Wierd infection in system restore

[Cyber 14]

Hi all,

Booted up my XP today and, when I returned to start using it, ZoneAlarm came up saying that it had found "virus.dos.horse.1576" in my system restore files. However, it was found nowhere on my system and, when a ZL super scan was started, the only viruses found where in my ZL Forcefield virtual browser cache, protected from my machine by the virtual browser. I have never had another virus attack stopped by ZL on this computer since reformatting last month. Could this virus have been contracted during "learning mode" on ZL Extreme Security, wherein one's system security is lower, and been deleted in a temp file but not before being saved as part of a system restore package?

Is it possible that the virus was actually from a virtual browser cache, the virus quarantined but saved into system restore? Can viruses run out of restore files? I don't remember if it had been brought to my attemtion through a scheduled scan or because it had been trying to run.

Does anyone have information about "virus.dos.horse.1576". I haven't been able to find out a whole lot about it.

Maybe I'm overreacting. Getting a virus is bound to happen to even the most careful user, and there's a big difference between "on the machine" and "running and being a virus", the latter of which all reputable antivirus software prevents.

Thanks.

Peace out and God bless.

[techsheaven]

I don't use Zone Alarm, but I will tell you you should turn off system restore, hit apply so it will delete all your restore points. Then turn it back on and set a new restore point. This way you will not restore a virus.

[kristain]

If an infection is found in the "C:\system volume information\restore" folder, you will have to disable System Restore.

The System Restore feature is built into Windows XP and Windows ME and is used to return your computer to an earlier state if you have a system failure or other major problem with your computer. The point of System Restore is to restore your system to a workable state without you having to reinstall the operating system and lose your data files in the process.

System Restore takes snapshots of your computer system and saves them as restore points. These restore points mark configuration places to return to, in the event of a problem with your computer that might occur after you install an unstable device driver or an older application. Because the snapshots are taken when your computer was infected, it does not mean that your computer is presently infected

[Cyber 14]

Is it absolutely necessary that I do that? ZoneAlarm cleaned the point of the infection. I'll do it if necessary, but I'd rather not if I don't have to.

It's strange, I don't remember that virus ever being quarantined or causing any problems when it was supposedly on my system. Could it have been a browser or other internet temp file that hadn't run yet and was deleted, but not before being logged into restore. I delete my IE data every couple of days to keep down on clutter.

Can viruses run out of the restore folder? I don't remember if it was a scheduled scan or attempted action on its part that caused it to be quarantined.

Thanks.

Peace out and God bless.

[techsheaven]

I guess it would be up to you, but something removed from a restore point would likely cause it to fail, or cause other errors if you ever even used it.

Good Luck

[Cyber 14]

I guess you're right. I'll have to do that when I get around to it.

Anyone care to hazard a guess as to how this infection managed to get in undetected? I 'm always careful about my downloads and use ForceField at all times. I think it may have been a temp file in a cache that was automatically dragged into a restore file before I deleted it in the system proper, as I stated above. Does that make sense? Can viruses run out of restore files? I don't remember if it was a scheduled scan or the virus trying something that caused it to get picked up.

Thanks.

Peace out and God bless.

[jholland1964]

I guess you're right. I'll have to do that when I get around to it.

Anyone care to hazard a guess as to how this infection managed to get in undetected? I 'm always careful about my downloads and use ForceField at all times. I think it may have been a temp file in a cache that was automatically dragged into a restore file before I deleted it in the system proper, as I stated above. Does that make sense? Can viruses run out of restore files? I don't remember if it was a scheduled scan or the virus trying something that caused it to get picked up.

Thanks.

Peace out and God bless.

No viruses generally don't run out of restore files UNLESS those particular files are restored.
You don't seem very concerned here... >>>I'll have to do that when I get around to it.
Setting a new Restore point takes maybe 30 seconds max..."when you get around to it."

Next time when you have a problem how would you feel if we say I will help you when I get around to it.?
As stated in our Read Me Sticky:
• Our volunteers can only address a limited number of threads at a time. If you wait too long to reply, they may move on to helping others and no longer have the free time to devote to your issues.

I am marking this one solved.

[Cyber 14]

I'm sorry but that computer is not at home and I'll have to drive into town to do that. It is an old secondary computer of mine at my work and is not often used. When I'm at work I'm working, and not on that computer, so yes, when I get around to it. I'm not blowing it off so much as I just don't have the time while at work. It is a busy time for me and I'll do it when I have a moment, that's all. Sorry if that came out harsh but that's how it is. Maybe not the best choice of words on my part originally.

Glad to hear they can't run out of restore. Must have been a backed up scan that picked it up. Thank you for all your help.

Peace out and God bless.

[jholland1964]

I'm sorry but that computer is not at home and I'll have to drive into town to do that. It is an old secondary computer of mine at my work and is not often used. When I'm at work I'm working, and not on that computer, so yes, when I get around to it. I'm not blowing it off so much as I just don't have the time while at work. It is a busy time for me and I'll do it when I have a moment, that's all. Sorry if that came out harsh but that's how it is. Maybe not the best choice of words on my part originally.

Glad to hear they can't run out of restore. Must have been a backed up scan that picked it up. Thank you for all your help.

Peace out and God bless.

Apology accepted. As far as the items being in System Restore, yes, that is likely how they got there. It would have been in the last few months, at the very most. System Restore only uses so much space and as new restore points are created the oldest ones drop off for several reasons, one of course there wouldn't be space for new ones but the other reason being is that System Restore is only to be used for VERY RECENT changes, like a few DAYS, not weeks or months. This is really one reason the default size of System Restore, generally around 12% of the hard drive is way too large because you may end up with months old restore points. It should really be reduced to around no more than 5%. This gives you more disk space for one thing plus doesn't hold those weeks or months old restore points that you would never want to use anyway.

System Restore actually operates only on a very few system files and settings. System Restore backs up your registry. System Restore does not backup your data. If you delete or damage a file, System Restore will not recover it. System Restore will NOT uninstall a program. In fact if you have installed a program and find you don't want it and you use System Restore to try to remove it then it may leave you with much of the program on the system taking up space but it just won't be listed in Add/Remove, making it much harder to uninstall. System Restore does not keep old copies of your files or settings. If you're looking for an "old version" of a file or program that you used to have on your machine, System Restore isn't going to have it. System Restore does not fix your system. So if your computer crashes and needs to be repaired System Restore will not repair it.