I have a Dell desktop computer, I run Windows ME, MS
Office, WORD, and Winstar cable for internet access.
Recently, every day, when I log into Word, whenever I
strike a key, I get an error message (unknown error) and
the application shuts down. After I restart the computer,
sometimes, I will get 1/2 a letter written and then it
shuts down. Also, when I have connected to the
internet, "explorer" will shut the computer down as soon
as I strike any key.
I think it's a virus, but I have run all of my virus
protection programs. The only file which has been
detected is C:\_restore\temp\A0122995.cpy.
My virus protection can not delete this file or quarantine
it. ANY CLUES on how to get rid of this would be
appreciated.

Re: possible virus by Mike

Mike
Fri Aug 29 14:13:27 CDT 2003

The file C:\_restore\temp\A0122995.cpy is not the cause of your problems in
either Word or Internet Explorer since it is dead and inactive for as long as
it remains in the system restore archive although the fact that you had a
virus in the past might mean that it did some damage which was not repaired
when you deleted the virus.

There is no need to be concerned about any virus in the _RESTORE archive. It
is 100% harmless in that folder unless you choose to restore to a checkpoint
created AFTER infection and BEFORE you cleaned your system. Worms, trojans
and viruses are harmless in the _restore archive and will be discarded in due
course as newer data is archived and older files discarded. You cannot
selectively delete individual files from the archive without compromising the
whole archive. .

If you really are worried about this, then there are two approaches to
resolving your problem:
Firstly try reducing the space allocated to the System Restore archive as this
could flush out these unwanted files. Do this using the slider found at
System | Performance | File System | Hard Disk and reduce the allocated space
until you flush out the unwanted files.

If that fails, reset System Restore:
System | Performance | File System | Troubleshooting and check "Disable
System Restore", Apply and IMMEDIATELY reboot. This will flush you restore
folder and erase all checkpoints, then,
System | Performance | File System | Troubleshooting and uncheck "Disable
System Restore", Apply and again IMMEDIATELY reboot. This should now
automatically create a new checkpoint immediately following the restart.
Finally adjust the space allocated to the restore folder,
System | Performance | File System | Hard Disk and adjust the restore slider
to your preferred setting. A figure of 200MB is normally more than adequate
for day to day use allowing perhaps a week of checkpoints to be available
although increasing this to perhaps 400-500MB for a few days during periods of
large installs such Microsoft Office is advisable.

See also MS KB 263455 - "Antivirus Tools Cannot Clean Infected Files in the
_Restore Folder" (http://support.microsoft.com?kbid=263455).
--
Mike Maltby MS-MVP
mcmaltby@hotmail.com


Leo Bleiman <Lbleiman@winstarmail.com> wrote:

> I have a Dell desktop computer, I run Windows ME, MS
> Office, WORD, and Winstar cable for internet access.
> Recently, every day, when I log into Word, whenever I
> strike a key, I get an error message (unknown error) and
> the application shuts down. After I restart the computer,
> sometimes, I will get 1/2 a letter written and then it
> shuts down. Also, when I have connected to the
> internet, "explorer" will shut the computer down as soon
> as I strike any key.
> I think it's a virus, but I have run all of my virus
> protection programs. The only file which has been
> detected is C:\_restore\temp\A0122995.cpy.
> My virus protection can not delete this file or quarantine
> it. ANY CLUES on how to get rid of this would be
> appreciated.



Re: possible virus by Ron

Ron
Fri Aug 29 18:10:07 CDT 2003

"Leo Bleiman" <Lbleiman@winstarmail.com> wrote:

>I have a Dell desktop computer, I run Windows ME, MS
>Office, WORD, and Winstar cable for internet access.
>Recently, every day, when I log into Word, whenever I
>strike a key, I get an error message (unknown error) and
>the application shuts down. After I restart the computer,
>sometimes, I will get 1/2 a letter written and then it
>shuts down. Also, when I have connected to the
>internet, "explorer" will shut the computer down as soon
>as I strike any key.
>I think it's a virus, but I have run all of my virus
>protection programs. The only file which has been
>detected is C:\_restore\temp\A0122995.cpy.
>My virus protection can not delete this file or quarantine
>it. ANY CLUES on how to get rid of this would be
>appreciated.

Files in the System Restore folder (c:\_restore\temp) are totally
encapsulated and cannot cause any harm to your computer UNLESS you
were to use System Restore and choose a restore point prior to the
time they were put there.

You can get rid of these files by one of the following methods:

1. Just wait a while. Eventually the old System Restore points and
their associated files will be deleted as newer ones are created.

2. Reduce the amount of disk space allocated to System Restore. Open
Control Panel - System - Performance and click on File System. The
space for System Restore should probably be no more than 500 mb
*unless* you are installing a lot of applications, especially very big
applications. In that case you might want to have 800 mb to 1 gb of
restore space. Reducing the System Restore space will speed up the
deletion of the restore files containing the virus.

3. Disable System Restore completely and then reboot the computer.
The system restore files should all be deleted. Then enable system
restore and immediately create a manual restore point.

Good luck




Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."