Tech Support Forum - View Single Post

paul333 · 11-12-2008, 09:05 AM

Hello,

After I have removed autorun.inf using FLASH DISINFECTOR and after I also used MALWAREBYTES' ANTI-MALWARE SCANS I thought I had cleaned my computer completely. But, except yesterday Nov. 11, I keep getting from ESET NOD32 the following:

12/11/2008 5:25:33 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020902.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

12/11/2008 4:12:25 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020878.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 11:36:08 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019884.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 10:22:15 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 9:22:51 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0018850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

another MALWAREBYTES scan produces nothing!

Please advise

I thank you in advance for your kind attention and help

11-12-2008, 09:05 AM	#1 (permalink)
paul333 Registered User Join Date: Nov 2008 Posts: 5 OS: win xp	Win32/AutoRun.ABH Hello, After I have removed autorun.inf using FLASH DISINFECTOR and after I also used MALWAREBYTES' ANTI-MALWARE SCANS I thought I had cleaned my computer completely. But, except yesterday Nov. 11, I keep getting from ESET NOD32 the following: 12/11/2008 5:25:33 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020902.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 12/11/2008 4:12:25 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020878.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 11:36:08 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019884.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 10:22:15 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 9:22:51 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0018850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. another MALWAREBYTES scan produces nothing! Please advise I thank you in advance for your kind attention and help Last edited by paul333; 11-12-2008 at 09:07 AM.