Virus keeps returning :)

[Cider]

Hey all

Client using Panda Antivirus - it keeps finding trj/Rizalof.RG - disinfecting it as it should however it comes back now and again. He has turned off system restore and on again a few times so I ruled that out as a possibility.

Anyone know how to permanent delete this one

Googled it however nothing solid.

Thanks.

[moxquito]

It would seem to me that if it keeps comming back after an AV program has removed it, one of his floppy/CD's or files on external drive is infected. I would recommend scanning all insertable media your client has.

[KorpDeath]

Barring an infected thumbdrive, floppy, or disc. Try unhackme. http://www.greatis.com/unhackme/download.htm

Just don't ever use it on a server. Not a good thing.

[SirDice]

http://www.pandasecurity.com/homeuse...idvirus=142895

Try doing a full scan in safe mode..

[Cider]

Ok - thanks guys. I will try everything ...

[ArPaNET]

so he has a trojan...

First I would make sure that it isn't picking up something false, this particular trojan consumes internet bandwidth, won't allow registry editor to open, and displays false error msgs, etc... so check and see if these symptoms occur.

Next, do a full scan using a couple different scanners including the one that he/she is using currently (all in safe mode, like previously stated) then remove it from the _restore folder http://www.pandasecurity.com/homeuse...a=particulares

restart the machine and run the machine like normal... do the scan.

if the scanner reports a single file is corrupted and it is not a necessary file, delete it in safe mode...

Good Luck.

[Cope57]

Using a operating system that is not affected by viruses could be a option.

[ArPaNET]

lol... yeah, change to the infamous Vista, that particular trojan doesn't effect the Vista OS...

[nihil]

Hmmm, I think that ArPaNET has an interesting point:

First I would make sure that it isn't picking up something false, this particular trojan consumes internet bandwidth, won't allow registry editor to open, and displays false error msgs, etc... so check and see if these symptoms occur.

http://www.emsisoft.com/en/software/free/

Is a tool I would consider using. It scans for all sorts of malware and in particular it looks for "traces" as well as the full-blown article. Not all anti-malware get rid of these "traces" so you keep getting warned, but aren't really infected.

[Cider]

Is a tool I would consider using. It scans for all sorts of malware and in particular it looks for "traces" as well as the full-blown article. Not all anti-malware get rid of these "traces" so you keep getting warned, but aren't really infected.

I will check it out - thanks Nihil.

lol... yeah, change to the infamous Vista, that particular trojan doesn't effect the Vista OS..

So Vista has some really GOOD points.

Thanks for all the replies ...