Windows Restore re-enabled without my knowledge?

Hi All,

My AVG just found a few trojans hiding in my (hidden) "C:\System Volume Information" folder. I distinctly remember turning off Windows Restore a long time ago, but it's now (somehow) turned on? I turned it off again, and all files were removed except "MountPointManagerRemoteDatabase" and "tracking.log "...

Is this the result of these virii? I mean, can running an external file turn on system restore? I do know that running certain programs (like registry backups and driver installs) will create restore points, could that be what happened? Is this something I need to check on a regular basis?

Thanks!

Russ

 

Hi Russ,

I've experienced SR turning on for external dives even though disabled SR for them but never for internal drives.

I can't tell you for certian having always had SR enabled for OS partitions, but I did experince SR turned on for the inactive OS partition (in a dual boot) when I modified the registry one time for the active one - supprised me

You can delete what's left in Sys vol folder - if you can Windows may argue.

 

Hi Christer,

I've done it - for the non OS partitions. I think it can be done as long as it's not the folder being deleted but the contents.

 

I previously added full access for myself (Admin) under security so I could see what was in the folder. Then turned off SR (again) and all the files went away except for two fore-mentioned files. Disabled SR service and will continue to monitor this situation.

Thanks!

Russ