Hi Jeff,

The file in question does exist on the G: drive. The "System Volume
Information" folder is a hidden Windows System folder and protected by
Windows. Either you have, or had, this infection when Windows established a
routine "System Checkpoint" in System Restore. Since Windows won't allow the
anti-virus, or anything else, into those files, you need to eliminate them
manually by turning off System Restore in this manner:

Go to Start \ Settings \ Control Panel and open "System". Click on the
"System Restore" tab. I suggest you turn off System Restore on all drives by
checking that option. Be aware that this will eliminate all System Restore
points that are presently established, but it will clear any infections that
may exist in any drive restore files. You can also turn it off for
individual drives by selecting that drive and pressing the "Settings..."
button. Once you've made your selections and clicked "OK" on the way out,
close everything and restart the computer.

After the restart, run the anti-virus scans again and you should be clean.
If you encounter a problem running the scans, restart in Safe Mode and run
the scans again. After you get clean scans, return to System Properties and
turn System Restore back on. Since you only use the external drive for
transferring data, I suggest you turn System Restore off for it.

Apparently Norton doesn't have Worm/Spybot31232 in it's definition files and
I couldn't find anything on it. Is that the correct name? You may find
something at the Antivir Web site or in their forums.

Sven Swanson, Sr.

----- Original Message -----
From: "Jeffrey Forman" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Saturday, January 15, 2005 9:59 PM
Subject: [PCSOFT] Anti-Virus confusion


I have two computers running XP Professional. On one computer I have Norton
Anti-Virus. On The other computer I am using a free program called Antivir
XP. I use a USB drive to share information between the two machines. Norton
tells me that I have no viruses on this USB drive while Antivir tells me
that I have countless files with signature of Worm/Spybot31232. What's worse
is that Antivir tells me that all of these infected files are found in:
G;\SYSTEMVOLUMEINFORMATION\_RESTORE{64192E79-9834-47EC-8A67-B63771DB6B1E}\RP103\A0032675.EXE.
The numbers change for each infected file. My problems/questions are as
follows:
1) I don't have this file on my G drive.
2) Why wasn't it picked up by Norton?
3) How can I get more information out of Antivir XP so that I can make this
computer usable again? There is a popup for each occurrence of
infection(hundreds of them).

Thank You

Jeff Forman

             PCSOFT maintains many useful files for download
                     visit our download web page at:
                  http://freepctech.com/downloads.shtml