Very BIG Mystery, I scan with AVAST in “normal use with computer” and nothing
infections, I try to do a scan in “before pc start MODE” and AVAST found this infection:
WIN32: Malob-v CRYPT (or WIN32: Malov-v?)
Obviously, located in the xp restore points:
C: / system volume information … … RR3 … A0000669.exe
Now, removing restore points disappeared infection or the win32: Malob or not ?
There will be ‘still in my computer and infect’ even restore points
System C: in the next days or not ?
I think not (its true?) But if there is a tool to eliminate this
Win32: Malob?
Strangely never MBAM (AntiMalwareByte) never Hijackthis, or GMER had found nothing of this INFECTION!
And why AVAST in mode 'normal (and therefore not in startup)
He had not found this infection?
@ miciotta62
Infected Restore Points - There really is little benefit in chasing a detection in the system volume information folder. It is only there because it had previously been deleted or moved from the system folders and this is a back-up created by system restore.
Worst case scenario it isn’t infected and you delete it, you can’t use that restore point in the future, not much of a loss and the older the restore point is the less of an issue it is.
So if there is any suspicion about a restore point then it is best removed from the system volume information folder or it could bite you in the rear at some point in the future when you use system restore if it included that restore point.
However, that said, I wouldn’t expect GMER to find anything as it is a specialist anti-rootkit scanner.
MBAM is a weird bird as I have been using it for ages and I still don’t know if it scans system restore points as there is nothing specific in the Scanner Settings (image1). This is further complicated in that I gave up on system restore (for hard disk imaging) many years ago, so I have empty system volume information folders (no restore points).
HiJackThis is a busted flush as it hasn’t been updated in well over a year, not to mention it is an analysis tool and again, it doesn’t check the system volume information (restore points).
MBAM is a weird bird as I have been using it for ages and I still don't know if it scans system restore points as there is nothing specific in the Scanner Settings (image1).
I think it does....here is from a log i found on the net
Files Infected:
c:\system volume information\_restore{5d527826-05bd-4a83-8416-28acdda14001}\RP116\A0019772.exe (Malware.Gen) -> No action taken.
In this case, I would delete all restore points and once the system is totally clean, create a fresh one.
Provided you intend to continue to use System Restore.
