Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the last two weeks, when I was using MPC-HC (Media Player Classic Home Cinema) to watch some "justyfied" episodes, my F-Secure Client Security antivirus software alerted me that there was a threat in file A0027132.exe (the number increased each of the three times that the antivirus found a new threat). All these three threats are now quarantined and the files are:

1) C:/System Volume Information/_restore/{72AACB12-6526-40F2-81D7-69DF5809DD8A}\A0027132.exe
2) D:/System Volume Information/_restore/{72AACB12-6526-40F2-81D7-69DF5809DD8A}\A0027133.exe
3) D:/System Volume Information/_restore/{72AACB12-6526-40F2-81D7-69DF5809DD8A}\A0027134.exe

The three threats are recognized like:
1. Backdoor.Generic.360086
2. Trojan.Packed.8707
3. Trojan.Packed.8807

F-secure and the OS are both updated at the last release/virus definition.

share|improve this question
    
Good source of steps to follow in case of infection: superuser.com/questions/100360. Don't hesitate to add more details of what worked or what didn't, by editing your question. –  Gnoupi Jun 7 '10 at 7:46

3 Answers 3

up vote 3 down vote accepted

I deal with virus infection on a daily basis as an IT professional i would recommended the first step would be to Clear your system restore as this is where the viruses are located (or copying themselves to) this can be done by following these steps


To clear existing restore points

  1. Click Start, click All Programs, click Accessories, click System Tools, and then click System Restore.

  2. Click to add a check mark beside Turn off System Restore on all Drives, and click Apply.

  3. When you are warned that all existing Restore Points will be deleted, click Yes to continue.


Then i would suggest you download Malwarebytes and scan ASAP if this is not possible in normal Windows mode i would reboot holding the F8 key down and select "Safe Mode" and running a full scan.

After this i would suggest installing a Permanent Anti-Virus solution such as AVG

P.S The file name A0027132.exe is a generic name used by windows restore when it backs up current executable files. In other words when windows is backing up your files it's also backing up viruses.

Also to prevent future re-infection through web-browsing i would suggest installing Firefox

share|improve this answer
    
Thanks. +1. The only difference for me is I would use Microsoft Security Essentials as my anti-virus –  Xavierjazz Jun 7 '10 at 14:40
    
In my personal option i would never choose MSE as it has only been around since 2009 (Initial release), AVG on the other hand has existed since 1998 (First Release as AVG). Microsoft has constantly attempted to solve security issues with there products/software "Windows Firewall", "Windows Defender", "UAC".They fall down at the fact that most security flaws are found in Microsoft software in the first place most notable "Internet Explorer" this does occur because it is one of the most used OS's but my believe is if MS were to build "Quality" software and not "Cash Cows" less issues would occur –  Christopher Wilson Jun 7 '10 at 14:53
    
Thanks for the 1+, and i respect your choose :) –  Christopher Wilson Jun 7 '10 at 14:54

Try installing Avast! Free, update it, schedule a boot-time scan. After that is done, try MalwareBytes' Anti-malware. These two should really clean your PC.

(And yes, those two were real threats. PC virus loves to use System restore folder for example because a single user can't even go there.)

share|improve this answer
    
The last real infection I saw (a couple of years ago, not on my machine) couldn't be removed without reinstalling windows. Various antimalware tools claimed to remove it, but it just came back - probably some rootkit component that the antivirus wasn't aware of. Personally, I wouldn't trust a once-infected machine unless it was wiped and re-installed, or a pre-infection disk image was restored, or whatever. As for system restore, I turn it off as pointless - if you really need it, it probably won't work. Occasional backup hard disk images on external drives make a lot more sense. –  Steve314 Jun 7 '10 at 13:12

Since you already know the infected viruses you may use the removal tools dedicated for the each virus/Trojan. Since they are targeting just the infected one they may be more effective than a virus guard (Not sure though).

Norton Virus removal tools

Mcafee Virus removal tools

I don't know this is applicable but I think you can use Kaspersky antivirus for remove the virus. I think you can download a Beta from it's web site. Apparently It is very effective antivirus program than most of the other programs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.