Problem - 'AMON cannot clean'

Discussion in 'NOD32 version 2 Forum' started by Old NJ Lady, Jan 31, 2004.

Thread Status:
Not open for further replies.
  1. Old NJ Lady

    Old NJ Lady Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    3
    1. not sure if I have version 1 or 2 but since I just d/loaded and installed it yesterday, hoping it's 2 and I'm at right place.

    2. A window popped up after running NOD that said:

    Virus Information -
    C:\windows\STWSI\optimize.exe
    w32Trojan Downloader.Dfica.L trojan\

    AMON cannot clean - Event occured at attempt to access the file.

    3. What does this mean? I went ahead and deleted the file.

    4.Today I ran it again and in addition again to the AMON cannot clean statement I got : c:\systemVolume\Information\_restore03B68573-6272-4148-80E8-E8E.....a\0035740.exe This I renamed though I don't know where it went.

    5. What does this all mean?? o_O o_O Please help an "Old NJ Lady" Thanks.
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    If you have a single "Green and White" icon in your taskbar, then you have version 2 of Nod, if you have 3 seperate icons, you still have version one.

    You need to disable System Restore:

    Windows ME and XP utilize a restore utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and a Virus Scan will be unable to delete these files. You must disable the System Restore Utility to remove the infected files from the C:\_Restore folder.


    Windows ME

    1. Right click the My Computer icon on the Desktop and click on Properties.
    2. Click on the Performance tab.
    3. Click on the File System button.
    4. Click on the Troubleshooting tab.
    5. Put a check mark next to 'Disable System Restore'.
    6. Click the 'OK' button.
    7. You will be prompted to restart the computer. Click Yes.

    Note: To re-enable the Restore Utility, follow steps one to seven and on step five remove the check mark next to 'Disable System Restore'.



    Windows XP

    1. Right click the My Computer icon on the Desktop and click on Properties.
    2. Click on the System Restore tab.
    3. Put a check mark next to 'Turn off System Restore on All Drives'.
    4. Click the 'OK' button.
    5. You will be prompted to restart the computer. Click Yes.

    Note: To re-enable the Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.


    Once you have done this, run a full scan with Nod using the "Clean" button.

    This should do the trick...

    Cheers :D
     
  3. Old NJ Lady

    Old NJ Lady Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    3
    Thanks. Will follow the steps you gave in the order you gave them. Hope it's right to restore the utility BEFORE scanning. If not, if I get another error message I'll try again and reverse the order.

    Thanks again for your help. It's greatly appreciated! :D
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Sometimes, AMON may not be able to delete a particular file.
    This happens if the file was detected in a temp folder and has meantime been deleted (you should no longer be able to locate the file on the disk manually)

    Whenever there's a problem cleaning/deleting a file from within the AMON alert window, I suggest you close the window and perform a full system scan with NOD32 scanner.
     
  5. kingul

    kingul Registered Member

    Joined:
    Feb 1, 2004
    Posts:
    5
    I have the same problem where Amon cannot clean but I can delete the infected files manually.
    I have no restore system as I am running Win 2003.
    And they are not in temp folders.
    The infected file was on D: partition in normal folder.
    See post under Frank Fallon.
     
  6. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    If you try to open the infected file, AMON will detect this, however this can't delete them.
     
  7. Old NJ Lady

    Old NJ Lady Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    3
    Marcos and Kingul thanks! ;)

    sir_carew.... muchos gracias. Tu eres un hombre muy simpatico! ;)
     
Thread Status:
Not open for further replies.