trojan attached to system volume info files

[Christel]

Hi all!

Just downloaded and registered, and I'm really starting with a bang!

The following virus "win32:Trojan-gen" has attached itself to various files in my c:\system volume info\ folder (for example it's attached to c:\system volume info\_restore{0824737A-688D-44D2-931F-5E29115C4F23}\984.exe and ....697.exe).

Do you know if I can simply delete these files? or should I have to reinstall winXP? is it part of the system restore function (in such case, I'll just delete them because I don't use that functionality).

I also have win32:Rbot-GX attached to c:\windows\system32\svdll.exe. What about that .dll? You think I can delete it?

I had to reinstall XP last week and haven't had the time to download SP2 yet. Maybe that's why I'm so vulnerable... If I have to reinstall again, I'd rather move to Linux!

Thanks a lot in advance
Christel
c.robert@inx.co.za

[galooma]

Hi and welcome ,
I suggest you go to settings and schedule a boot time scan and see if that solves your problem. System files usually  need this type of scan to be effective. If you get the option move any suspect files to chest firstly.
If the problems are only appearing in system restore files then you can de-activate Sys Restore then re-activate to flush out any bad files.

[DavidR]

Disable system restore, reboot, scan and if clear enable system restore. This will remove all restore points.

Win XP-ME - How to disable System Restore

[Christel]

Thanks for your help. Followed your advice.
I also installed Sygate for further protection.

Thanks again
Christel