Results 1 to 5 of 5
  1. #1
    5 Star Lounger
    Join Date
    Feb 2001
    Location
    Dallas plus 20 miles or so, Texas, USA
    Posts
    876
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Klez and System Restore

    We have one WinME computer belonging to the office manager which has the Klez virus. This person is telling me that the Symantec Klez fix is telling her to disable the system restore. She has enabled sys restore, disabled sys restore, enabled it again, rebooted into safe mode, etc and the fix still thinks that the restore function is on. My guess is that whatever exe actually sets the flag in the registry for system restore has been deleted(?), and that the function appears to be there in name only.

    She apparently got it about two weeks ago, primarily uses AOL and Netscape, and fortunately there were only six addresses in the OE address book. The fix says that it has deleted 5 files, fixed 11 others, and there are 73 more remaining... <img src=/S/drop.gif border=0 alt=drop width=23 height=23>

    Any ideas on how to get the virus off the machine? Is there a way to edit the registry to manually set the flag for system restore to off so that the Klex fix will take?

  2. #2
    5 Star Lounger
    Join Date
    Jan 2001
    Location
    Cumberland, Maryland, USA
    Posts
    880
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Klez and System Restore


  3. #3
    5 Star Lounger
    Join Date
    Feb 2001
    Location
    Dallas plus 20 miles or so, Texas, USA
    Posts
    876
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Klez and System Restore

    That is the tool we used, however it still thinks that the System Restore is set to on, regardless of whether it is checked in the interface or not.

  4. #4
    5 Star Lounger
    Join Date
    Jan 2001
    Location
    Cumberland, Maryland, USA
    Posts
    880
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Klez and System Restore

    Sorry, I should have read your post more carefully. However, you might try this link. It has some registry tweaks to disable System Restore:
    http://www.arstechnica.com/ask-ars/

  5. #5
    5 Star Lounger
    Join Date
    Feb 2001
    Location
    Dallas plus 20 miles or so, Texas, USA
    Posts
    876
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Klez and System Restore

    Thanks, that was the info I was looking for...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •