Trojan Horse

[[AK]Clay]

I'm getting a pop-up message on my PC from AVG, my anti-virus software saying:

AVG Resident Shield

Trojan horse Startpage.AY
is found in file
C:\System Volume Information\_restore{599EE blah blah blah (my words there)}\RP22\A0002764.exe

To remove this virus, please run AVG for Windows

So I do, and after the scan it says everything fine, nothing found so nothing fixed. The next day, same pop-up appears.

Windows won't let me even go into this directlry to manually find the file and delete it. Not sure what to do, but I'm sure not doing any more on-line purchases on this machine! Any tips and how serious my problem is here and how to fix?

-Clay

[the wolffman]

symantec's removal instructions

if it can't be accessed, it can't be run. the removal instructions should help you, but it appears the file's stuck in a system restore save point. i'd say deleting the restore point (can't determine which one though with the change in directory name) should be enough.

for future reference, you should be able to use ctrl+c on messages like that. you can do at least this when windows reports a crash.

[[AK]Rocks]

If you have window restore on then it may be backed up on your restore point file. Turn off system restore and turn it back on if you want restore pionts.

[[AK]Hardnok]

You can even try running the antivirus in safe mode...but the symantec information page is a good way to get it off too.

[[AK]Clay]

Thanks for all the help. I cleared out my system restore as described - hopefully that'll clear up the problem. It's frustrating that the very anti-virus software that was informing me of the problem (via pop-up) was then failing to actually find the problem and fix it. Doing so manually should take care of it though.

Thanks again, I'm always appreciative of the help on this board.

-Clay

[[AK]Rocks]

AV could only see it in the Restore point file, not clean it. That why it was always there. Every time your system opened the restore point file AV would flag it, but since the virus wasn;t there due to previous cleaning, it was only in the restore backup file.

On and Off of monitoring should do it.