rogue.syscleaner keeps trying to reninstall from system restore

[joejibster]

Hello,

I read something on this topic in the forums, but it didn't seem to address my direct issue. If I missed something, my apologies.

I was infected with this rogue.syscleaner in downloading software from Cnet (iWeb Computer Energy Saver...beware!). Malwarebytes effectively found it and quarantined it (excellent!) even before it unleashed its nasty cargo. Still, even after uninstalling the malicious iWeb software (had to force uninstall it using Revo), the rogue.syscleaner malware keeps trying to reinstall, seemingly from Windows restore point files. I run Windows XP Home Edition. Whether the paths of the latest two attempted reinstalls (now quarantined) will be helpful to you is unclear to me, but just in case, here they are:

C:\system volume information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1217\A0158164.exe

(reference # is 15739)

C:\system volume information\..........\RP1217\A0158197.vxd

(reference # is 51005)

Fortunately, Malwarebytes catches it and stops it, but it does not seem good to have to continue that forever. I'm way far from being an expert, but it seems I need to get rid of some (or all?) of my system restore points where this nasty thing may still be hiding. I don't want to do that unless it seems to be a logical next step. Actually I don't even know how to remove restore points. I've never once used a system restore point, so it is unlikely I would miss any of them.

Can anyone assist me with or advise me on this? Thanks so much in advance.

[prairie dog]

Hello, and welcome to Malwarebytes.org

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

[joejibster]

Sorry for the error and thank you very much for the information.

[prairie dog]

you're welcome