Restore Settings Question

[Tom]

I click on programs-accessories-system tools--restore,
and then click on System Restore Settings. I get a pop-
up from McAfee VirusScan telling me a suspicious script
has been detected---The file C:\WINDOWS\SYSTEM32
\Restore\RSTRUI.EXE contains suspicious script activity
and has been stopped. I am given options, Stop This
Script, Allow Entire Script This Time, Find Out More
Info, and Continue What I Was Doing. Clicking on "Find
Out More Info", basically tells me the same thing and
recommends the STOP option, which I do. Can anyone shed
any light on what it all means? Thanks in advance.

 

[Doug Knox MS-MVP]

Choose the Allow the entire script, this time option. Many components of Windows XP use HTA files (HyperText Applications) rather than executables. HTA files can modify the registry and access the file system. This is why McAfee is flagging it as potentially malicious. In this case RSTRUI.EXE is calling an HTA file to do its tasks.