Please help! virus in operating memory!

Discussion in 'ESET Smart Security' started by Trae, Mar 18, 2009.

Thread Status:
Not open for further replies.
  1. Trae

    Trae Registered Member

    Joined:
    Mar 18, 2009
    Posts:
    4
    It says win32/agent.ODG virus and can not be cleaned! another shows this on the c drive temp win32/patched.AE virus!
    I have no internet access, malawarebytes will not work, system restore says my PC is not protected, and my c drive will not open up at all - just a pop up about recyclers!
    I have a HP dc5000 windows xp pro, I think I downloaded this, by accident. I have used ccleaner rebooted etc and still the same!
    How can I get rid of this? Having to use my son's pc to access the internet! Please help!
     
  2. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Create a SysInspector log in ESS and send it off to support [at] eset [dot] com.
     
  3. Trae

    Trae Registered Member

    Joined:
    Mar 18, 2009
    Posts:
    4
    How can I send it without access to the net?
    Thanks so much for answering my question!:D
     
  4. bodgy

    bodgy Registered Member

    Joined:
    Sep 22, 2005
    Posts:
    2,387
    Location:
    Qld.
    Try booting your PC into SAFE mode (press the F8 key just after the flashing cursor or BIOS info disappears).

    Once in SAFE mode, delete all your system restore points, (virii can hide and respawn themselves from this location), then run an ESS scan, if it misses the file in the C:\temp directory then delete it manually (hold down the shift key whilst pressing delete will bypass the rubbish bin), then run the anti virus scan again. If the scan reports all OK or that there are items in quarantine - you can reboot back into normal Windows - if you are feeling a little insecure, you can run the scan again.

    If the virus is resident in RAM, when you reboot the computer leave at least a minute between shutdown and reboot.

    Post here or PM me if you are unsure on how to delete your system restore points.

    Colin
     
  5. Trae

    Trae Registered Member

    Joined:
    Mar 18, 2009
    Posts:
    4
    Okay will do but if I delete my system restore won't that disable me from going back to before I downloaded that virus? Or is system restore points different from system restore?
    Thanks so much, Colin!
     
  6. Trae

    Trae Registered Member

    Joined:
    Mar 18, 2009
    Posts:
    4
    Just went back to my pc and the gmer is still running? I used my usb stick to run that on the pc. Will that work or should I stop that and do the safe mode, Colin? Thanks
     
  7. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Um, use a different pc to send the log?
     
  8. bodgy

    bodgy Registered Member

    Joined:
    Sep 22, 2005
    Posts:
    2,387
    Location:
    Qld.
    They are one and the same.

    Window's System Restore only saves system settings such as registry, crucial dll files in system32 - it doesn't save things like programs or files. If you still have on your drive the program or file that was infected with the virus then even performing a restore won't do anything as it will just re-infect. If it has copied itself to System Restore, then again, shortly after you roll back your system files it is likely to re-infect your system.

    Rolling back to a pre virus set of files will give you a clean registry etc, but any programs you've installed in the meantime that rely on registry will require re-installing and you still have the virus on your system.

    Do you have any programs that might be giving you a problem and require you to rollback? If so, then you'll need to make a choice.

    Personally I disable the restore function and make disk images before installing software I think may cause a system problem, and I gain extra disk space :)

    Colin

    Colin
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.