A Windows XP help forum. PCbanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » PCbanter forum » Microsoft Windows XP » Security and Administration with Windows XP
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Turn off system restore, to remove W32.Silly



 
 
Thread Tools Display Modes
  #1  
Old October 1st 08, 09:11 PM posted to microsoft.public.windowsxp.security_admin
jez47
external usenet poster
 
Posts: 5
Default Turn off system restore, to remove W32.Silly

Hi i am trying to remove the W32.Silly virus, however, when i try to access
the My Computerproperties to turn off system restore as an administrator the
error message is produced, Unable to locate file etc. caused by the virus.
How do i overcome this so i can remove virus and stop it from restoring
itself.
Any ideas greatly appreciated

Ads
  #2  
Old October 1st 08, 09:26 PM posted to microsoft.public.windowsxp.security_admin
nass
external usenet poster
 
Posts: 7,474
Default Turn off system restore, to remove W32.Silly



"jez47" wrote:

Hi i am trying to remove the W32.Silly virus, however, when i try to access
the My Computerproperties to turn off system restore as an administrator the
error message is produced, Unable to locate file etc. caused by the virus.
How do i overcome this so i can remove virus and stop it from restoring
itself.
Any ideas greatly appreciated



Run a thorough scan by doing the following steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start Control Panel Double click Network and Internet
Connections Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from he
SuperAntispyware - Free
http://www.superantispyware.com/supe...freevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/d....htm?s_cid=sah

Run a scan from here on-line:
http://security.symantec.com/sscv6/d...d=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from he
http://www.avast.com/eng/avast-virus-cleaner.html
Comodo BOClean : Anti-Malware Version 4.27
http://www.comodo.com/boclean/boclean.html

If you wish to send me your Hijackthis log I will be happy to help you
further or send to one of many forums on the internet!
Download Hijackthis and send me the log.
(http://www.trendsecure.com/portal/en...hijackthis.php)
my address is : to_you_ross(at remove this and repalce with the
obvious)yahoo.co.uk ( _ is underscore)

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/bui...wnloading-slim
Run Disk Clean Up on your Drive.
HTH,
nass
---
http://www.nasstec.co.uk


  #3  
Old October 1st 08, 10:24 PM posted to microsoft.public.windowsxp.security_admin
David H. Lipman
external usenet poster
 
Posts: 4,185
Default Turn off system restore, to remove W32.Silly

From: "jez47"

| Hi i am trying to remove the W32.Silly virus, however, when i try to access
| the My Computerproperties to turn off system restore as an administrator the
| error message is produced, Unable to locate file etc. caused by the virus.
| How do i overcome this so i can remove virus and stop it from restoring
| itself.
| Any ideas greatly appreciated


There are anti virus news groups such as; microsoft.public.security.virus for this
kind of discussion.

This is a worm not a file infecting virus so this means that it should be able to be
removed.

However it is NOT necessary to disable the System Restore cache to remove it. You should
only worry about re-infection IFF you may restore the system from a previous restore point
that was already infected. If you don't plan on restoring the system to a previous
restore point then the file(s) of this worm will eventually cache-out. The fact that the
System Restore cache is dysfunctional may mean there are NO restore points anyway.

As you have noted, the System Restore cache was either corrupted by the worm or disabled.
By what you posted, it sounds like the worm corrupted the System Restore functionality and
NT Service.

First scan your computer with your un-named anti virus application that detected the
W32/Silly worm. Make sure it has been removed from the system. Then...

Go to; %windows%\inf

Find; SR.INF and Right-Click on the file and choose; " Install"
{ example: c:\windows\inf\sr.inf }

Hopefully this will fix the System Restore cache functionality.

You can also double-check to make sure the system is clean by using the Sophos module of
my Multi AV Scanning Tool...


Download MULTI_AV.EXE from the URL --
http://www.pctip.ch/ds/28400/28470/Multi_AV.exe
or
http://212.98.39.7/ds/28400/28470/Multi_AV.exe

http://www.pctip.ch/downloads/dl/35905.asp
or
http://212.98.39.7/downloads/dl/35905.asp

English:
http://www.raymond.cc/blog/archives/...irus-for-free/


To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off






All times are GMT +1. The time now is 11:31 AM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 PCbanter.
The comments are property of their posters.