NOD32 see 28 infected files. help!

Ulisse · Dec 4, 2004

Hello, when NOD32 start automatically for searching infected files, at
the end of the run it sees 28 infected files. I attach them
on the bottom.
If I open NOD32 Control Center and I click on "In-depth analysis"
NOD32 doesn't see any infected files.
I am sure I have configured NOD32 very fine.
Why I have this problem?
Thanks Ulisse

C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039420.dll
- Win32/Adware.SearchRelevancy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039437.exe
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033835.exe
- Win32/Adware.Rebate Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033860.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033869.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033870.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034828.dll
- Win32/Adware.WinAd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034829.dll
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038913.dll
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038914.exe
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038916.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038917.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038918.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038919.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038926.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038928.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038965.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038966.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038971.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039015.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039016.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039019.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039020.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039022.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039024.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039144.exe
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039192.dll
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039193.exe
- Win32/Adware.NdotNet.A Application

Spock · Dec 4, 2004

Hello, when NOD32 start automatically for searching infected files, at
the end of the run it sees 28 infected files. I attach them
on the bottom.
If I open NOD32 Control Center and I click on "In-depth analysis"
NOD32 doesn't see any infected files.
I am sure I have configured NOD32 very fine.
Why I have this problem?
Thanks Ulisse

C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039420.dll
- Win32/Adware.SearchRelevancy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039437.exe
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033835.exe
- Win32/Adware.Rebate Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033860.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033869.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033870.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034828.dll
- Win32/Adware.WinAd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034829.dll
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038913.dll
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038914.exe
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038916.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038917.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038918.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038919.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038926.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038928.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038965.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038966.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038971.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039015.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039016.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039019.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039020.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039022.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039024.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039144.exe
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039192.dll
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039193.exe
- Win32/Adware.NdotNet.A Application

Turn off system restore, restart, scan with NOD again. Make a new
restore point when finished.

SC · Dec 4, 2004

Hello, when NOD32 start automatically for searching infected files, at
the end of the run it sees 28 infected files. I attach them
on the bottom.
If I open NOD32 Control Center and I click on "In-depth analysis"
NOD32 doesn't see any infected files.
I am sure I have configured NOD32 very fine.
Why I have this problem?
Thanks Ulisse

C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039420.dll
- Win32/Adware.SearchRelevancy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP102\A0039437.exe
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033835.exe
- Win32/Adware.Rebate Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033860.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033869.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP87\A0033870.exe
- Win32/Adware.BargainBuddy Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034828.dll
- Win32/Adware.WinAd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP92\A0034829.dll
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038913.dll
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038914.exe
- Win32/Adware.NdotNet Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038916.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038917.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038918.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038919.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038926.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038928.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038965.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038966.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0038971.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039015.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039016.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039019.dll
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039020.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039022.exe
- Win32/Adware.Webhancer.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP98\A0039024.exe
- Win32/Adware.Webhancer.A.installer Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039144.exe
- Win32/Adware.WUpd Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039192.dll
- Win32/Adware.NdotNet.A Application
C:\System Volume
Information\_restore{C09EEC88-D930-4E0B-A56B-DE10C11ED3B3}\RP99\A0039193.exe
- Win32/Adware.NdotNet.A Application

Running a scan is only a scan, if you want NOD to attempt to get rid
of the viruses then run the On Demand Scanner and click CLEAN.
Report back any problems with this.

Peter Seiler · Dec 4, 2004

Spock - 04.12.2004 21:28 :

Turn off system restore, restart, scan with NOD again. Make a new
restore point when finished.

no need of 100 quoting lines (snipped) only to say that. Everybody may
read back. THX for your understanding.

Peter Seiler · Dec 4, 2004

SC - 04.12.2004 21:41 :

Running a scan is only a scan, if you want NOD to attempt to get rid
of the viruses then run the On Demand Scanner and click CLEAN.
Report back any problems with this.

same to you:

no need of 100 quoting lines (snipped) only to say that. Everybody may
read back. THX for your understanding.

BagPuss · Dec 4, 2004

These are not viruses. They are adware/spyware. Download Spy Sweeper Trial
Version from webroot.com and update the definitions. Then run a scan. It
will remove them all easily.

Roger Wilco · Dec 4, 2004

Ulisse said:
Hello, when NOD32 start automatically for searching infected files, at
the end of the run it sees 28 infected files. I attach them
on the bottom.
If I open NOD32 Control Center and I click on "In-depth analysis"
NOD32 doesn't see any infected files.
I am sure I have configured NOD32 very fine.
Why I have this problem?

Because you have malware in your restore points that won't be scanned on-demand yet will be scanned on-access when
the OS looks at them. Purge the restore points and they will be gone (until you collect some new ones). Whenever a
malware file is deleted, the OS saves a pristine copy of the malware in the restore directory which is off limits to application
software.

Spock · Dec 5, 2004

Spock - 04.12.2004 21:28 :

no need of 100 quoting lines (snipped) only to say that. Everybody may
read back. THX for your understanding.

Point taken! Is this okay? --

lcs Mixmaster Remailer · Dec 5, 2004

These are not viruses. They are adware/spyware. Download Spy Sweeper Trial
Version from webroot.com and update the definitions. Then run a scan. It
will remove them all easily.

better yet, get AdAware SE Personal (FREE)
http://www.lavasoftusa.com/support/download/

and Spybot Search & Destroy (FREE)
http://www.safer-networking.org/en/index.html

each one catches things the other misses. I regularly use both

Gary · Dec 5, 2004

SpySweeper will find things that Ad-aware and Spybot miss also. Good to run
all three.

NOD32 see 28 infected files. help!

Ulisse

Spock

SC

Peter Seiler

Peter Seiler

BagPuss

Roger Wilco

Spock

lcs Mixmaster Remailer

Gary