locked
killav.p ??? can't get rid of it RRS feed

  • Question

  • hi

     

    onecare detects killav.p ..so i deleted it...but then in a few hrs...i get notified that it is back???  any help -- anyone??

     

    thanks

    bcy1

    Thursday, February 7, 2008 3:26 PM

Answers

  • It may be located in your System Restore points if it returns every few hours. Open OneCare and click on Change Settings. Go to the logging tab and create a support log. In the report that opens in your browser, scroll to the Virus and Spyware section to view where the infection was found. If it is in the System Restore points, you can turn off System Restore and turn it back on again (Control Panel/System/Advanced) to delete all saved restore points and start fresh. Note that you will not be able to restore your PC to an earlier time if you do this.

    If you need help, please contact support -

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

     

    -steve

    Thursday, February 7, 2008 5:17 PM
    Moderator

All replies

  • It may be located in your System Restore points if it returns every few hours. Open OneCare and click on Change Settings. Go to the logging tab and create a support log. In the report that opens in your browser, scroll to the Virus and Spyware section to view where the infection was found. If it is in the System Restore points, you can turn off System Restore and turn it back on again (Control Panel/System/Advanced) to delete all saved restore points and start fresh. Note that you will not be able to restore your PC to an earlier time if you do this.

    If you need help, please contact support -

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

     

    -steve

    Thursday, February 7, 2008 5:17 PM
    Moderator
  • I've been having the same problem.  Your fix seems to have cured it!  Thanks.

     

    Thursday, February 7, 2008 7:24 PM
  • Great, thanks for letting us know.

    -steve

     

    Friday, February 8, 2008 2:02 AM
    Moderator
  • steve:

     

    thanks for the response. the malware is actually on my kid's computer (and she is not home) so i will check out your suggestions when i get my hands on the machine.  BUT, can you tell me where the restore file is??? and how i can delete it if the problem is there??? ALSO, what will it look like in the onecare support log, if it is in the restore file??? what will be the location on the hard drive??

     

    thanks

    bcy1

     

    Friday, February 8, 2008 3:16 PM
  •  BCY1 wrote:

    steve:

     

    thanks for the response. the malware is actually on my kid's computer (and she is not home) so i will check out your suggestions when i get my hands on the machine.  BUT, can you tell me where the restore file is??? and how i can delete it if the problem is there??? ALSO, what will it look like in the onecare support log, if it is in the restore file??? what will be the location on the hard drive??

     

    thanks

    bcy1

     

    The naming of the restore points will appear in the log in OneCare. I don't recall the specific naming convention, but it will show the path as C:\System Volume Information\_Restore{GUID} (GUID is a really long set of letters and numbers)

     

    This article explains how to wipe them out - http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

    -steve

    Friday, February 8, 2008 7:05 PM
    Moderator
  • Help!

    Actually, I have 'Killav.FB' yet have the same problem of reoccuring appearences and removeal. I don't see it as originaing in a backup/restore file. I suspect there is a registry entry that reinstalls Killav.FB after each boot of the pc. Doesn't  Windows OneCare have any way of locating and removing whatever it is that is reinstalling it? I tried Removal and Quarantine options and still no luck.

     Regards,

    Carl

    ===== OneCare Log extract ========

    Windows Live OneCare found potentially harmful or unwanted software on your computer
    Threat Name: Trojan:Win32/Killav.FB
    Detection Date and Time: 4/12/2008 7:01 AM
    File Name: C:\Documents and Settings\Carl Acebal\Local Settings\Temp\D.tmp
    Threat Severity: Severe
    Threat Category: Trojan
    Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS)
    Threat Status: Quarantined

    Saturday, April 12, 2008 12:57 PM
  • cace2002,

    Follow the instructions in this post, http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=662566&SiteID=2, to report a virus that is not cleaned by OneCare and to get help in removal.

    -steve

    Sunday, April 13, 2008 1:48 AM
    Moderator