Win 32 Poza.exe worm

[Jane]

phone =
type = support
os = XP Home
custnum = 41851
vetver = 10.6
email = (e-mail address removed)
name = Jane
question = A persistent screen message indicates that I
have the following worm
C:\System Volume Information\_restore{af1dc2f4-a4oa-495f-
b864-e29ff5b9faa3}\rp125\a0021275.exe which is a Win32
poza worm.


I cannot access system volume information even after
enabling show hidden and system files. The message
appears consistently.

Please advise how to remove it.

company =

 

[Carey Frisch [MVP]]

You'll need to turn-off System Restore, reboot, then turn it back on.

How to Turn On and Turn Off System Restore in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310405&Product=winxp

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

---------------------------------------------------------------------------------


| phone =
| type = support
| os = XP Home
| custnum = 41851
| vetver = 10.6
| email = (e-mail address removed)
| name = Jane
| question = A persistent screen message indicates that I
| have the following worm
| C:\System Volume Information\_restore{af1dc2f4-a4oa-495f-
| b864-e29ff5b9faa3}\rp125\a0021275.exe which is a Win32
| poza worm.
|
|
| I cannot access system volume information even after
| enabling show hidden and system files. The message
| appears consistently.
|
| Please advise how to remove it.
|
| company =
|

 

[Haggis]

you need to turn off the system restore function...repair file..then set
restore on again (you'll have to reboot between)

 

[Haggis]

<snip>

from a Bruce Chambers post:

How to Gain Access to the System Volume Information Folder
http://support.microsoft.com/default.aspx?scid=kb;EN-US;309531