up vote 0 down vote favorite
share [g+] share [fb]

I got the following warning from my antivirus:

enter image description here

Translation: 

 Warning
 Potential threat found

 Object: 
 C:\System Volume Information\restore{ .....\A00009511.exe

 Threat:
  Win32/HackAV.GV potentially dangerous application

 Comment
 The event happened during an intent to access a file from the
 application: C:\WINDOWS\system32\svchost.exe

What is happening here?
Is some dll invoked by svchost infected?
Why is it trying to access a _restore file?

link|improve this question
feedback

1 Answer

up vote 4 down vote

The service detecting the infection, hosted by svchost, is probably the ekrn service (ESET's scanning service).

Usually this means it's found an infected file in a old system restore point.

To 'clean' this I usually disable System Restore to destroy all the restore points, re-enable it, and then make a fresh restore point.

link|improve this answer
I already did that a few days ago, but the thing re-appeared, so I guess something worst is happening. Do you know how to check if the ekrn is the one trying to access the file? – belisarius May 13 '11 at 10:12
@belisarius - yeah, that's kind of weird (that it came back). Have you done a full scan of the computer? You can probably use MS' Process Monitor (google it) and filter for writes to the system volume info folder. Currently I like using HitmanPro for a quick '2nd opinion' scan. – techie007 May 13 '11 at 12:18
The full scan reports only the _restore file, but I don't trust it, because that does not explain why it is coming back, and why svchost.exe is accessing it. I will try deleting the restore points and monitoring writes to the volume info. Nice idea. – belisarius May 13 '11 at 12:37
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.