Windows System Restore backs up virus also, Tips to Remove Bloodhound.Packed.Jmp trozan

Well, I never knew windows System Restore could be actually one of the biggest security risk for computers. While searching the solution to remove this trozan Bloodhound.Packed.Jmp, I encountered few lines in symantec security response which are quoted as follows

If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

To turn off the System restore

1. Right click My computer and click Properties , else follow the shortcut Windows Key + Pause .
2. Click on System Restore Tab and Check the Box “Turn off System Restore”.
3. Save

Virus and trojan are nothing new in today’s world. These spread basically with removable storage like pocket HDD , Flash disks etc. These trojan or virus at times act in a very weird manner. I wonder whether you encountered this Trojan named Bloodhound.Packed.Jmp which is highly undetectable by many antivirus program(including norton) since its a Trojan Horse(and not a virus), many antivirus just skip them. When my friends computer got affected with this Trojan, the moment you doubleclick C:\ Drive, following screen will appear :

I wonder if any of you have also got the same screen. Everytime you doubleclick C:\ drive, the above mentioned screen will appear, deleting the same 2t99k.dll file. Even after scanning the drive 5 to 10 times with Norton Antivirus, no detection took place. Finally, I remembered this article published by Arpit recently which proved to be of great help.

Since Norton doesn’t detect this, you have to look for alternatives. The best solution is AVG antivirus (free edition) which detects and heal this trojan . But again, this doesn’t solve the problem fully. Next thing which I encountered was when you double click the drive, the following dialog will open.

When such things happen, you can easily make out that an autorun.inf file is created in your drive. Anyway you can access the drive by typing the drive letter in the address bar, but deleting this file could be a hefty task for some people as the virus or trojan will keep resetting “Show hidden files and folders” option in “Folder Options” even if you try to enable.

So the only way to delete this file is to get to windows command prompt.

1. Go to Start Menu and Run ( shortcut : Window Key + R )
2. Type CMD or Command and press enter
3. Type cd\ (this will take you to the root directory)
4. Type the drive letter and press enter ( in our case its C: )
5. Type “Attrib -h -s autorun.inf” (without quotes) and press enter. This will make the file visible.
6. Type “Del autorun.inf” (without quotes) and press enter. If this doesn’t work, go to the drive and manually delete the file using Shift+delete key ( for permanent deletion)

Start the AVG scan again and check for any trace of any virus or Trozan. You can schedule it to run everyday around 8pm which is the time for Dinner for most of us and hence idle time on Computer.

Prevention is better than cure. Hence keep your system updated with latest antivirus definitions, security updates. Prevent installing any software which gives you a security warning unless you very sure about it. A little google about the products or browser plugins you are not sure off, can prevent you from lots of future troubles.

Liked the Post ?? Then why not Subscribe FREE, For latest Updates

Posts(RSS)

Use promo code "TECFREROCKS" or "THE50DREAM" for $50 off on any hosting plan on DREAMHOST