Boot up scan viruses - delete?

[TimN]

I have run a normal scan with no problems. When I run a boot up scan I get a number of potential viruses being detected.  They are all in C:\System Volume Information\_restore{854b4 etc etc etc.  Some of these are identified as the Eicar test virus that I had been using to test my new install of avast! and the others I suspect are to do with Panda Active Scan files which I have set to be excluded in my normal scan.
Is it safe to delete these "restore" items or will it cause problems when I finally boot up?
I'm running Windows XP Home and I think I once heard that restore had to be turned off before deleting viruses.....not sure though. Any help would be much appreciated

[Vlk]

1. You can generally delete all these files.
2. If you delete them during the boot-time scan, it will work (but not when doing normal scanning under Windows - the whole 'System Volume Information' directory is then "locked").
3. It's generally much easier (if you don't intend to use the System Restore feature) to disable it, and then re-enable it (you can do this immediately) - by disabling it, you tell Windows to discard the whole contents of the directory. This has been discussed on this forum many times (mostly in the 'Worms & Viruses' section).

Hope this helps,
Vlk

[BanziBaby]

Can i ask a question Vlk, where is the option to do a boot up scan, does this means before windows has loaded or are U talkin about the memory scan??

Thanks

BaNzI

[Vlk]

Before Windows loads.
It's available only in Windows NT/2K/XP/2K3.
In the avast user interface (e.g. the blue panel), bring up the context menu and select Schedule Boot-Time Scan. Pretty easy, isn't it?

Vlk

[BanziBaby]

Cheers Vlk

Unfortunatly im runnin Win98se, no wonder i couldn't find the option

Thanks for the prompt advice

BaNzI

[techie101]

Tim,

Your just full of questions aren't you! hahaha

This may help you:
Accessing System Restore You must be a member of the computer administrator group on your computer to access the System Restore Wizard or change System Restore settings.

There are three methods that you can use to access System Restore functionality.

You can access the System Restore Wizard through the Start menu. To access the System Restore Wizard, click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.
You can access System Restore through Control Panel. To open the System Restore Wizard, click Start, click Control Panel, and then click Performance and Maintenance. Under See Also, click System Restore.
You can access System Restore through Help and Support Center. To access the System Restore Wizard, click Start, and then click Help and Support. Click Performance and Maintenance, click Using System Restore to undo changes, and then click Run the System Restore Wizard.
For more information about System Restore, see System Restore overview.


Until your next question...