restore that restore point, especially if the rest of the system is OK.

What she may need to do is to Unhide all files:

Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click to expand...

then goto the E drive and locate the System Vol Info folder, but she will likely have no acess to it as its a system locked file, so you will have to take ownership of it by follwing the below:

http://support.microsoft.com/kb/308421

once you have ownership of the folder it will open and then just delete its contents.

Reboot and rescan.

If all ok then set the files and folders back to hidden ( just a tidy thing ) to do this repeat the unhide but reverse the instructions.

lynette00 · May 12, 2007

Hi,
Yes the E:\ drive is listed and i cleared the restore points, I followed your instructions, but the system vol folder was empty on the E:\ drive, hopefully i have done it correctly, its still coming up on nod32, You said its not to much to worry about, so it take it thats its not to serious, Can i just leave it there??

thanks for your help also, much apperciated

Log in or Sign up

trojan downloader help removing please

lynette00 Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

lynette00 Private E-2