Member Avatar for foxkueh

I have a warning from AVG that there is a virus in my system with the above name. I was asked to run AVG but failed to detect it. I have the latest update of AVG virus information.
The location of the virus is:
C:\System Volume Information\_restore{A5073A68-187E-4B32F-058F2831B5A9}\RP9\A0000396.exe
The message pops up regularly. Can someone help? Any :idea: ?

  • 3 Contributors
  • 3 Replies
  • 99 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by alc6379

Dani AI

Generated

Brief expert note: the AVG alert naming IRC\BackDoor.SdBot indicates an IRC-controlled backdoor. As reported, the detection came from a restore-snapshot and correctly removed the restore points; that often clears the persistent alert because infected files are stored only inside System Restore data. marked the thread solved after that follow-up.

What to do next (verification and hardening):

  • Run at least two full scans with different engines (for example an updated on-demand scanner and an offline rescue scanner) to confirm no live copies remain. Use a rescue environment if malware blocks scanners.
  • Check for persistence and network activity with tools such as Autoruns and Process Explorer, or by listing active TCP connections (netstat -ano) to spot unknown processes connecting to IRC ports (commonly 6667 and similar).
  • Inspect services, scheduled tasks and startup entries for unfamiliar items, and examine user accounts and shared folders for signs of spread.

Cleanup cautions and follow-up:

  • Change all passwords from a clean device if the machine was accessible while infected.
  • Keep the host disconnected from the network until you are confident it is clean.
  • If scans still flag components or you find unknown persistent services, a full reimage is the safest route; partial cleanups can leave backdoors behind.
  • After cleanup, fully patch the OS and enable a host firewall and real-time protection to reduce re-infection risk.

If there is any doubt about thorough removal, consider professional removal or reinstallation. The steps taken by often resolve restore-point detections, but confirm with fresh scans and network checks before returning the machine to normal use.

Recommended Answers

All 3 Replies

Member Avatar for crunchie

Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

You will lose all previous restore points.

Member Avatar for foxkueh

Hi Crunchie,
It is done. I hope this will stop the pop up.
Thanks for your help.
Foxkueh

Member Avatar for alc6379

Now marking thread as Solved. If this actually did not solve the issue, contact a moderator via PM, and we'll un-mark it for you.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.