Hello there,
I need some mega help on another problem. I went over to have a look at my brother-in-law's 'sick' computer. It is Windows Me and I managed to do an AVG Scan. I came up with about 4,000 infected files which were repaired but then the message came up that it was unable to repair:
C.\_RESTORE\TEMP\A0063948.CPY

After that every time I tried to boot up it said there was a virus:
Trojan Horse Downloader Agent.2BM: There was also a lot of other error messages: C:\Windows\NETGO32.EXE
C:\WINDOWS\SYSTEM.SD
C:\WINDOWS\SYSTEM\IPYO.EXE
C:\WINDOWS\SDKXU32.EXE
C:\WINDOWS\APPXB32.EXE
and others all with the .EXE tag

I had copied a few of the programmes which I had successfully used on my computer onto a CD but unfortunately it was not even reading the d: drive.
May I add that my brother-in-law cannot find his 'Rescue Disc' or his Installation Disc for Windows Me so I am at a loss as to what to try. Can anyone help?

Your system was infected at the time ME's System Restore function created one of its restore points, and now infected files are stored in your system restore folder. That folder is a protected system folder, which is why your AV program can't delete the infected files. Follow the instructions below to temporarily disable the system restore function; doing so will delete the contents (including the infected files) of the C:\_RESTORE folder:

http://service1.symantec.com/SUPPORT...rc=sec_doc_nam


Before turning the System Restore function back on, run a full anti-virus scan again and have your av program fix what it finds. If it still has trouble removing any infections, let us know.

Hi there,
Thank you very much for that. I'm going over to my brother-in-laws tomorrow and will let you know how I go on. One little thing bothers me. When you switch on his computer all he gets now is the AVG Orange virus message to say he has got a virus. It will not let you out of this screen. Any easy answers as to how I get to the Start the computer in safe mode to bypass this message. As I said before, he has not got a floppy disc. Many thanks again for your patience.
Mary (Scotland)

You get to the Safe Mode boot choice by hitting the F8 key as the computer is starting up. You have to hit the key at just the right time though (right as the initial BIOS startup messages finish and Windows begins to load), so you might have to try it a couple of times to catch it just right.

Once again, very many thanks. All advice taken and virus has now been cleared.
Very grateful for your advice.
Mary (Scotland)

Glad we could help


Thread marked as solved.

Sorry, I spoke too soon. When I left my brother-in-laws yesterday I had done another complete scan and it was virus free. I followed it up with a defrag etc and was quite happy with it when I left. I've come in from work tonight to a phone call to say that when he booted up the computer this morning he has got the trojan virus screen again. He was able to bypass it to get to his e-mails etc. Is there anything else I can check apart from disabling the RESTORE again and re-scanning?
Thanks
Mary

Or not. Oh well... :rolleyes:


You can try doing the following, and then doing another full anti-virus scan (make sure you have the absolute latest virus definition updates installed for your AV program):

- Reboot into safe mode

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- Delete the entire contents of all Temp, Cookie, and Temporary Internet Files folders

(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)

- Empty your Recycle Bin.

- Reboot normally.

I've moved this thread to our Security forum. Have a good read through other threads here to learn where to download and how to use some of the other recommended virus/trojan/adware/spyware/etc. detection and removal tools. AVG alone might not be enough to thoroughly clean your brother's system.

Windows ME is the type of development that offers the lowest level of assurance and falls under the lowest maturity level of the software development capability maturity model at best. I'm sorry to notify you but Windows ME offers no security at all.