Member Avatar for gmg2u

My AV software detected a trojan in C:\System Volume Information\.restore{F2681A7D-91E5-401A-AC8B-01535799DC0}1RP220\A0059613.EXE but access to this file is denied to me & my AV software. Is there any way to fix it? I can't seem to find the name of it now.

  • 2 Contributors
  • 3 Replies
  • 89 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Good call by — a detection inside the System Volume Information area is exactly why your AV could see the file but not remove it. That folder holds protected restore-point snapshots and is owned by the SYSTEM account, so normal user processes (and some scanner contexts) can be blocked from deleting items there. Removing the restore-points that contain the infected copy is the usual, correct remedy.

Follow-up steps to make sure the machine is really clean: record the AV detection details (name, timestamp, quarantine log entry) so you can research the threat. Update your AV and run a full system scan. Use a second-opinion scanner or boot a trusted rescue CD/USB to scan the disk offline — scanning outside the running OS finds resident or locked malware that an in-OS scan can miss. Only re-enable System Restore and create a new restore point after the system is verified clean. Back up important data before removing snapshots, because deleting restore points removes roll-back options.

Advanced options for inspection or manual removal: run a process with SYSTEM privileges (for example, via a trusted Sysinternals utility) or mount the drive on another clean machine or rescue environment to examine or delete the file. Do not restore from old restore points until you are sure they are clean. For , those extra verification steps will reduce the chance of a hidden reinfection.

Recommended Answers

All 3 Replies

Member Avatar for crunchie

Assuming you have XP?

Clear your restore points now like so..
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

All previous restore points will be lost.

Member Avatar for gmg2u

THANX CRUNCHIE, I'm kinda new 2 the game & I'm tryin' 2 learn somethin' new every day. Ya just taught me somethin else I didn't know. Hopefully I'll remember it. I'm followin all the links ya recomended right now.

Member Avatar for crunchie

You're welcome :).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.