The Mudcat Café TM
Thread #67816   Message #2234129
Posted By: JohnInKansas
11-Jan-08 - 02:56 PM
Thread Name: Tech: Trojan virus-cookie?
Subject: RE: Tech: Trojan virus-cookie?
If you have an indication of infection that's been on the machine for a while, it's quite likely that backups in System Restore have been infected. If so, in some cases, when you remove an infection, the next boot will find "missing entries" and System Restore may automatically put the infection back. NO AVG CAN CLEAN the stored backups in System Restore.

1. You should use Start|Run|regedit Export to save a copy of your Registry outside the System Restore vault, where you can if necessary get back at least to your present condition. (Even if it is infected, it may be better than a total crash.)

2. After getting the registry back up saved where you can get to it if needed as a last resort, TURN OFF Sytem Restore. This will delete ALL BACKUPS that System Restore has made, so that an infected old one can't be put back when you reboot.

3. If your machine hasn't been waking up to scan, it may not have been waking up for updates, so you should update at least the "definitions" for your AVG.

4. Especially if Trojans are indicated, it usually is more effective to run a full scan in SAFE MODE. Some AV programs require you to "run from a command prompt" in Safe Mode, so you'll need to determine whether this applies to AVG, and find the command. (If you can't find a way to run a full scan in AVG in Safe Mode, obviously running the scan in normal Windows is better than not going ahead and running it.)

5. (Optional) For getting into Safe Mode, Norton suggests a procedure that's much cleaner than the usual reboot - punch buttons and hope - suggested by most others. The method is included (Step 2 & 3 for WinXP, with a separate instruction for Vista) at Scanning for Threats in Safe Mode. A step is missing in their description however, in Step 3. To return to Normal mode, in addition to the "uncheck" on the "boot" tab, you should also move the check on the "general" tab back to "Boot Normally." It works as described, but you'll get an extra "say-what" from Windows asking if you want to boot normally.

Use your normal "safe boot" method if it works, or the Norton one if you don't remember which key your computer wants or if you have trouble "catching" the right spot in the boot cycle.

6. (personal preference) After getting a clean scan in Safe Mode, I always feel better running a fresh AV update and another "normal" full scan in Normal mode, but then I'm told I'm a little AR at times.

John