Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How to remove System_Volume_Information\Restore\*.*


  • Please log in to reply
4 replies to this topic

#1 S3cS3arch3r

S3cS3arch3r

  • Members
  • 142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:EU
  • Local time:10:30 AM

Posted 10 July 2012 - 08:53 AM

Hi all,

I have some issues with an old XP machine from my beloved mother.
It had some malware infections (a RAT / Adware / Zero.Access / And some other MBR-garbage), witch I got rid of nicely using -among others- some custom scripting with ComboFix, if I may say so myself :P

This was in March, earlier this year. The system is running fine again now / since, both Kaspersky and F-Secure rescue CD's are giving me the all clear. I also monitored all outgoing traffic, and nothing suspicious came up.
We got her a new e-mail account and so on as well. No weird things in the registry, everything seems to be clean, I am quite SURE the system is now clean as can be..
The only exception is the now-freshly-installed Comodo Internet Security, it keeps finding some remnants in the System_Volume_Information\Restore folder.
MBAM and all others I tried so far (Avira, MSE, Panda, AdAware, HitmanPro, you name it) miss this entry.
(No there not installed at the same time, only 1 active AV installed at any given time)

I already turned off system-recovery, rebooted, and checked if it was still de-activated on all drives, witch it is.
I also de-installed all software not needed to boot in the first place and that I can replace, including Office, Photoshop, Silverlight, you name it.
All custom back-up software (it's a Dell) has been removed, the discs do not contain any hidden partitions...

I'm a bit clueless now, I hope you guys can help out...


Questions:
Is there an easy way to manually delete / script myself a way out of this without harming the system?
Could those Restore\*.* files be from a(n OLD???) driver installation? (The only things I kept on the system)
I cross referenced the name / CLSID and location against the registry, but I can't find anything??? :wacko:

Thanks in advance,

\0/
-Sec

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,290 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:30 AM

Posted 10 July 2012 - 10:54 AM

When System Restore is turned off (assuming thzt you are referring to SVI...those files are emptied.

Certain programs/functions may try to set a restore point...even if SR is disabled, resulting very small files which may then wind up in SVI folders. These can be manually deleted by user, if desired.

I turn off SR on my systems...but I find that adding a new drive/partition may initiate it again...so I just turn it off again.

Louis

#3 S3cS3arch3r

S3cS3arch3r
  • Topic Starter

  • Members
  • 142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:EU
  • Local time:10:30 AM

Posted 10 July 2012 - 05:12 PM

Ah yes, I forgot to mention the files are absolutely locked from within the OS, tried multiple tools, and although I have enough means to manually securely-delete them from a LiveCD, the question is, will this potentially harm the system?

- Is the \restore\ directory for Win SR only or are there other applications that could write to that dir as well, like un-installers???

I'll back the whole directory up to be sure, and then delete it, after which I'll make a new \restore\ with the same properties and try to boot Windows again.

Thanks for the advice, I'll update later this week.


Note, I don't use SR either, but my mom is a novice end-user, so it couldn't hurt there. :thumbup2:

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,290 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:30 AM

Posted 11 July 2012 - 07:31 AM

I can't tell you anything more about SR...as I said, I don't use it and haven't worried about how it functions.

I imagine there's a lot of similar information about it if one chooses to use Google.

Louis

Edited by hamluis, 11 July 2012 - 07:32 AM.


#5 S3cS3arch3r

S3cS3arch3r
  • Topic Starter

  • Members
  • 142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:EU
  • Local time:10:30 AM

Posted 11 July 2012 - 02:30 PM

I can't tell you anything more about SR...as I said, I don't use it and haven't worried about how it functions.

I imagine there's a lot of similar information about it if one chooses to use Google.

Louis

Got to love Google, brought me here in the first place :P

Well, I dove some deeper in the matter, and in fact, some application-uninstall information IS written there...
I found 100's of different sub-directories in 3 main _restore-{CLSID?} directories, totaling over a GB, while SR is 100% disabled.

I backed the sub-directory up and then Sdeleted it using a LiveCD, and so far so good.
It seemed to contain information about Zoo Tycoon, and as that is not installed anymore, it seemed safe to remove.

Still not sure on how the System Volume Information\_restore-{xxxx} dir works, I hope somebody here can explain that in plain English :P


Thanks,

\0/
-Sec




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users