and post the results. Make sure to use version 1.06 which is toward the bottom of the list. The newer versions have been causing some problems. Also, quarantine wenever possible rather than deleting files.
Once we’re sure you are clean we can create fresh restore points and delete the old, infected points.
Other than these 3 detections do you have any symptoms of adware (popups, etc)?
Have you made a disk backup of the recovery partition? You should do this whether or not you decide to keep the partition.
Do the Ad Aware scan anyway. When we delete the old restore points and create new you will have only one restore point for each drive. I wouldn’t want this to be an infected point too.
HP provides a utility to make a single copy of the recovery partition. Its already on your computer (well, it should be there). I’m on an Acer right now but I’ll go locate it on an HP and post the method.
K adaware says Im clean. I just used 2007 because it doesnt give me problems. Anyway there is a program for making cd backups, but it takes like 29 cd’s or something
You will need to do the second part (removing old restore points) for both partitions:
Select Start > All Programs > Accessories > System tools > System Restore.
On the dialog box that appears select Create a Restore Point
Click NEXT
Enter a name e.g. Clean
Click CREATE
You now have a clean restore point, to get rid of the bad ones:
Select Start > All Programs > Accessories > System tools > Disk Cleanup.
In the Drop down box that appears select the drive (C: or D:)
Click OK
The System will do some calculation and the display a dialog box with TABS
Select the More Options Tab.
At the bottom will be a system restore box with a CLEANUP button click this
Accept the Warning and select OK again, the program will close and you are done
If you have a DVD burner a copy of the recovery partition usually only takes 6 or 7 disks. Its up to you, but if you make them and put them in a safe place you can restore to an “as shipped” condition from an uninfectable source any time you want.
can I delete the viruses? I dont want to back up an infected partition. And it takes 2 dvds, but 17 freakin cd’s and that’s all I have! dang guess im goin to wallmart
Compaq Application Recovery, Recovery Cd-DVD recovery, recovery tools cd, system recovery, application recovery, pc doctor and some informational tools
This is something of a guess but the 2 files listed appear to me to be legitimately pre-installed “junk-ware” that comes with HP/Compaq computers (yeah, I know “legitimately pre-installed “junk-ware”” is an oxymoron).
These files are part of a single application (APP17392 in the path) and you have a single program, Weatherbug, listed in the pre-installed programs that is often considered adware.
With no backups of any kind and no symptoms of true infection I’ll reiterate my concerns about breaking the recovery option and advise against removing these files.
I always delete weatherbug, it sucks anyway. However, what do I do about the virus in the system volume information/restore? I just noticed that every time I reformat avast finds this virus, and then when I delete it and later try a system restore, none of them work regardless of if they were made before or after deleting.
When you reformat/reinstall Weatherbug will be in 2 places - on the C: drive as an installed program and on the D: drive as a recoverable program. When you uninstall it, you remove it from C: but it remains on D: and will eventually show up in the D: restore points as well. Its not a virus - its just an adware program from the computer manufacturer. It cannot reinstall from C: to D: unless you tell it to do so.
If you uninstall it and then reset your restore points as I outlined earlier you should get rid of the C: drive detections. And I’m not sure there’s a real need to scan D: on a regular basis. Its well protected.
If you want to make very sure you’re OK scan with the free version of SuperAntispyware
For sure these ones are not needed and can be moved to Quarantine.
Can you check this files in VirusTotal?
I respect the opinion of mauserme but I see no reason to ‘restore’ an adware application each time you restore your computer from D. Is there any way to be sure that removing this files will affect the recovery capabilities?
I would recommend removal too if a copy of the recovery partition or some sort of back up could be made. But with out backup and no guarantee of a functional recovery option that I know of …
I’m not saying recovery won’t work - I just don’t know that it will.
I seriously doubt it will affect anything, because it isn’t a core windows system file, but then I am not totally sure. I didn’t even think a virus could get in D in the first place. My computer won’t even let ME in there.
You’re right to be prudent… I don’t know either.
What I know is that I won’t trust in a backup partition application that won’t work if you remove one file from it: neither if it makes a single archive file nor if they copy file-by-file… It won’t be a backup solution for me for sure 8)
Are you an user with administration rights?
Even though, there are access rights that the system can reach/do and you, the Administrator, can’t. I won’t be surprised if a virus uses this situation.
No, i mean there is a program which prevents you from going into the D drive. This is a compaq failsafe to make sure curious users don’t go in there and delete things.
Is it encrypted? I don’t think so, as avast can scan the partition.
If it is not encrypted, low level programs could access the partition. It’s only hidden to ‘common’ users and applications. Maybe not to a virus or advanced users…
