I ran a standard scan using Avast! 4.6. It found a virus in the following file: “Win32P2E-4(Trj) has been found in C:_RESTORE\ARCHIVE\FS79.CAB\A0008524.CPY”
At first Avast couldn’t remove, delete, or repair file, with an error message coming each time. I went to the Avast FAQ’s website, and it recommended disabling System Restore. I did this, but had to restart the computer and when I had rebooted and reopened Avast, the “results from the last scan” option wasn’t available, so I can’t see that virus. I then used Windows Explorer to find C:_Restore and scan it, but nothing was found.
Has the virus disappeared? I can’t quite believe that. Do I have to run the whole scan again or is my computer safe from this now?
System Restore stores copies of some files and protects them. Sometimes virus files get stored in this way. They are inactive (unless System Restore is used to return the computer to a time when the virus was active) but cannot be deleted.
Diasbling System Restore causes all the backup files to be deleted, so the virus is gone now. Don’t forget to turn System Restore back on- it can be useful sometimes.
The virus must at one time have been in one of the system folders when it was deleted, windows has in its infinite wisdom backed it up (just in case you made a mistake) in one of the system restore Restore points. This is a windows protected storage area and why avast can’t remove it. You should disable system restore and reboot as suggested and that should be enough to clear all system restore points including the infected one.
Once you have disabled system restore, reboot, that should automatically delete the contents of the _Restore folders. Scan your PC again and if clear enable system restore.