removing NACHI.B in System Volume Information

Discussion in 'NOD32 version 2 Forum' started by Niko, Mar 10, 2004.

Thread Status:
Not open for further replies.
  1. Niko

    Niko Guest

    Hello,

    One of my computers have been infected by NACHI.B.
    NOD32 send me emails with this alert :

    10/03/2004 14:47:56 - AMON - Antivirus monitor Program Virus Alert triggered on PC_MULLER: C:\System Volume Information\_restore{014D633C-8DF8-4725-B893-1F85A30C059C}\RP248\A0017966.exe infected with Win32/Nachi.B worm.

    NOD32 says C:\System Volume Information\ is invalid

    The system files automatic restoration is disabled.

    How can I remove this file ?

    Thanks

    Niko
     
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,451
    Location:
    North Carolina, USA
    Hello Niko,

    To clean out your System Restore, do the following:

    Turn OFF System Restore.
    1. On the Desktop, right-click My Computer.
    2. Click Properties.
    3. Click the System Restore tab.
    4. Check the box beside "Turn off System Restore".
    5. Click Apply, and then click OK.
    6. Restart the computer. (You must restart your computer to clear the old Restore Points)

    To Turn System Restore back ON.
    1. Follow the above Steps 1 to 3
    2. UNcheck the box beside "Turn off System Restore".
    3. Click Apply, and then click OK.
    4. Restart your computer.

    Then do another scan with your virus scanner to see if you are still being alerted to anything.

    Then create a new restore point, if your scan comes back clean.

    HTH.....

    Regards,
    Kent
     
Thread Status:
Not open for further replies.