System Volume Information

[Ronald E. Foltz]

PCcillin found a virus in C:\system volume
information\_restore........(that's all that shows)
how can i find this file or folder????i ran a search with no
results...........thanks

 

[David H. Lipman]

1) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Reboot your PC into Safe Mode
3) Using your AV software, perform a Full Scan of your platform and clean/delete any
infectors found
4) Restart your PC and perform a "final" Full Scan of your platform
5) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 200 ~ 400MB),
6) Reboot your PC.
6) Create a new Restore point


* * * Please report back your results * * *

Dave




| PCcillin found a virus in C:\system volume
| information\_restore........(that's all that shows)
| how can i find this file or folder????i ran a search with no
| results...........thanks
|
|

 

[myha]

you have to disable hide protected operating system files to view this
files....
Win explorer -> tools->folder options->view tab

 

[Jupiter Jones [MVP]]

Ronald;
Turn off/on System Restore to delete corrupted files:
Start/All Programs/Accessories/System Tools/System Restore.
Click System Restore Settings on left side.
Check "Turn off System Restore", click OK, follow prompts and reboot.
This deletes ALL Restore Points including corruption.
Then go back and turn on system Restore and create a Restore Point.

 

[Guest]

donot worry about that.
that means there was a virus..and it is stored in ur restore history.
if everything is running okay on ur system.
first turn off the system restore...and click ok...
then turn on the system restore..click ok..and restart the system...
if the messge doesnt go..
then , restart system between turning off and on the system restore.
Take care
yash

 

[David H. Lipman]

No -- This is the System Restore cache.
You either wait until the file caches out or you dump the System Restore cache and then
re-enable System Restore.

Dave



| you have to disable hide protected operating system files to view this
| files....
| Win explorer -> tools->folder options->view tab
|
| | > PCcillin found a virus in C:\system volume
| > information\_restore........(that's all that shows)
| > how can i find this file or folder????i ran a search with no
| > results...........thanks
| >
| >
|
|

 

[Bruce Chambers]

PCcillin found a virus in C:\system volume
information\_restore........(that's all that shows)
how can i find this file or folder????i ran a search with no
results...........thanks

The System Volume Information is the hidden, protected operating
system folder in which WinXP's System Restore feature stores
information used to recover from errors. It's really not a good idea
for you, or an antivirus application, to directly access the contents
of that folder, unless you expect to have no future use for the
restore points, in which case it would be simpler just to turn off the
System Restore feature.

To clear viruses or other malware from the "System Volume
Information," simply turn off the System Restore feature (Start > All
Programs > Accessories > System Tools > System Restore, System Restore
Settings), reboot, then re-enable System Restore, and reboot one last
time. This will delete all of your Restore Points, including the
corrupted one(s), and allow you start with a clean slate.


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

 

[PA Bear]

Or, so you're never without a Restore Point:

1. Create a new Restore Point (Start>Programs>Accessories>System
Tools>System Restore); then

2. Delete all but the most recent Restore Point
(Start>Programs>Accessories>System Tools>Disk Cleanup>More options>System
Restore>Clean up
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Posting and You
http://www.trials-shack.co.uk/posting.html

 

[Kelly]

Hi Ronald,

To show System Volume Information

Go to: Windows Explorer/Tools/Folder Options/View/Show Hidden File and
Uncheck Hide Protected Operating System Files.

Then go to: C:\System Volume Information

How to Gain Access to the System Volume Information Folder
http://support.microsoft.com/default.aspx?scid=kb;EN-US;309531

But the way to fix your problem is to create a restore point and then use
the Disk Cleanup to delete all but the last restore point. The virus will be
gone, if your virus checker already deleted it from your system.

Right click your Root drive/Properties/Disk Cleanup ... let it run. Then
click on More Options/System Restore/Clean up.

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Alex Nichol]

PCcillin found a virus in C:\system volume
information\_restore........(that's all that shows)

That contains the restore points, and the virus got backed up in one of
them

It can do no harm there, unless you restore to the point concerned.
So wait for a new clean one to have been made (or go to Start - All
Programs - Accessories - System Tools - System Restore and create one
manually) then Start - All Programs - Accessories - System Tools - Disk
Cleanup and on the More Options use the button to delete all but the
more recent point - the virus will go along with the point it is in