restore file deletion

Ralph · Joined: 19 Aug 2006 Posts: 3

I cleared the Haxdor trojan from my system a couple of weeks ago and
subsequently the scan ran clean. But now I have it in a restore file; it
could be that the old one was backed up or perhaps it is a new infection. The
message and location is as follows:
'Troj/Haxdor-Fam' detected in C:\System Volume
Information\_restore{8FD22EBF-9496-41BC-878F-BBD9792F9B3C}\RP953\A0133711.dll

I can't find the dll file or even the folder C:\System Volume Information\
in order to delete them. Is it possible to select a previous restore point
and delete it?

Ben · Joined: 22 Aug 2006 Posts: 1

Hi Ralph,

Virus scanner do not have the ability to remove virus infection from
restore points in the System Volume Information folder. Virus infection
found within restore points are dormant unless the system is restored
using an infected restore point. That's why it best to complete
infection removal before cleaning out infected restore points. To clear
out all existing restore point, turn System Restore off on all drives.
Then turn it back on after a reboot. I would suggest setting SR to only
monitor the partition Windows is installed on.

How to Disable and Enable System Restore:
http://bertk.mvps.org/html/disablesr.html

Here are some tips on adjusting disk space usage and keeping System
Restore healthy:
http://bertk.mvps.org/html/healthy.html