[Dshield] Virus in my restore point

Brad dshield-list at izallgood.net
Wed Dec 10 15:31:17 GMT 2003


I don't think there is a way to delete one rstore point, however if you
disable system restore, that should delete all the restore points. Only
other thing i can think of  is to restore to a point before you got the
virus, but not sure if that would work. The WinXP box we have at work has
System Restore disabled so i can't test to see if that would work

Brad


+----------------------------------------------------------------+
 Trust in the LORD with all your heart; do not depend on your own
 understanding. Seek his will in all you do, and he will direct 
 your paths. -- Proverbs 3:5-6 (NLT)		      		 
+----------------------------------------------------------------+
 I have wondered at times what the Ten Commandments would have 
 looked like if Moses had run them through the U.S. Congress.
 --President Ronald Reagan
+----------------------------------------------------------------+

On Wed, 10 Dec 2003, Keith Bergen wrote:

> Date: Wed, 10 Dec 2003 08:59:16 -0500
> From: Keith Bergen <keith at keithbergen.com>
> Reply-To: General DShield Discussion List <list at dshield.org>
> To: list at dshield.org
> Subject: [Dshield] Virus in my restore point
> 
> Hello All,
> 
> I have an annoying problem on my Win XP Pro box. One of the 
> files in one of the restore points is claimed to have a virus 
> in it. PC Cillin finds this virus each time, but cannot 
> remove it. Every day, PC Cillin reports that it is there, and 
> you have to hit okay.
> 
> The virus is Troj_Fyle.B, but never got installed on my 
> system. The executable, however, got into a restore point 
> before my scan could delete it. The Run key is not installed 
> in the registry either.
> 
> As you probably know, XP will automatically create these 
> restore points for you. I would like to find and remove that 
> restore point (thus removing the file). Does anybody know of 
> how to manage the restore points, and delete these restore 
> points?
> 
> Thanks,
> Keith.
> "Life is like an analogy"
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
> 




More information about the list mailing list