System Volume Information

Discussion in 'Computer Support' started by Atreju, Sep 3, 2004.

  1. Atreju

    Atreju Guest

    Wondering...

    A client of mine had some serious virus infections. They have been
    healed and all is ok, except:
    There is an infected file within the "System Volume Information"
    folder, which appears to have been put there during a "Restore Point"
    creation.

    How can I either get in there and delete the file, or remove the
    restore point and delete the files through Windows?

    Is there a Restore Point management utility in Windows?

    XP Home Edition.

    TIA.


    ---Atreju---
     
    Atreju, Sep 3, 2004
    #1
    1. Advertisements

  2. Wondering...

    A client of mine had some serious virus infections. They have been
    healed and all is ok, except:
    There is an infected file within the "System Volume Information"
    folder, which appears to have been put there during a "Restore Point"
    creation.

    How can I either get in there and delete the file, or remove the
    restore point and delete the files through Windows?

    Is there a Restore Point management utility in Windows?

    XP Home Edition.

    TIA.


    ---Atreju---
    ---------
    Windows uses System Restore to restore files on your computer in case they
    become damaged. System Restore is enabled by default. Windows Me keeps the
    restore information in the _RESTORE folder. Windows XP stores this
    information in the System volume information folder. These folders are
    updated when the computer restarts. If the computer is infected with a
    virus, the virus could be backed up in these folders. You need to disable
    system restore, do the following :

    Disable System Restore and run another virus scan for Windows XP
    Follow the steps in each section in the order listed.

    To disable System Restore
    1.. Click Start > My Computer.
    2.. Click Properties.
    3.. On the System Restore tab, check Turn off System Restore.
    4.. Click Apply > click OK.
    5.. Restart the computer
    now run virus scan

    Duncan
     
    Duncan Newell, Sep 3, 2004
    #2
    1. Advertisements

  3. Atreju

    Atreju Guest

    Thanks. I figured that might be a way. I just was not sure if
    disabling it actually CLEARS the data from there.

    Considering how many things Windows likes to preserve (just in case
    you change your mind) it would not surprise me if it kept that
    information just in case you re-enable Restore. This way you will
    still have all your restore points.

    Kind of the way MS does most things.

    I will give it a try. Thanks.


    ---Atreju---
     
    Atreju, Sep 3, 2004
    #3
  4. Thanks. I figured that might be a way. I just was not sure if
    disabling it actually CLEARS the data from there.

    Considering how many things Windows likes to preserve (just in case
    you change your mind) it would not surprise me if it kept that
    information just in case you re-enable Restore. This way you will
    still have all your restore points.

    Kind of the way MS does most things.

    I will give it a try. Thanks.


    ---Atreju---

    If you got a virus in there then not much else you can do but to disable it
    and clean it, ive done it on a few peoples pc's never had any problems
    after.

    Duncan
     
    Duncan Newell, Sep 3, 2004
    #4
  5. Atreju

    Atreju Guest

    No better confirmation than experience.

    Thanks, I'll do that.


    ---Atreju---
     
    Atreju, Sep 3, 2004
    #5
  6. No better confirmation than experience.

    Thanks, I'll do that.


    ---Atreju---

    You can always do the reverse and re enable it again after your 100% sure
    the virus has gone, depends if you think you'll need it or not.

    Duncan
     
    Duncan Newell, Sep 3, 2004
    #6
  7. You have to start in safe mode, do a virus scan than reboot in regular mode
    and make sure system restore is running.
     
    gary niskanen, Sep 4, 2004
    #7
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.