I am infected in my system files with a trojan named Win32:Kuang2
When I try to move to chest or delete there is a failure in the program. If I run another scan the same virus is still there ( there are at least 10 files infected w/ this same virus)C:\System Volume Information_restore{8F4E05A0-232A-4012-B977-A1E0E558BEBD}\RP429\A0198086.exe\Files\APVXD.VXD
Is there any way I can remove this virus???
The C:\System Volume Information\ folder is a windows protected folder, that is why you can do anything in there, it is a part of the system restore function and when something is deleted from the windows system folders a restore point is created in case you made a mistake (even for viruses).
So this is likely how it got in there, have you ever used panda’s on-line scanner because that is naughty creating a sub folder ‘activescan’ within the system32 folder and the virus signatures aren’t encrypted. Because of this they are often detected when you scan your system and if deleted from within the system32 folder would be saved by system restore.
- The c:\System Volume Information folder is a part of the system restore function and as such is protected by windows, the only way to clean infected _restore points is do disable system restore and reboot. This will clear ALL _restore points. Once you have disabled system restore, reboot, scan your PC again and if clear enable system restore.
Win XP-ME - How to disable System Restore