Accessing Directory - System Volume Information

[Strike]

My virus scanner is detecting a virus in a directory that I cannot access.
The directory is C:\System Volume Information. When I try to open it I get
this error.
"C:\System Volume Information is not accessible, access is denied." Is there
any way I can get in there and delete the virus file? Thanks,

 

[Malke]

My virus scanner is detecting a virus in a directory that I cannot
access. The directory is C:\System Volume Information. When I try to
open it I get this error.
"C:\System Volume Information is not accessible, access is denied." Is
there any way I can get in there and delete the virus file? Thanks,

These are the files for System Restore. If you know your computer is
completely clean, make a new System Restore point. Then delete all the
previous System Restore points with the Disk Cleanup More Options.

Malke

 

[Ken Blake, MVP]

My virus scanner is detecting a virus in a directory that I cannot
access. The directory is C:\System Volume Information. When I try to
open it I get this error.
"C:\System Volume Information is not accessible, access is denied."
Is there any way I can get in there and delete the virus file? Thanks,

You have a virus in one or more System Restore points. Presumably you had a
virus and removed it, but not before one or more Restore Points were
created.

First of all, recognize that a virus in a Restore Point is completely
innocuous and can not hurt you in any way *unless* you restore that Restore
Point. So no need to panic.

You have a couple of choices:

1. Turn off System Restore, and turn it back on. That will delete all
existing Restore Points, including those with the virus.

2. As new Restore Points are created each day, the oldest ones fall of the
end of the chain. So sometime within the next 90 days at most, the
virus-laden Restore Point(s) will disappear by themselves.

I would prefer choice number 1 to be safe, but number 2 is acceptable, *if*
you are very careful never to do a restore to a date prior to the one on
which you removed the virus.

 

[Bruce Chambers]

My virus scanner is detecting a virus in a directory that I cannot access.
The directory is C:\System Volume Information. When I try to open it I get
this error.
"C:\System Volume Information is not accessible, access is denied." Is there
any way I can get in there and delete the virus file? Thanks,

The System Volume Information is the hidden, protected operating
system folder in which WinXP's System Restore feature stores
information used to recover from errors. It's really not a good idea
for you, or an antivirus application, to directly access the contents
of that folder, unless you expect to have no future use for the
restore points, in which case it would be simpler just to turn off the
System Restore feature.

To clear viruses or other malware from the "System Volume
Information," simply turn off the System Restore feature (Start > All
Programs > Accessories > System Tools > System Restore, System Restore
Settings), reboot, then re-enable System Restore, and reboot one last
time. This will delete all of your Restore Points, including the
corrupted one(s), and allow you start with a clean slate.



--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -Benjamin Franklin

 

[Chelsea]

There is also the question how did the virus get into system restore in the
first place? If it is there it is possible if not likely to have been
present when the last system restore point was made. If your anti-virus
scanner has identified the virus check to see if there is a standalone
utility for removing it.

Chelsea

 

[Strike]

It does try to remove it but it keeps saying access denied so it won't let
my virus scanner in there either.

 

[Thota Umesh]

remember to disable the antivirus scanner before u disable system restore
and enable it again to clean it because many antivirus lock the file u are
accessing so the cleaning of the system restore wont go accordingly.