> My question is, is it safe to just delete what's in the temp folder
No. It has to be the complete archive.
> or is there anything special I need to do or know....
There is little or no point in removing viruses or trojans from the
_RESTORE archive as they are totally harmless and in doing so you are
destroying the integrity of the archive. Once you have got your system
clear of malware reset system restore so as to clear the archive and
create a new clean reference checkpoint.
See MS KB 263455 - "Antivirus Tools Cannot Clean Infected Files in the
_Restore Folder" (http://support.microsoft.com?kbid=263455).
--
Mike Maltby
mcmaltby@hotmail.com
> I'm working on a W-ME machine that indicates infected files in the
> _restore\temp folder. Using Mike M's replies to previous post I found
[quoted text clipped - 4 lines]
>
> Thanks for any assistance......
grwilbourn - 09 Nov 2005 20:13 GMT
Mike, I've got the system 'cleaned' and nothing pops up on bootup (virus
detected, etc.) but when I run a scan it shows the files in _restore/temp. I
attempted to use the system to empty the restore folder but when I went to
...file systems\troubleshooting 'Disable System Restore' was already
selected. I clicked it off, applied and restarted. When back and it was
selected again. I attempted to deselect/reselect/deselect again and restart
but it comes back already selected again.
Also, on the 'Hard Disk' tab 'System Restore Disk Space Use' is grayed out
and I can't adjust slider. I looked in bios to see if there was a setting the
disabled system restore but couldn't find anything.
What can I do? I know it not critical to get rid of the restore temp files
but the user doesn't like seeing them appear when they run a scan...
Thanks again....
> > My question is, is it safe to just delete what's in the temp folder
>
[quoted text clipped - 22 lines]
> >
> > Thanks for any assistance......
Mike M - 09 Nov 2005 21:05 GMT
It would appear that system restore is totally fubared on your PC, this is
often a consequence of having had a product from Symantec installed on the
system at some time. The solution to the problem requires you to clear
down the entire folder structure from DOS.
Delete the folder as follows:
a) Boot to DOS using a floppy. Do NOT choose "Minimal Boot" from the menu
when booting from a floppy but rather choose "Start computer with (or
without) CD-ROM support" otherwise the ATTRIB command will not be
available.
b) At the DOS A:\> prompt, type:
ATTRIB -H -S -R C:\_RESTORE
and then
REN C:\_RESTORE OLDREST
c) Remove the floppy
d) Reboot your PC
e) Delete the folder C:\OLDREST
f) Check that an automatic system restore checkpoint was created.
g) Finally adjust the space allocated to the restore folder: System |
Performance | File System | Hard Disk and adjust the restore slider to
your preferred setting. A figure of 200MB is normally more than adequate
for day to day use allowing perhaps a week of checkpoints to be available
although increasing this to perhaps 400MB for a few days during periods of
large installs such Microsoft Office is advisable.
Finally you may want to give system restore the once over by carrying out
the following quick test.
a) Create a shortcut on your desktop to a file.
b) Create a manual checkpoint
c) Delete the shortcut
d) Restore you PC to the checkpoint you created.
Was the shortcut restored? Did you see any error messages?

Signature
Mike Maltby
mike.maltby@gmail.com
> Mike, I've got the system 'cleaned' and nothing pops up on bootup
> (virus detected, etc.) but when I run a scan it shows the files in
[quoted text clipped - 13 lines]
> files but the user doesn't like seeing them appear when they run a
> scan...