Sign of Trojan only in a restore point

RangerLeigh · 05-10-2009, 09:16 AM

I've been cleared in the removal help forum ( Possible infection - DDS and gmer info inside ) but I have a general question and think other people might be interested also. How does this happen? It was never detected any other way. And what is confusing to me is that it was only in the fourth to last RP, but not the last three.

From Avast:

4/29/2009 10:40:20 AM 1241030420 Leigh 3208 Sign of "Win32:Small-KMM [Trj]" has been found in "C:\System Volume Information\_restore{11710026-9BFD-4653-B8F8-1D6DE9FA165E}\RP1401\snapshot\_REGISTRY_MACHINE_SOFTWARE" file.

Thanks!

**TheShadowFl** · 05-10-2009, 09:35 AM

A possibility, is that an update to your Anti-Virus program found and removed the infection from that Restore point.

If you want to remove the restore points as a possible haven for malware, just shut off system restore and reboot. All the old restore points will be deleted.
Then turn System Restore back on and a new Restore Point will be created.
Any Malware hiding in restore points will be GONE.

I rely heavily on my System Restore to fix little glitches that arise from day to day.
It's so important to me, that I have put a script to "Force System Restore Point" in my startup folder, so it runs every time I reboot my PC.

I know,,,,I know,,,, some people don't like System Restore and won't use it no matter what. But I personally find it useful. It's a personal preference.

Cheers Mate!
The Shadow

RangerLeigh · 05-10-2009, 04:19 PM

Thanks, Shadow.

Avast removed it during the scan. I guess what confuses me is how something could be only in one restore point but not the in restore points created after the one its in and before a scan is performed. It just seems like it would be in all the restore points after the first incidence.

However it got in there I'm glad it never had a chance to get a hold on my system.

05-10-2009, 09:16 AM	#1 (permalink)
RangerLeigh Registered User Join Date: Apr 2009 Posts: 17 OS: XP Pro	Sign of Trojan only in a restore point I've been cleared in the removal help forum ( Possible infection - DDS and gmer info inside ) but I have a general question and think other people might be interested also. How does this happen? It was never detected any other way. And what is confusing to me is that it was only in the fourth to last RP, but not the last three. From Avast: 4/29/2009 10:40:20 AM 1241030420 Leigh 3208 Sign of "Win32:Small-KMM [Trj]" has been found in "C:\System Volume Information\_restore{11710026-9BFD-4653-B8F8-1D6DE9FA165E}\RP1401\snapshot\_REGISTRY_MACHINE_SOFTWARE" file. Thanks!

05-10-2009, 09:35 AM	#2 (permalink)
TheShadowFl TSF Enthusiast Join Date: Feb 2008 Location: Central Florida Posts: 290 OS: XP-SP3, Vista Ult. 64, Win-7/64	Re: Sign of Trojan only in a restore point A possibility, is that an update to your Anti-Virus program found and removed the infection from that Restore point. If you want to remove the restore points as a possible haven for malware, just shut off system restore and reboot. All the old restore points will be deleted. Then turn System Restore back on and a new Restore Point will be created. Any Malware hiding in restore points will be GONE. I rely heavily on my System Restore to fix little glitches that arise from day to day. It's so important to me, that I have put a script to "Force System Restore Point" in my startup folder, so it runs every time I reboot my PC. I know,,,,I know,,,, some people don't like System Restore and won't use it no matter what. But I personally find it useful. It's a personal preference. Cheers Mate! The Shadow __________________ A person with experience is never at the mercy of a person with an argument.

05-10-2009, 04:19 PM	#3 (permalink)
RangerLeigh Registered User Join Date: Apr 2009 Posts: 17 OS: XP Pro	Re: Sign of Trojan only in a restore point Thanks, Shadow. Avast removed it during the scan. I guess what confuses me is how something could be only in one restore point but not the in restore points created after the one its in and before a scan is performed. It just seems like it would be in all the restore points after the first incidence. However it got in there I'm glad it never had a chance to get a hold on my system.