Re: _restore

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 07/23/04


Date: Fri, 23 Jul 2004 16:34:44 -0400

The following are the instructions....

Please read the following URL:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

The objective:
------------------
- Turn off the System Restore function
- Reboot the PC
- Using your AV package, perform a full scan of all files on the platform and clean/delete
       infectors found
- Turn on the System Restore function, and re-apply any System Restore preferences,
       e.g. HD space to use
- Reboot the PC
- Create a new System Restore point.

If you have problems, it can be done manually....

Use the WinME floppy boot disk and boot from drive "A:"
When you get to a DOS prompt enter the following command

attrib -r -s -h c:\_RESTORE
rename c:\_RESTORE c:\RESTORE.old

Reboot the PC.

In Windows delete the folder; c:\RESTORE.old

Dave

"madmax" <maxpro4u@nomail.afraid.org> wrote in message
news:My%Lc.6931$sx2.1159@fe2.columbus.rr.com...
| richard morin wrote:
| > _restore is in my c:\ as hidden files... and is growing quickly each time
| > I'm on internet.... why?
| >
| >
| From your other posts I see you are infected.Run some online scanners
| and write down results. If the offending files are in "restore",turn it
| off and reboot.See my site for links and other tips.
| -max
|
| --
| To help you stay safe see: http://www.geocities.com/maxpro4u/madmax.html
| This message is virus free as far as I can tell.
| Change nomail.afraid.org to neo.rr.com so you can reply
| (nomail.afraid.org has been set up specifically for
| use in Usenet. Feel free to use it yourself.)



Relevant Pages

  • Re: fs66.cab/generic dialer
    ... Turn off the System Restore function ... Reboot the PC ... The Cabs are archived files and I ...
    (microsoft.public.security.virus)
  • Re: Viruses in C:RestoreTemp*.cpy files that are write protected
    ... Turn off the System Restore function ... Reboot the PC ... | My McAfee antivirus software has isolated multiple viruses ...
    (microsoft.public.security.virus)
  • Re: Invalid Procedure Call or Argument
    ... annoyances), cleaned infection (with System Restore turned off?), still had ... Boot into Safe Mode and use MS Config to go into Diagnostic Mode. ... note what Services and Startups AVG ... Reboot normally, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: RPC shutdown (not msblast)
    ... Reboot the infected PC into Safe Mode ... Re-enable System Restore and re-apply any System Restore preferences, ... | Her machine then went into a reboot cycle caused by the RPC process | termianting. ...
    (microsoft.public.windowsxp.general)
  • Re: Atheists: Americas most distrusted minority
    ... number of machines and I can't remember the last time I had to reboot (other ... another machine because a known bug in one of the updates meant that I ... move it back and do a system restore. ... didn't occur to them that eSATA drives were, well, e, and so you can't ...
    (rec.arts.sf.tv.babylon5.moderated)