System Volume Information folder

[Salih Icil]

Hi,
Recently, I have been having a problem with my System
Volume Information folder. Somehow a sub-seven trojan got
inside that folder. Whenever, trojan tries to access
outside, my AVG anti-virus program catches it. I am not
sure if it is blocking the trojan or not. I want to clean
the trojan but Windows XP doesn't let me to scan through
the folder. Is there a way to scan that folder? Name of
the trojan is _restore0435783...-.EXE and I know that it
is still there. I will be glad if I can get some help.
Thanks,
Salih Icil

[Roger Abell [MVP]]

In the default setting the Administrators group does not have=20
permissions within these folders. You can add a grant to the=20
Administrators group using the security dialog in the properties=20
of the folder (for Home or Pro in Simple sharing mode this=20
will need to be done in a safe mode boot).
Be careful as to what gets deleted/modified by your cleaner=20
tools, and it would probably be best to set the permissions=20
back by removing the Administrators grant when done.

--=20
Roger=20

"Salih Icil" > wrote in message =
...
> Hi,
> Recently, I have been having a problem with my System=20
> Volume Information folder. Somehow a sub-seven trojan got=20
> inside that folder. Whenever, trojan tries to access=20
> outside, my AVG anti-virus program catches it. I am not=20
> sure if it is blocking the trojan or not. I want to clean=20
> the trojan but Windows XP doesn't let me to scan through=20
> the folder. Is there a way to scan that folder? Name of=20
> the trojan is _restore0435783...-.EXE and I know that it=20
> is still there. I will be glad if I can get some help.
> Thanks,
> Salih Icil

[Jupiter Jones]

System Volume Information is the System Restore data.
Turn off/on System Restore to delete corrupted files:
Start/All Programs/Accessories/System Tools/System Restore.
Click System Restore Settings on left side.
Check "Turn off System Restore", click OK, follow prompts and reboot.
This deletes all Restore Points including corruption.
Then go back and turn on system Restore and create a Restore Point.
Otherwise:
http://www.microsoft.com/technet/itcommunity/newsgroups/faqsrwxp.asp

--
Jupiter Jones
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
Please respond to newsgroup only for everyone's benefit.


"Salih Icil" > wrote in message
...
> Hi,
> Recently, I have been having a problem with my System
> Volume Information folder. Somehow a sub-seven trojan got
> inside that folder. Whenever, trojan tries to access
> outside, my AVG anti-virus program catches it. I am not
> sure if it is blocking the trojan or not. I want to clean
> the trojan but Windows XP doesn't let me to scan through
> the folder. Is there a way to scan that folder? Name of
> the trojan is _restore0435783...-.EXE and I know that it
> is still there. I will be glad if I can get some help.
> Thanks,
> Salih Icil

[Roger Abell [MVP]]

"Jupiter Jones" > wrote in message =
...
> System Volume Information is the System Restore data.
> Turn off/on System Restore to delete corrupted files:
> Start/All Programs/Accessories/System Tools/System Restore.
> Click System Restore Settings on left side.
> Check "Turn off System Restore", click OK, follow prompts and reboot.
> This deletes all Restore Points including corruption.
> Then go back and turn on system Restore and create a Restore Point.
> Otherwise:
> http://www.microsoft.com/technet/itcommunity/newsgroups/faqsrwxp.asp
>=20
> --=20
> Jupiter Jones

But this assumes the file is one that system restore=20
manages rather than something else hidden in there.

--=20
Roger=20



> "Salih Icil" > wrote in message
> ...
> > Hi,
> > Recently, I have been having a problem with my System
> > Volume Information folder. Somehow a sub-seven trojan got
> > inside that folder. Whenever, trojan tries to access
> > outside, my AVG anti-virus program catches it. I am not
> > sure if it is blocking the trojan or not. I want to clean
> > the trojan but Windows XP doesn't let me to scan through
> > the folder. Is there a way to scan that folder? Name of
> > the trojan is _restore0435783...-.EXE and I know that it
> > is still there. I will be glad if I can get some help.
> > Thanks,
> > Salih Icil
>=20
>