How do I delete Write Protected Virus?

I'm having a problem deleting a virus off of my computer... McAfee is telling me that I have a virus located at C:/_Restore/Temp/A0062519.CPY
I've tried to locate it myself on my computer and have no clue how to find it??

Does anyone have any clues of how to get rid of this virus... I've seen people write that you can do it by starting the Computer in Safe Mode and deleting it from there or trying to untick the "Read Only" mark on the file but I can't even find the file! Any help would really be appreciated! Thanks!

- Dan

 

Hello, Smooth.

First, without knowing any details about exactly what virus McAfee is warning about, exactly what operating system you use, etc., I would suggest you take a look at information at http://spywarewarrior.com/sww-help.htm and try their suggestions.

Then, if you are unsuccessful with those anti-spyware programs, online scanners, anti-virus programs, etc., I suggest you post details described above as well as details about what you did to try to remedy the problem in the Removing Spyware & Viruses forum on this site. There are very friendly, knowledgeable people in that forum that can probably help [including help with HijackThis (HJT) logs.]

Good luck!

EDIT: Bursley, PeteC, or Newt (or anyone else that's able): Should we move this thread to the Removing Spyware & Viruses forum?

admin note: Good idea. Moving it now from XP to Security. Newt

 

Hello Dan,

C:/_Restore/Temp/A0062519.CPY Is the System Restore file. The easiest way to get rid of it is to disable System Restore which will flush the file, then re-enable SR, the system will create an initial SR point.

If this is WinME - I saw your other posts - thru the Control Panel > System > properties > File System > drag the slider all the way to the left (zero) and re-boot. Then re-enable by dragging the slider to the right.

If this is XP - Right click on My Computer > Properties > System Restore tab > Check "trun off system restore on all drives" > reboot and un-check to re-enable SR.

Regards - Charles

 

Smooth212

I write this reply due to personal experience with a family member. She found and removed a Virus. And the same as you it was indicated to be in a Restore Point.

I had given her the same advice that charlesvar posted but, she said I was Nuttier than a Christmas Fruit Cake and did not pay attention and used a previous RP and put the Virus right back into the system. And it also removed/replaced other changes she had made. ( She did not tell me. Her Daughter did. )

I beleive that you have learned a very valuable lesson.

Any time you do a Virus/Trojan check and find/clean out anything I believe it is a good idea to shut down and restart System restore.

Or at least I think it is a good idea. And it appears the charlesvar does too.

ESPECIALLY in a case such as you have where a Virus is shown to be in a System Restore point. Other wise, if you do have to use system restore you will be putting the problem right back in.

System Restore is a good thing. But I believe it needs to given some thought when cleaning, updating, or other changes to the system are made.

I myself usually do wait a day or two to make sure the changes I made are going to be OK.

BillyBob

PS
I personaly have messed up (at least once.) I added new software Monday. Then used a RP from a Sunday or Saturday. The newest software was nowhere to be found.

BB

 

Thanks guys I appreciate the help! I'm gonna attempt it now

And thanks for actually replying and helping unlike some people who tell you just to attempt to search for it yourself. Sure I could have searched myself and found loads of info but some problems are "specific." And people, like me, who really aren't good w/ computers sometimes can't relate one to the other. So for all of you who get upset w/ people who "re-post ", take it easy alright... People will be willing to help us even if you don't.

 

Hey guys I'm back, I tried what was mentioned above only to find that the virus is now in the "Archive" part of my System Restore???

The file name is C:/_Restore/Archive/FS423.CAB

This one is write protected again?? Any Ideas on how to remove it?

Thanks a lot.......... I appreciate it

 

Hey guys I'm back, I tried what was mentioned above only to find that the virus is now in the "Archive" part of my System Restore???
Ok, "mentioned above" wasn't my post.

Disable/re-enable SR and that'll take care of the problem.

Regards - Charles

 

How to Disable and Enable System Restore ME.
Disable it, reboot. Then enable it. This is one way to get rid of that file, the other is to boot the computer with a floppy, and delete the c:\_restore folder.