Win32/AutoRun.ABH

paul333 · 11-12-2008, 08:05 AM

Hello,

After I have removed autorun.inf using FLASH DISINFECTOR and after I also used MALWAREBYTES' ANTI-MALWARE SCANS I thought I had cleaned my computer completely. But, except yesterday Nov. 11, I keep getting from ESET NOD32 the following:

12/11/2008 5:25:33 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020902.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

12/11/2008 4:12:25 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020878.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 11:36:08 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019884.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 10:22:15 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

10/11/2008 9:22:51 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0018850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe.

another MALWAREBYTES scan produces nothing!

Please advise

I thank you in advance for your kind attention and help

sUBs · 11-12-2008, 10:44 AM

Do this ....

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start >> Run - type control sysdm.cpl,,4 & press Enter

Tick on the checkbox - Turn off System Restore on all drives
Click Apply

Turn it back 'On' by unticking the same checkbox & click OK

NOD wont pick it up anymore after you have reset the cache

paul333 · 11-12-2008, 10:53 PM

Thank you very much, it cleared the problem!

God or (if you prefer) nature bless you!

11-12-2008, 08:05 AM	#1 (permalink)
paul333 Registered User Join Date: Nov 2008 Posts: 5 OS: win xp	Win32/AutoRun.ABH Hello, After I have removed autorun.inf using FLASH DISINFECTOR and after I also used MALWAREBYTES' ANTI-MALWARE SCANS I thought I had cleaned my computer completely. But, except yesterday Nov. 11, I keep getting from ESET NOD32 the following: 12/11/2008 5:25:33 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020902.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 12/11/2008 4:12:25 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0020878.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 11:36:08 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019884.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 10:22:15 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0019850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. 10/11/2008 9:22:51 pm Real-time file system protection file C:\System Volume Information\_restore{F229C88F-68CE-41E1-A890-F3D9A8BD1714}\RP54\A0018850.com a variant of Win32/AutoRun.ABH worm cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\System32\svchost.exe. another MALWAREBYTES scan produces nothing! Please advise I thank you in advance for your kind attention and help Last edited by paul333; 11-12-2008 at 08:07 AM.

11-12-2008, 10:44 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,234 OS: N/A	Re: Win32/AutoRun.ABH Do this .... CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder) Go to Start >> Run - type control sysdm.cpl,,4 & press Enter Tick on the checkbox - Turn off System Restore on all drives Click Apply Turn it back 'On' by unticking the same checkbox & click OK NOD wont pick it up anymore after you have reset the cache

11-12-2008, 10:53 PM	#3 (permalink)
paul333 Registered User Join Date: Nov 2008 Posts: 5 OS: win xp	Re: Win32/AutoRun.ABH Thank you very much, it cleared the problem! God or (if you prefer) nature bless you!