MSE says it removed WIN64/Rovnix.gen!A but............ - Am I infected? What do I do?

| | TrackBacks (0)

Bleeping Computer: MSE says it removed WIN64/Rovnix.gen!A but............ - Am I infected? What do I do?

My wife, feverish and not thinking clearly, opened an infected zip file attached to an email. I was away from home, advised her to use System Restore, to restore system files back to the state prior to her mistake. She reported that she couldn't -- system restore was turned off and the System Protection tab on the computer properties dialog was missing.

I used Windows Defender Offline (from a bootable USB thumb drive -- had to be plugged into a USB2 port) to scan the hard drive. It found and cleaned Rovnix.gen!A and another virus, but I still couldn't see the system protection tab. I ran Kaspersky's TDSSKiller -- found nothing further. I updated and ran MalwareBytes and Spybot Search and Destroy -- found and cleaned some annoyances but nothing big. I ran SysInternals Startups and disabled some services and processes that looked dodgy.

Finally I found this article. I ran through all the steps recommended by "Broni" -- first in safe mode, then in normal mode, then in safe mode again. Now we have a System Protection tab again, and I was able to enable System Restore. Then again it might have been because of a Microsoft Windows security update.

0 TrackBacks

Listed below are links to blogs that reference this entry: MSE says it removed WIN64/Rovnix.gen!A but............ - Am I infected? What do I do?.

TrackBack URL for this entry: https://www.batesline.com/cgi-bin/mt/mt-tb.cgi/7300

Contact

BlogAds

Support BatesLine

Show your appreciation and help fund hosting and research expenses:

Official PayPal Seal

Enjoy affordable and reliable hosting with Bluehost and support BatesLine at the same time -- click here!