Member Avatar for craiggale

Upon installing windows 7 i immediately intsalled avast antivirus and did a full scan. A trojan horse was found in the old vista files which after update have been changed to windows.old, will this trojan horse still be active from there?

  • 2 Contributors
  • 6 Replies
  • 336 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by craiggale

Dani AI

Generated

Short expert summary tied to the thread: since reported the antivirus moved the detection into quarantine, that is the expected immediate outcome — quarantined files are isolated so they cannot be executed by the running OS until they are restored. (support.avast.com)

What “Windows.old” means and the risk: Windows.old is just a copy of the previous Windows installation (system files and user folders) kept after an upgrade; it is not part of the active installation and won’t run automatically by itself. That said, malware can persist if the current installation has been modified to call files (for example via registry Run keys, scheduled tasks, services, etc.), so treat files in Windows.old as potentially infected until verified. (learn.microsoft.com)

Practical, low-risk steps to finish the job (ordered): verify the AV entry is quarantined and then permanently delete it from quarantine; update signatures and re-scan the Windows.old folder explicitly; if the old files are not needed, remove Windows.old using Disk Cleanup’s “Clean up system files” → “Previous Windows installation(s)”; run an offline/bootable scanner (Microsoft Defender Offline or a rescue disk) to catch anything a live scanner might miss. These steps remove the leftover files and detect stealthy/rootkit-type components. (learn.microsoft.com)

Followup checks and last-resort advice: inspect startup/persistence locations (Task Scheduler, msconfig/startup, HKLM/HKCU Run keys) — Autoruns (Sysinternals) makes this efficient — and consider cleaning old System Restore points if there’s concern about reinfection. If persistent signs remain after offline scans and persistence cleanup, prefer a full wipe-and-reinstall from known-good media. Backups before any destructive action (the precaution suggested) are the right call. (learn.microsoft.com)

Recommended Answers

All 6 Replies

Member Avatar for D3m3nt3d

Shouldnt be a problem, however the windows.old folder is for older documents and settings...do you already have your important documents backed up? If so you can just delete the windows.old folder.

Member Avatar for craiggale

ye i made a back up before upgrading, its just handy to have all the old files right there. thanks for the reply

Member Avatar for D3m3nt3d

What trojan name is it showing, and does it give you the file location of where this trojan is?

Member Avatar for craiggale

i've just deleted it from the antivirus chest, it was win32:zbot-lyk[trj] in my old temporary internet files

Member Avatar for D3m3nt3d

Good deal - If it was in the Antivirus chest, it was already quarantined so you're good :icon_smile:

Member Avatar for craiggale

thanks

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.