"System Volume Information"?

choice

I have a trojan virus in a file on my c drive named "system volume information". However, when i ran AVG it told me that everything was ok. But i keep getting messages telling me that i have a trojan located in this file!
I tried to search for the file but i cant find it. i went to www.trojanscan.com and they ran a scan on my c drive. They reported no viruses on my computer but they also told me that they couldnt get into the system volume information file on my computer (access denied).
How do i locate this file(system volume information) myself and kill the bugger?
Im using WindowsXP

seamus

This is a folder where windows stores files that would be needed for a System Restore. As such, it is protected by the OS when System Restore is on.

Turn off System Restore, reboot, scan & purge, and re-enable System Restore.

choice

Where can i find system restore?
Thanks

Martyr

System Volume Information has an ACE (Access Control Entry)
which disallows anyone from accessing it, including SYSTEM.
If you think there is a trojan or virus in that folder, you
could check the contents..through the security properties.
Change the permissions, add READ access for ADMINISTRATOR

I've not heard of malware yet that utilises security api,
but you may have something that does.

It could be nothing at all.

seamus

Originally posted by Average Joe
System Volume Information has an ACE (Access Control Entry)
which disallows anyone from accessing it, including SYSTEM.
If you think there is a trojan or virus in that folder, you
could check the contents..through the security properties.
Change the permissions, add READ access for ADMINISTRATOR

I've not heard of malware yet that utilises security api,
but you may have something that does.

It could be nothing at all.

A lot of viruses get backed up in the SVI folder unwittingly by Windows, which is why it needs to be disabled, so that AntiVirus can have read/delete access to the folder.

Dman_15

system resore.

Rightclick my computer --->properties---> system restore

choice

Eh.......It didnt work. I went to the system restore and did everything you said but nothing changed. I cant find the file manually or when i use the search. I used trojan scan wgain and it told me that it didnt have access to this file. Any ideas?

iano

If you really want to get into the folder, follow the instructions in How to Gain Access to the System Volume Information Folder

As others have stated, if you believe that you have something nasty in the restore folder, then:
1. disable system restore (instructions How to Turn On and Turn Off System Restore in Windows XP )
2. Run your anti-virus, anti-span, anti-trojan, whatever ... on ALL of your disk
3. re-enable system restore

choice

I got the folder up so that i can see it! But when i click on it it tells me that access is denied! I can access all the other folders that have appeared but not the system volume information. I cant even scan for viruses because i cant access it! Should i be able to access it?

seamus

Is this ME or XP?

Are you logged in as Administrator?

If you disable System Restore then reboot, you should have no problem accessing it.

choice

hEY, i THINK IT WORKED. wHEN I REBOOTED MY SYSTEM A MESSAGE POPPED UP TELLING ME THAT THE COMPUTER WAS UNABLE TO COPY SOME FILES BECAUSE THEY HAD A VIRUS IN THEM. I THEN SCANNED THE FOLDER AND I GOT RID OF THE VIRUS! IT WASNT THE SAME FOLDER AS VOLUME SYSTEM INFORMATION BUT I HAVENT HAD ANY WARNING MESSAGES TELLING ME THAT I HAD A VIRUS ON THE COMPUTER IN A WHILE SO I THINK ITS GONE!
THANKS EVERYONE FOR YOUR HELP