How do I clear virus in 'System Volume Information' file of XP



Mark
07-09-2005, 10:35 PM
Hi
My computer is infected with 'Global Patrol'. It is only picked up with a
spybot search each time I start the computer and removed. It is located in
the computers xp VOLUME INFORMATION FILE, from where NOTHING can remove it
(so Far!) and launches into HKEY_LOCAL_MACHINE\Software\GlobalPartol. From
this location it is removed by Spybot but never from its generation point. I
have tried about 10 removal programs without success. If I forget to remove
it each time it tries uploads other viruses etc which get blocked by
PC-cillan.

What do I do other than reformat and reload? - With massive loss of data!
(As I cannnot burn to disc)
Please note I can only download 200MB/month!!! Which is gone in a few days -
Then on VERY slow - small pages only can be opened! Eventually!

Shenan Stanley
07-09-2005, 10:35 PM
Mark wrote:
> Hi
> My computer is infected with 'Global Patrol'. It is only picked up
> with a spybot search each time I start the computer and removed. It
> is located in the computers xp VOLUME INFORMATION FILE, from where
> NOTHING can remove it (so Far!) and launches into
> HKEY_LOCAL_MACHINE\Software\GlobalPartol. From this location it is
> removed by Spybot but never from its generation point. I have tried
> about 10 removal programs without success. If I forget to remove it
> each time it tries uploads other viruses etc which get blocked by
> PC-cillan.
>
> What do I do other than reformat and reload? - With massive loss of
> data! (As I cannnot burn to disc)
> Please note I can only download 200MB/month!!! Which is gone in a few
> days - Then on VERY slow - small pages only can be opened! Eventually!

(This, of course, will erase any previous restore point you have.)

- Turn off System Restore.
http://support.microsoft.com/kb/310405
- Reboot.
- Turn on System Restore.
http://support.microsoft.com/kb/310405
- Make a Manual Restoration Point.
http://snipurl.com/68nx

--
Shenan Stanley
MS-MVP
--

MowGreen [MVP]
07-09-2005, 10:36 PM
Mark,

The system is *NOT* being reinfested from SVI. It's just not possible.
Obviously the system is being reinfested, but there are many places from
where that may be occurring. Flushing the Restore points will *not*
remove Global Patrol as it's loading from somewhere else.
Strongly advise you to visit a reputable antispyware forum for assistance :

http://www.bleepingcomputer.com/forums/HijackThis_Logs_and_Analysis-f22.html
http://spywarewarrior.com/viewforum.php?f=2&sid=3ce3e4c9a40b25268d1bac3189d22184
http://forums.spywareinfo.com/index.php?showforum=44
http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html
http://forum.aumha.org/viewforum.php?f=30&sid=28b7de716b318feaf7b8d0b95dcd7ff0

Please read the guideline of the forum your choice prior to posting
there or your post may be ignored or assistance delayed.


MowGreen [MVP 2004-2005]
===============
*-343-* FDNY
Never Forgotten
===============


Mark wrote:

> Hi
> My computer is infected with 'Global Patrol'. It is only picked up with a
> spybot search each time I start the computer and removed. It is located in
> the computers xp VOLUME INFORMATION FILE, from where NOTHING can remove it
> (so Far!) and launches into HKEY_LOCAL_MACHINE\Software\GlobalPartol. From
> this location it is removed by Spybot but never from its generation point. I
> have tried about 10 removal programs without success. If I forget to remove
> it each time it tries uploads other viruses etc which get blocked by
> PC-cillan.
>
> What do I do other than reformat and reload? - With massive loss of data!
> (As I cannnot burn to disc)
> Please note I can only download 200MB/month!!! Which is gone in a few days -
> Then on VERY slow - small pages only can be opened! Eventually!


How do I clear virus in 'System Volume Information' file of XP