.cpy files infected with virus in _RESTORE folder 1

[grez]

Hi! Here is my situation:
*Windows ME operating sytem
*"*.cpy" files (5 total) infected with viruses

*Virus scans (first AVG 6.0 then EZ Trust) can not delete or rename the files. These files are in the sysetm restore folder.

*Can not get to the certain files via windows explorer

*Tried to get to them in DOS mode, and I can get to the folder and see files, however, the exact files I'm looking for (such as A0127198.cpy) are not there.

*Took system restore settings all the way down to 200MB hoping this will eventually overwrite the files (is this correct? Not sure here).

Now, I did turn the restore setting down first, then went to DOS mode and could not find them. Maybe it took them out since I tuned down the space. I am performing a system scan now. If those 5 files are still there and infected, any ideas on how to delete them? And...would it be safe if we just didn't use system restore if I can't delete them? Or am I looking at a reformat?

Thanks in advance!!

 

[kippy13]

Hi,
If you try switching off system restore temporarily, reboot, rerun the scan, clean the files, reboot and turn sys restore back on again alll should be well.

***************************************
Looking for the best answers:
faq222-2244
Keeping your system clear of malware:
faq608-4650
***********************************
Dont forget to post back with the eventual resolution.
***************************************

 

[grez]

Hey kippy13! Worked perfect! Just so I can learn this one, I suppose since system restore was enabled, it will sort of "lock" those cpy files so there are no modifications to it? Thanks a million!!

grez

 

[kippy13]

Yes thats why, the files were in use or locked by the system resource process.
Glad to hear it worked.

***************************************
Looking for the best answers:
faq222-2244
Keeping your system clear of malware:
faq608-4650
***********************************
Dont forget to post back with the eventual resolution.
***************************************