|
Posted by news on August 1, 2006, 2:05 am
If you were Registered and logged in, you could reply and use other advanced thread options
McAfee VirusScan is reporting C:\System Volume
Information\_restore{...hex reference...} is a Potentially Unwanted
Program and has been blocked from running on the machine.
Is it safe just to let McAfee delete this file, or will that upset the
Restore archive or Restore mechanism somehow?
--
Ian
|
|
Posted by Frank Saunders, MS-MVP OE on August 1, 2006, 6:27 am
If you were Registered and logged in, you could reply and use other advanced thread options
> McAfee VirusScan is reporting C:\System Volume Information\_restore{...hex
> reference...} is a Potentially Unwanted Program and has been blocked from
> running on the machine.
>
> Is it safe just to let McAfee delete this file, or will that upset the
> Restore archive or Restore mechanism somehow?
>
> --
> Ian
No.
In fact, McAfee shouldn't be able to remove it. There is nothing there that
will hurt you.
To get rid of the message turn off System Restore, then turn it back on and
create a restore point.
--
Frank Saunders, MS-MVP OE/WM
Reply in newsgroup
"They who would give up an essential liberty for temporary security, deserve
neither liberty or security"
|
|
Posted by news on August 1, 2006, 6:58 am
If you were Registered and logged in, you could reply and use other advanced thread options >> McAfee VirusScan is reporting C:\System Volume
>>Information\_restore{...hex reference...} is a Potentially Unwanted
>>Program and has been blocked from running on the machine.
>>
>> Is it safe just to let McAfee delete this file, or will that upset
>>the Restore archive or Restore mechanism somehow?
>>
>> -- Ian
>
>No.
>In fact, McAfee shouldn't be able to remove it. There is nothing there
>that will hurt you.
>
>To get rid of the message turn off System Restore, then turn it back on
>and create a restore point.
>
Thanks Frank. That's just what I wanted to hear.
--
Ian
|
|
Posted by Shiroy Choksey on August 3, 2006, 12:35 pm
If you were Registered and logged in, you could reply and use other advanced thread options
There are two reasons I think this happens:
(a) Sometimes the way System restore stores files, may sometimes cause a
signature match with a PUP, since the byte signature may be the same.
However, this is not really an indication that the file is a PUP, just that
it contains some of the bytes of the PUP which were used to write the
signature.
(b) Sometimes, you may have had PUP on your computer when the System Restore
was performed... So if you restore back to this place, you may land up with
the PUP installed on your machine, which will then again be removed by
whichever program installed it in the first place.
But all things said and done, I believe there is no way for PUP to execute
from inside the system restore files. So you should be at peace...
~Shiroy
>>> McAfee VirusScan is reporting C:\System Volume
>>> Information\_restore{...hex reference...} is a Potentially Unwanted
>>> Program and has been blocked from running on the machine.
>>>
>>> Is it safe just to let McAfee delete this file, or will that upset the
>>> Restore archive or Restore mechanism somehow?
>>>
>>> -- Ian
>>
>>No.
>>In fact, McAfee shouldn't be able to remove it. There is nothing there
>>that will hurt you.
>>
>>To get rid of the message turn off System Restore, then turn it back on
>>and create a restore point.
>>
>
> Thanks Frank. That's just what I wanted to hear.
>
> --
> Ian
|
|
Posted by news on August 4, 2006, 3:27 am
If you were Registered and logged in, you could reply and use other advanced thread options
>But all things said and done, I believe there is no way for PUP to execute
>from inside the system restore files. So you should be at peace...
>
Thanks Shiroy. The strange thing, though, is that the PUP is reported
automatically every few hours via a popup, yet when I do a full manual
scan of all files the PUP is not reported.
--
Ian
|
| Similar Threads | Posted | | restore after a file has been cleaned? msconf.exe | December 7, 2005, 9:05 pm |
| good reg file to restore desktop? | August 29, 2008, 9:46 pm |
| MWAV, infected _restore files, and System Restore? | January 3, 2006, 11:55 pm |
| Re: Lost System Restore Points, Management Services, Internet Connection, Firewall icon in Sys Tray, Sound | June 30, 2005, 5:35 am |
| Unknown file on system | August 12, 2007, 8:32 am |
| "Restore my Active Desktop" doesn't work | June 26, 2005, 10:53 pm |
| Tell users how to restore files removed by MRT | October 7, 2008, 12:06 pm |
| cleaning neighbor's computer, problems with Sys Restore | February 10, 2007, 2:06 pm |
| HOSTS File FAQ - Testing the HOSTS File | November 4, 2005, 11:21 pm |
| Zip File Virus *HELP* | June 28, 2006, 1:05 pm |
|
XML site map