Is this serious or not?Help!

Discussion in 'malware problems & news' started by whyme, Apr 8, 2003.

Thread Status:
Not open for further replies.
  1. whyme

    whyme Guest

    I just bought Extendia Antivirus AVK Pro at CompUSA for $19.99 and the KAV engine found this:

    Trojan.BAT.DeltreeY.au from file A0004279.CPY in C:\_RESTORE\TEMP

    It can't disinfect or delete it
    It says it can't move it into quarantine but when I check there it is in quarantine.

    Is this something to be worried about?

    Thanks
     
  2. xor

    xor Guest

    It's a batch trojan and it can result in false postives.
    This file proberly contains some code of deltree <dir>.
    Do not worry about this - its in the system restore - just disable and reenable system restore (xp) then is all ok :D
     
  3. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Yes, that will empty the system restore folder (you lose any backup points, sorry)

    The KAV BAT engine is fairly strong.. the name suggests the file in question must contain

    Deltree /Y

    Not unreasonable to detect something with that in it generically, Wormguard sure does :D False alarm or not (they are detecting it by signature), thats a batch file I would like to be warned about..
     
  4. whyme

    whyme Guest

    Thanks for the replys!

    I have Windows ME(unfortunately).What is the proper way to disable and reenable system restore?

    Thanks again...
     
  5. Technodrome

    Technodrome Security Expert

    Joined:
    Feb 13, 2002
    Posts:
    2,140
    Location:
    New York
    Go here:

    http://www.europe.f-secure.com/v-descs/sfc_dis.shtml


    Technodrome
     
  6. whyme

    whyme Guest

    I'm so very glad there are pc knowledgable people who are kind enough to give out advice for those of us who aren't as computer literate. :)

    Wilders has the best and most informative forum on the net.

    My thanks to all...
     
Loading...
Thread Status:
Not open for further replies.