system restore

[obleyo]

I have a trojan virus that McAfee cannot completely remove and it has
affected system restore. I was attempting to turn off system restore to do a
scan in DOS mode, but I received a message "system restore encountered an
error trying to enable/disable one or more drives. restart computer and try
again." I restarted but the same happened. I am not able to use system
restore and I believe the virus is causing the problem. Any thoughts?

 

[kim]

Boot into safe mode and try from there.

 

[obleyo]

Okay so I booted in safe mode and still was not able to turn off system
restore nor am I able to even restore anything. System Restore is not
responding and the message in the restore window says "There are no available
restore points". I ran a DOS scan and it reported no viruses, but that I
think is because it can not access system restore where the virus seems to
be? How do I proceed? Please help.

The virus, by the way, has left an icon in my taskbar that is continually
flashing and when I right or left click on it I am taken to a web page for a
fake viroprotection site. I can not delete the icon. It also causes the
system to redirect my cursor away from where I am writing every 5 minutes or
so, so that I have to click back in the area where I am writing to bring the
cursor back.

 

[PA Bear [MS MVP]]

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.