Results 1 to 10 of 10
  1. #1
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Spybot's not-so-bright idea

    Following the discovery of a virus on XP, and the user's decision to Fix the Problems, Spybot S&D will by default create a System Restore Point, thus neatly moving the offending EXE, DLL or whatever into the System Restore area, where it is picked up by the usual antivirus scan of the hard disk...

    Can someone remind me how to delete an individual System Restore Point, or a file within a specific one, preferably remotely? (I can link to the offending PC's C: drive, but am getting the usual "You do not have permission to access this directory"-type messages).

    Thanks!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  2. Subscribe to our Windows Secrets Newsletter - It's Free!

    Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

    Excel 2013: The Missing Manual

    + Get this BONUS — free!

    Get the most of Excel! Learn about new features, basics of creating a new spreadsheet and using the infamous Ribbon in the first chapter of Excel 2013: The Missing Manual - Subscribe and download Chapter 1 for free!

  3. #2
    3 Star Lounger
    Join Date
    Jun 2001
    Location
    Lewiston, Maine, USA
    Posts
    293
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Spybot's not-so-bright idea

    Hi John,
    Not sure about XP, but the standard cure on my WinME is:
    Stop System Restore
    Reboot
    Start System Restore
    Reboot
    What this does is it cleans out all your exising restore points and starts system restore fresh.
    HTH
    Bob

  4. #3
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Spybot's not-so-bright idea

    Thanks for the suggestion, but that's a bit drastic, and none too easy to do remotely!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  5. #4
    Bronze Lounger
    Join Date
    Feb 2001
    Posts
    1,424
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Spybot's not-so-bright idea

    you probably know all of this, but this is what I found searching:

  6. #5
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    20,418
    Thanks
    1
    Thanked 597 Times in 534 Posts

    Re: Spybot's not-so-bright idea

    John,

    Have you looked at Spybot's Settings panel? Creating a Restore Point is configurable.

    Joe

  7. #6
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Spybot's not-so-bright idea

    Thank you, Ms Skitterbug!

    I was using SMS 1.2 on NT4 to Remote Control this XP PC for someone who had (also) signed on as a Domain Administrator, and had done all you suggest (bar the last two points, of course!) -- but the System Volume Information directory came up with the message described earlier. (I didn't really want to put all that, but you've twisted my arm!). I will have to go 120 miles to beat this unfortunate about the head for getting the Company Record of 139 adware and virus items to be deleted onm a single PC...

    The view the Restore Point directories works fine on my non-domain-attached XP Pro box at home, of course!

    John

    PS Joe - yes, I found that the Spybot System Restore Point creation was the default option <big>after</big> I had run Spybot, which caused the infected DLL file disappear into the System Volume Information directories!
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  8. #7
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Spybot's not-so-bright idea

    Perhaps an AV product can delete the file as part of a manual scan of that folder? It seems rather drastic to drive 120 miles to do something that an AV program should do automatically.

  9. #8
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Spybot's not-so-bright idea

    Jefferson

    It tries, but it says it can't delete it because it was "in use". I'm still working on it, but I've suggested, not entirely seriously, that the chap (who is an alleged techie, by the way!) rebuilds XP Pro on a new hard drive... It was full of the Gator/GAIN stuff/rubbish that Ad-Aware loves!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  10. #9
    5 Star Lounger
    Join Date
    Mar 2001
    Location
    Pickering, Ontario
    Posts
    642
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Spybot's not-so-bright idea

    John

    I had a similar situation in that Norton ID'd an undesirable which turned out to be in the Restore Point file. Unfortunately, it would not eradicate the culprit. My only solution was the one suggested earlier... turn off System Restore Points, reboot and turn SRP back on.

    Bob

  11. #10
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Spybot's not-so-bright idea

    Restore point files should not be "in use." Something is very wrong there. (For reference, I have had success cleaning out restore points using Trend Micro's OfficeScan product.)

    Bottom line, rebuilding is the only way to truly have peace of mind.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •