Trojan

  • Thread starter Thread starter Terry
  • Start date Start date
T

Terry

Every several minutes now I get the warning from my on board anti-virus
software that:

c:\System Volume Info\_restore(c1234348 -
F053-4F73-A94D-8F631C783DF2)-\RP196\A0011540.SCR is a Win32.Rawbot trojan.

I have checked the file location above and didn't find it.

I earlier tried running my anti virus suite to dislodge it.

Before that I tried running some on-line virus cleaners that had worked for
me before.

Nothing has worked so far. That's why I'm here now.

I'm running Win XP Home with plenty of HD space left. It's a 1.6 GB P4 with
512 MB Ram.

Does anyone have an idea as to how I can rid my machine of this annoying
message and the crud that started it?

Thanks in advance,

Terry
 
Hi Terry,

The virus is in a System Restore file. The solution is to delete the SR
files. You wouldn't want them back now anyways as that would reintroduce the
infacting file. There are three ways to easily remove restore points (you
cannot do this selectively).

1) Start/run cleanmgr.exe (disk cleanup), there is a "clean up" button on
the "more options" tab to remove all but the newest restore point.

2) Control Panel/System/System Restore tab, go to settings and reduce the
amount of space allotted to System Restore. This will remove older restore
points, how many depends on how much space you require for a point, and how
much space you leave.

3) Control Panel/System/System Restore tab, click the "turn off system
restore on all drives" box. This will eliminate all restore points. Once
reenabled, the system will begin creating new ones. You should reboot
inbetween doing this.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone
 
Back
Top