Spyware, viruses, &amp; security forum: How to remove &quot; System volume information&quot; virus completely?

it was not about "system restore" ?

by bspkumar - 6/5/08 9:51 AM

In Reply to: Re: Remove System Volume Information virus by Carol~

Some viruses are creating a folder ( system volume information)in every drive of my Pc.

ok. if u cant undertand that tell me how to remove viruses manually.

Was this reply helpful? (0) (0)

Staff pick

More Information Would Sure Help..

by Grif Thomas - 6/5/08 10:05 AM

In Reply to: it was not about "system restore" ? by bspkumar

Which operating system? A

And YES, this IS about System Restore.. The System Restore program creates a "system volume information" on every drive that it is monitoring. Any and all infected files will get recreated there until you make those system restore volumes go away. To eliminate viruses from those "system volume information" folders (System Restore volumes), assuming you're using Windows XP, then RIGHT click on "My Computer", choose "Properties", then click on the "System Restore tab, and place a CHECK mark in the box next to "Turn OFF System Restore in all drives", then click on "apply", then OK.. Once that's done, restart the computer into Safe Mode..

How To Start In 'Safe Mode'

Once in Safe Mode, check to see that all "system volume information" folders are gone.. If they are not, then they have been artificially created by something.. RIGHT click on that folder, chose "Delete" to make it go away.

Hope this helps.

Grif

Was this reply helpful? (0) (1)

Staff pick

System Volume Information folder cannot delete

by perekisi - 9/12/11 9:55 AM

In Reply to: More Information Would Sure Help.. by Grif Thomas

its saying ''cannot delete system volume information, access denied
Make sure the disk is not full or write protected.............

Was this reply helpful? (0) (0)

Staff pick

3 years old

by MarkFlax - 9/12/11 10:10 AM

In Reply to: System Volume Information folder cannot delete by perekisi

You are posting in a discussion that is now 3 years old You would do better to create your own discussion and re-post.

Be sure to explain why you want to try and delete this protected folder and give FULL Details of the problem.

Mark

Was this reply helpful? (0) (0)

Staff pick

Actually, it is the OS that creates the ...

by Edward ODaniel - 6/5/08 12:59 PM

In Reply to: it was not about "system restore" ? by bspkumar

System volume Information" directory on every NTFS volume on the computer. NT has done this since it was first released as NY 3.1. Since XP was released the directories are also created on FAT32 partitions where they contain only the Restore Points.

With the advent of XP (NT 5.1) and its "System Restore" the restore points are contained in the directory but before XP and its Restore Points" the directory on all NTFS volumes was used for and is still used for -

1. Distributed Link Tracking Service databases for repairing your shortcuts and linked documents. That is included in the "tracking.log" file in the directory along with other tracking events (nothing to do with the Event Viewer).

2. Content Indexing Service databases for fast file searches. This is also the source of the cidaemon.exe process: That is the content indexer itself, busy scanning your files and building its database so you can search for them quickly. the database index file in the directory is "Catalog.wci".

3. other purposes such as documenting mount points etc. but unnecessary to delve into ...

If you want to see what is in there for yourself here is a link that tells you how to access the contents but BE AWARE that the security permissions for the directory are defaulted to System only for a very good reason.
How to gain access to the System Volume Information folder
http://support.microsoft.com/kb/309531/

Suffice it to say that while your AV product of choice may indicate a virus in the System Volume Information directory the indication means only that it has found viral signatures in files in restore points in the system directory. NO VIRUS "created" the directories.

Was this reply helpful? (0) (0)

Staff pick