Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: chipshot on April 19, 2007, 11:05:59 PM
-
During a regular scan "Avast found Adware" notification popped up showing a location in the C:\System Volume Information\.... folders with the recommendation of moving it to the Chest. Did so and C:\System Volume Information\_restore (original file location) with the name A0064373.exe showed up in the chest OK.
However, subsequent scans show no infested files but a summary listing 49 lines of files in C:\System Volume Information\_restore..... folders with the notation "Unable to scan. Archive is password protected" and one file "Unable to scan. Installer archive is corrupted".
I assume these files are unscanable because they are associated with System Restore?
Is "Adware" a specific virus as opposed to the general adware?
Am I home free in spite of these unscanable files?
If not, what further should I do?
I'm a newbe so hope the above isn't too basic for someone's attention.
-
If a virus is replicant (coming and coming again), you should:
1) Disable System Restore on Windows ME (http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887) or Windows XP (http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405). System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again.
2) Clean your temporary files. You can use [ur=http://www.stevengould.org/downloads/cleanup/]CleanUp[/url] or the Windows Advanced Care (http://www.iobit.com/AdvancedWindowsCarePersonal/index.html) features for that.
3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (http://support.microsoft.com/default.aspx?scid=kb;en-us;315222) (repeatedly press F8 while booting).
4) It will be good if you download, install, update and run other trojan remover tools: a-squared (http://www.emsisoft.com/en/software/free/) and/or Free AVG Antispyware (http://www.ewido.net/en/) (trojan removers). Some users recommend SUPERantispyware (http://www.superantispyware.com) or Spyware Terminator (http://www.spywareterminator.com/).
5) Use the immunization of [ur=http://www.javacoolsoftware.com/spywareblaster.html]SpywareBlaste[/ur]r or, which is better, the Windows Advanced Care (http://www.iobit.com/AdvancedWindowsCarePersonal/index.html) features of spyware/adware cleaning and removal.
-
Adware isn't a virus.
Files aren't normally password protected in _restore points allied to the installer archive corruption as well it might be best to clear out the system volume information folder and start afresh clean.
The c:\System Volume Information folder is a part of the system restore function and as such is protected by windows (but not normally by password), the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points. Once you have disabled system restore, reboot, scan your PC again and if clear enable system restore.
Win XP-ME - How to disable System Restore (http://www.pchell.com/virus/systemrestore.shtml)