Hi,

I recently rebuilt PC, wiped HDD fresh XP Pro install ect. Things were fine until i decided like a moron to download a matrix style screensaver which would work on my dual monitor display. Within an hour of installing and usign the screensaver McAfee virus scan detected a trojan and deleted it. Becuase it was deleted i assumed it was cleaned and quickly uninstalled the screensaver.

Since this attack McAfee virus scan has promted me 3-4 times of a trojan, all with identical locations but with slightly different file names (the numbers change in teh file name)

See screenshot of the latest warning from McAfee Virus scan

http://design2rent.co.uk/virus/image.jpg

since this is repeating and McAfee only seems to be deleting the threat rather than completely cleaning it i downloaded the below apps.

Spybot S/D
HiJackThis
Malwarebytes

Spybot scan results screenshot http://design2rent.co.uk/virus/sd.jpg

all removed now

Hijackthis log http://design2rent.co.uk/virus/hijackthis.log

never used this program before so not sure what to do with the log.

Malwarebytes results screenshot http://design2rent.co.uk/virus/mwb.jpg

nothing found



From the mcafee screenshot has anyone got any ideas why this trojan keeps returning and getting flagged as deleted but is not completely cleaned?

Any input would be great.

Cheers
I'm going to move this to the Virus and Spyware section...
MEANWHILE check the GUIDE at the top of the page...there may be more info needed.

patio.still happening, another screenshot from this morning.

www.design2rent.co.uk/virus/virus2.jpg

the 2 highlight lines are the questionable issues the other 2 are false POSITIVES as far as i can find.

Any ideas or any more info needed to help try and clean this?

Cheers

Don't worry, your computer LOOKS clean to me. This is something that confuses and misleads a lot of users. If you take a look at those infections, you'll see that they are in the System Volume Information folder. That folder stores all of your backups used by System Restore. Basically, what that means is that you had infections that were cleaned and now their backups are being stored in the SVI folder. They currently aren't a threat to your computer. However, if you use System Restore to roll the system BACK, you may get reinfected. What you should do is clear out all of your restore points and then start a fresh new clean one...

1. Go to Start > Programs > Accessories > System Tools > System Restore
2. Click on System Restore Settings.
3. Check Turn off System Restore and click OK.
4. Restart your computer.
5. Follow steps 1 and 2 to return to the settings, uncheck Turn off System Restore, and click OK.
6. Create a new restore point and close the program.

System Restore will now be active again. If you would like to learn more about System Restore, go here.