trojan loopy.C help????

Discussion in 'NOD32 version 2 Forum' started by luckytuck, Mar 5, 2004.

Thread Status:
Not open for further replies.
  1. luckytuck

    luckytuck Guest

    NOD32 has detected loopy.C trojan and startpage.CE trojan

    Time   Module   Object   Name   Virus   Action   User   Info
    6/03/2004 14:31:25 PM   AMON   file   C:\System Volume Information\_restore{520F2D63-FAF9-4470-8A40-E431E972ABAF}\RP241\A0030499.exe   Win32/StartPage.BE trojan   quarantined   NT AUTHORITY\SYSTEM   
    6/03/2004 12:56:28 PM   AMON   file   C:\System Volume Information\_restore{520F2D63-FAF9-4470-8A40-E431E972ABAF}\RP241\A0030498.exe   Win32/Loony.C trojan   quarantined - deleted   NT AUTHORITY\SYSTEM   


    I have no idea what to do can anybody give advise?

    thanks
    Mark
     
    luckytuck, Mar 5, 2004
    #1
  2. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    NOD or any antivirus cannot clean inside the restore folder

    so
    Turn off system restore by following instructions here
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039 for Xp
    or here
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239 for ME

    That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable sytem restore & create a new restore point.
     
    dvk01, Mar 6, 2004
    #2
  3. ragamix

    ragamix Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    17
    Location:
    Bratislava, Slovak republic
    also take a look at http://www.nod32.com/support/faq.htm - click on "The infected files are still restoring themselves. What to do?" [it's at the end of the page]
     
    ragamix, Mar 6, 2004
    #3
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...