Hi Jeff, The file in question does exist on the G: drive. The "System Volume Information" folder is a hidden Windows System folder and protected by Windows. Either you have, or had, this infection when Windows established a routine "System Checkpoint" in System Restore. Since Windows won't allow the anti-virus, or anything else, into those files, you need to eliminate them manually by turning off System Restore in this manner: Go to Start \ Settings \ Control Panel and open "System". Click on the "System Restore" tab. I suggest you turn off System Restore on all drives by checking that option. Be aware that this will eliminate all System Restore points that are presently established, but it will clear any infections that may exist in any drive restore files. You can also turn it off for individual drives by selecting that drive and pressing the "Settings..." button. Once you've made your selections and clicked "OK" on the way out, close everything and restart the computer. After the restart, run the anti-virus scans again and you should be clean. If you encounter a problem running the scans, restart in Safe Mode and run the scans again. After you get clean scans, return to System Properties and turn System Restore back on. Since you only use the external drive for transferring data, I suggest you turn System Restore off for it. Apparently Norton doesn't have Worm/Spybot31232 in it's definition files and I couldn't find anything on it. Is that the correct name? You may find something at the Antivir Web site or in their forums. Sven Swanson, Sr. ----- Original Message ----- From: "Jeffrey Forman" <[log in to unmask]> To: <[log in to unmask]> Sent: Saturday, January 15, 2005 9:59 PM Subject: [PCSOFT] Anti-Virus confusion I have two computers running XP Professional. On one computer I have Norton Anti-Virus. On The other computer I am using a free program called Antivir XP. I use a USB drive to share information between the two machines. Norton tells me that I have no viruses on this USB drive while Antivir tells me that I have countless files with signature of Worm/Spybot31232. What's worse is that Antivir tells me that all of these infected files are found in: G;\SYSTEMVOLUMEINFORMATION\_RESTORE{64192E79-9834-47EC-8A67-B63771DB6B1E}\RP103\A0032675.EXE. The numbers change for each infected file. My problems/questions are as follows: 1) I don't have this file on my G drive. 2) Why wasn't it picked up by Norton? 3) How can I get more information out of Antivir XP so that I can make this computer usable again? There is a popup for each occurrence of infection(hundreds of them). Thank You Jeff Forman PCSOFT maintains many useful files for download visit our download web page at: http://freepctech.com/downloads.shtml