We help IT Professionals succeed at work.

XP system volume information, cannot delete restore points

AE_JB
AE_JB asked
on
AVG resident shield keeps popping up with possible infection in the files within system volume information folder.  I turned off system restore and restarted.  My understanding is that this will delete the restore points.  I then turned system restore back on and created a new restore point.  The problem persists with possible infection popups.  I was going to manually delete the files but the folder is locked.  
Comment
Watch Question

Use Start->Programs->Accessories->System Tools->Disk Cleanup
Select C: Drive
Once it has scanned your files select the "More Options" tab.
On this tab you should find a section for System Restore.
If you press the Clean Up button for that section, Windows deletes all restore points except for the most recent one.

More help on Windoze Restore here:
http://www.bleepingcomputer.com/tutorials/windows-xp-system-restore-guide/#delete
If the restore points were deleted, and you then created a new restore point, that would indicate that there is an underlying (possible) infection somewhere.

Turn off System Restore again to clear the restore points

Right-click the System Volume Information folder in the root folder.
Click [Properties] and select the [Security] tab. Click [Add]
Enter the name of the user you are allowing access to the folder. Assign full rights
Click [OK], and then click [OK].
Double-click the System Volume Information folder to open.
Verify that all restore points are gone

Turn it back on. Create a new restore point. Still the same?
CERTIFIED EXPERT
Author of the Year 2011
Top Expert 2006
Commented:
AVG has consistently had problems with 'false positives' and faulty updates that adversely impact systems. I switched from AVG to MSE about two years ago because of this.

Have you scanned your computer with any other scanners? If so, what are the results?

Two of the top line scanners are Malwarebytes and ComboFix. Please follow the steps list in the EE Article listed below.

If none of the scanners listed find malware, then dump AVG and get something that still works.

If any of them do find malware, attach the logs here so that we can evaluate them.

Stop-the-Bleeding-First-Aid-for-Malware

Thomas Zucker-ScharffSolution Guide
CERTIFIED EXPERT
Commented:
You did it correctly, although you should be sure that system restore is not enabled separately on different disks - if it is you need to disable it on all disks and then restart and turn it back on.  Note that contaminated files in the system restore points are BENIGN.  They will not do anything unless you either use that restore point or use last known good.  See my article on disabling System Restore in XP:

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/A_2209-Removing-protected-System-Restore-files-if-they-have-been-infected.html

Note the link to another article in the first paragraph (by rpggamergirl) it is worth the read.

Author

Commented:
It was most likely a false posative, but it needed to be removed.  I ended up going in to the advanced settings of system restore and clicking the option to delete all but the most recient restore point.  This solved the problem.

Explore More ContentExplore courses, solutions, and other research materials related to this topic.