3 Trj , 1 Adw, 1 RAR

[lilmelody]

1]

C:\_RESTORE\ARCHIVE\FS1357.CAB\A0264142.CPY
Infection: Win32.Trojano-G[Trj]
Error Occured During File Deleting: Access is Denied.

2]


C:\_RESTORE\ARCHIVE\FS1728.CAB\A0301442.CPY
Infection: Win32.Swizzor-gen[Trj]
Error Occured During File Deleting: Access is Denied.

3]


C:\_RESTORE\ARCHIVE\FS1760.CAB\A0313504.CPY
Infection: Win32.Spyware-gen.[Trj]
Error Occured During File Deleting: Access is Denied.

4]



C:\_RESTORE\ARCHIVE\FS1728.CAB\A0301466.CPY
Infection: Win32.Adware-gen.[Adw]
Error Occured During File Deleting: Access is Denied.

5]


C:\_RESTORE\ARCHIVE\FS1357.CAB\A0264142.CPY\install.exe
Unable to Scan: Error 0x00001779
Error Occured During File Deleting: Error 0x00001779

----------------

Ive tried Safe mode, they wont delete. What should my next move be other than a complete system restore.

[DavidR]

The c:\_Restore folder is a part of the system restore function and as such is protected by windows, the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points. Once you have disabled system restore, reboot, scan your PC again and if clear enable system restore.

WinME - How to disable System Restore

[polonus]

Hi lilmelody,

By the way did you do a panda online scan before finding up these, there could be the problem of the findings: panda signatures that Avast ticks as malware, a known bug of panda's.
It is just a hunch on my side?

polonus

[DavidR]

For the future (not really applicable with _Restore issue you had, no choice in this case), Deletion isn't really a good first option (you have none left), you are better of sending the file to the avast Chest and then investigate. The adage 'first do no harm' is very apt, don't delete, send virus to the chest and investigate.

There is no rush to delete anything from the chest, they can't do any harm there. Anything that you send to the chest you should leave there for a week or two. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

[lilmelody]

The c:\_Restore folder is a part of the system restore function and as such is protected by windows, the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points. Once you have disabled system restore, reboot, scan your PC again and if clear enable system restore.
WinME - How to disable System Restore

I did that. No more virus's or spyware. However my computer still wont shut down :/ It goes to a black screen with a blinking white cursor. The power never cuts off i have to manually turn it off [via power supply]. I dont know whats doing this... hmmm but there are no more virus so yay!  tyvm David.

Hi lilmelody,

By the way did you do a panda online scan before finding up these, there could be the problem of the findings: panda signatures that Avast ticks as malware, a known bug of panda's.
It is just a hunch on my side?

polonus

No my bro was looking for a trainner. :/ He clicked on the exe before he even scanned me thats how this happened.

[polonus]

Hi lilmelody,

Download this to get passed your shutdown probs:
http://www.soft32.com/Download/free-trial/dfg_ShutDown_XP/4-7996-1.html

polonus