Help with a virus...

[MacBaine]

Ok... I use AVG, and I keep getting a pop-up that tells me the following:

Virus
Trojan horse IRC/BackDoor.Flood

is found in file
C:\System Volume Information\_restore{long string of digits}\RP19\A0000908.BAT

To remove this virus, please run AVG for Windows


The thing is, I have run AVG twice, with the latest virus database, and it doesn't pick anything up. The popup happens every hour or so, and the only thing I can think to do is just delete the file it is reporting. Is this the only thing I can do?

 

[dighn]

back up the file and delete it

 

[MacBaine]

Originally posted by: dighn
back up the file and delete it

Wouldn't that mean backing up the virus too? 😕

 

[hevnsnt]

just change the extention to something other than "bat"

 

[Muck]

Dumbasses!! Everybody reading this thread is now infected too!! 😕

 

[dighn]

Originally posted by: MacBaine

Originally posted by: dighn
back up the file and delete it

Wouldn't that mean backing up the virus too? 😕

yes but if you just back it up and dont run it it should be fine i think

just in case that's some vital file though i dbout it

 

[GhettoFob]

if it's really a .bat file, couldn't he just open it with a text editor to see what it says?

 

[dighn]

Originally posted by: GhettoFob
if it's really a .bat file, couldn't he just open it with a text editor to see what it says?

good idea

post what it says here

 

[MacBaine]

Ok... new problem. The "directory" it lists as infected isn't actually a directory. I have no idea what to do... any suggestions?

 

[wfbberzerker]

Originally posted by: MacBaine
Ok... new problem. The "directory" it lists as infected isn't actually a directory. I have no idea what to do... any suggestions?

try making hidden directories visible to see if it shows up then. otherwise delete it in dos.

 

[Kalvin00]

Reformat.

 

[Muck]

I had a very similar problem occur while a friend was uploading files to my FTP server two weeks ago. Kept getting the exact same virus alerts you are during the entire session (which lasted all night). Full virus scan couldn't see it. And the infected directories didn't seem to exist. After much research, I played it safe. Since it was only a day-old installation, I just went ahead and reformatted.

 

[BennyD]

try ad aware or spybot, if they don't find it try nuking it in dos(command prompt)

 

[MacBaine]

I'm gonna try AdAware and whatnot... otherwise try dos... I really don't want to have to reformat... I just did less than a month ago 🙁

 

[OZEE]

Try this. It's a trojan, not a virus. Typical virus-scanners don't deal well with trojans.

Plus, it's in one of your system restore backups... So you'll reinfect yourself if you ever have to restore.

 

[guyver01]

Most AntiVirus proggies don't deal well with Trojans.

Download the free trial for eTrust EZ Antivirus.. they handle Trojans remarkably well.

http://www.my-etrust.com/

 

[OZEE]

Also, I forgot that you have to turn off your system-restore in able to fix a bug in the restore files...

From McAfee