Forum Home
Press F1
 
Thread ID: 96664 2009-01-18 20:05:00 Running Hi-Jack This Digby (677) Press F1
Post ID Timestamp Content User
740085 2009-01-18 20:05:00 Hi Guys

I often see Speedy suggest that people turn System restore off when they run Hi-Jack This.

Whilst I do not doubt his wisdom, could someone please explain why the need to do this ?

And then the suggested order of doing things. 		Digby (677)
740086 2009-01-18 20:06:00 Hi Guys

I often see Speedy suggest that people turn System restore off when they run Hi-Jack This.

Whilst I do not doubt his wisdom, could someone please explain why the need to do this ?

And then the suggested order of doing things.

Viruses/spyware can hide in the system restore cache, and re-appear when the PC is rebooted. Disabling system restore causes the cache to be deleted on reboot. Besides, if you have an infected machine you hardly want the option to be able to restore back to it. :p 		wratterus (105)
740087 2009-01-18 20:49:00 Very good :p

Actually I did it to someones laptop last night. Somehow, they had picked up Internet Antivirus Pro (rogue software). Its a bugger of a thing to get rid of.

I managed to get Malwarebytes on it with one of the USB flash drives here.

Luckily, the other person here regged it for me. Because this thing is hard to kill, it doesnt appear in add/remove programs.

If you untick its entry in msconfig, ((by the looks of it, it also puts a winlogin entry in startup), then click on OK, it brings up some kind of error.

You can end its process in task manager, but it restarts itself if you do. Malwarebytes did the trick tho, with its protection option (when you reg it). It detected it, and then terminated it.

Then I did a scan, and it got rid of it.

System restore is handy, if youre infected with something like a trojan / worm ...thats where most of them hide, and reactivate, if you dont turn it off. 		Speedy Gonzales (78)
740088 2009-01-18 20:56:00 I removed the 2 entries it put in startup, with ccleaner.

Since removing them from msconfig didnt work 		Speedy Gonzales (78)
740089 2009-01-18 22:09:00 :lol: :p wratterus (105)
1