AMON Splash Screen not functional

Discussion in 'NOD32 version 2 Forum' started by Blackspear, May 27, 2004.

Thread Status:
Not open for further replies.
  1. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I have just taken a look at my virus log it shows the following has been going on for DAYS!!!! and not a single peep from AMON, what has happened to the glearing red splash screen that normally pops up o_O


    Time Module Object Name Virus Action User Info
    27/05/2004 19:45:20 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM
    27/05/2004 17:11:05 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM
    27/05/2004 16:59:05 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM
    27/05/2004 15:11:05 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM
    27/05/2004 13:26:34 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM
    27/05/2004 12:11:05 PM AMON file C:\System Volume Information\_restore{7EA69FAF-9D49-4735-B141-CB813AEFE73A}\RP26\A0003170.scr Win32/Sober.G worm error while cleaning - operation unavailable for this type of object NT AUTHORITY\SYSTEM


    and it continues...

    11/05/2004 21:51:54 PM AMON file C:\Documents and Settings\PC User\Local Settings\Temporary Internet Files\Content.IE5\3A47VHG5\all_launch_reg[1].htm probably modified trojan JS/NoClose.L error while cleaning - operation unavailable for this type of object
     
    Last edited: May 27, 2004
  2. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,729
    Location:
    Texas
    Do you use an anti trojan program along side NOD?
     
  3. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    No I don't, I trialed TDS but had problems of freezing with my XP machine, and being that I have a VERY stable system, I was NOT at all impressed. I'll give it another go later on.

    I'm just really concerned that AMON has been trying to deal with a problem for days on end and I have NOT been made aware of the situation...

    Cheers :D
     
  4. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,729
    Location:
    Texas
    Blackspear

    If you are using XP, any antivirus will be unable to clean in the system restore folder. It's protected by the operating system.

    Only way to get rid of those is to shut down system restore.

    In documents and settings, I would just delete that file.

    Is Nod set up to automatically delete viruses on your system with no warning?
     
  5. anders

    anders Eset Staff Account

    Joined:
    Oct 25, 2002
    Posts:
    410
    Do you have it set to automatically try to clean infected files?

    I think that the problem might also be that the files are accessed when no one is logged in (during booting for example), or that the files are accessed by the system account. If there is no user logged in, there is no desktop to display the errors on.. but.. then you shouldn't see the "error while cleaning" message.
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Since the virus was detected in the System volume information folder, it's necessary to turn off the System restore function.
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi Ronjor, Anders and Marcos, thanks for your replies, I do have AMON set to "Clean Automatically", I just expected AMON still to pop up and advise me there was an action being taken, even though I had set it to "Clean Automatically"...

    Surely there is a way of having the AMON Splash Screen pop up and stay there when using "Clean Automatically", I want to know that there is something happening in the backgound, that a virus has been detected and what AMON has or has NOT been able to do with the infiltration.

    I have system restore permanently turned off.

    Administrator is the ONLY account on my system.

    I was/am just VERY surprised to see that AMON had been having a struggle for days on end without success and I had NOT HAD A SINGLE warning that this was going on... and this is NOT a good thing...

    Cheers :D
     

    Attached Files:

    • AMON.JPG
      AMON.JPG
      File size:
      23.3 KB
      Views:
      130
    Last edited: May 27, 2004
  8. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,729
    Location:
    Texas

    Blackspear

    How is tomorrow? I'm still in yesterday! :D

    I wonder what the reference to system restore in the log means in this case?

    Does NOD think it is still turned on. o_O
     
    Last edited: May 27, 2004
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Scan log of 3 days ago 24th of May - ALL Clean APPARANTLY :( (I know about the zipped file, it was one that was NOT detected by Nod until virus patterns were updated 2 days later) and my settings are set to maximum, scan all files, runtime packers, archives etc etc...

    Cheers :D
     

    Attached Files:

    Last edited: May 29, 2004
  10. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Scan log from last night using the Command Line scanner and AH, this is where Sober.G was detected and cleaned from System restore, even though I have it permanantly turned off :rolleyes:

    Cheers :D
     

    Attached Files:

    Last edited: May 27, 2004
  11. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    You can have yesterday, I like today, it's much better :D
     
    Last edited: May 28, 2004
  12. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I wonder if the Sober.G infection that was found has something to do with the following thread

    https://www.wilderssecurity.com/showthread.php?t=32317

    This was when Sober.G first arrived on the market and Nod did not detect it. Still though having updated detection patterns 2 days later, I would have expected AMON and full scans by Nod to have detected infiltrations in the restore files, and being that I do NOT have system restore activated I wonder as to why these files were infected, does Sober.G target system restore?

    Cheers :D
     
  13. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    I'm confused about System Restore and cleaning/deleting viruses in it. Marcos says System Restore must be turned off in order to clean viruses in it. I don't understand.

    I ran NOD32 last night using this new ah command and NOD32 found 4 viruses that the regular NOD32 scan and adv. heuristics right click scan and AMON had all missed. NOD32 proceeded to delete 2 viruses from System Restore. Unlike Blackspear, I have System Restore up and running.

    So, how did NOD32 manage to delete 2 viruses from the protected active System Restoreo_O

    Does this deletion mean that all System Restore points up to, and including the last one before NOD 32's action, are now crippled and cannot be used to restore to?! If that is true then I sure I wish I hadn't left the "delete if not cleanable" command in that string! Ugh.
     
  14. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,729
    Location:
    Texas
Thread Status:
Not open for further replies.