system restore ?

[darrenrd]

is there a way to locate the actual restore file that windows creates, my reason for asking is that avg anti-virus detected a keeper(rest of name missed) virus in system restore but i was away from my pc when i returned the pop-up was there but when i went to click to remove i was too late and the pop-up went away, i then ran a scan w/restore on and then off and avg did not detect the keeper again. i thought that if i could gain access to the actual restore file(s) and get rid of them that i could be rid of this keeper thing..or maybe a better route that i might be missing??? thanks for anything

 

[cdogg]

The better route is to disable system restore temporarily, which will delete your backups. Reboot and rescan for infections. Then re-enable system restore.

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Albert Einstein
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[darrenrd]

i will give that way a go cdogg thank you very much for the help.

 

[bcastner]

Cleaning the restore archive can be done as cdogg notes by disabling system restore. It is also an option under the Disk Cleanup tool.

But as a direct answer to your question: yes, you can access the stores, but unforutnately, no, that would not help you to remove a single element that contained malware. Deleting the stores is the only sane thing to do.

To gain access to the System Volume Information folder:

http://support.microsoft.com/defaul...port/kb/articles/q309/5/31.asp&NoWebContent=1

But there is nothing there for mere mortals to play with.

 

[darrenrd]

thanks to you too becaster on the info.

 

[linney]

i then ran a scan w/restore on and then off and avg did not detect the keeper again"

Sounds like you may have already turned System Restore Off and On, thereby removing the old Restore Points.

Q310405 - How to Turn On and Turn Off System Restore in Windows XP

http://support.microsoft.com/support/kb/articles/q310/4/05.asp

As to what AVG found and did with this file, that information should be available in the AVG logs of past scans.