[KB250] Infected files keep reappearing—what should I do?

If a previously deleted file continues to appear on your system, it is likely that you are using either the Windows ME or Windows XP operating system. Both operating systems are equipped with an automatic system files restore function which enables the creation of so-called restore points. By backing up all crucial system files, these restore points allow the user to revert to a previous configuration in the event of a serious system problem.

The restore points are stored in the System Volume Information folder on all drives for which this function is enabled. If you are running an out-dated version of the virus signature database, ESET NOD32 Antivirus may not detect some viruses. Consequently, any infected file residing in the Windows directory or other system directory may be inadvertently backed up and included in a restore point.

Provided ESET NOD32 Antivirus is kept current through its automated virus signature updates, no infected file should be contained in this system directory. If this directory does contain an infected file, the automatic system files restore function should be disabled and the file should be deleted. See the steps below for details on this process.

To turn off the automatic System Restore function in Windows XP:

1. Click Start, right-click My Computer and then click Properties.


2. Click the System Restore tab and then select the Turn off System Restore option.
    
3. Click OK, and then click Yes to confirm.
    
4. Run a Computer scan.

To turn off the automatic System Restore function in Windows ME:

1. Right-click My Computer and select Properties.
    
2. Click the Performance tab → File System.
    
3. Click the Troubleshooting tab and select the check box next to Disable System Restore.
    
4. Click OK twice, and then click Yes when you are prompted to restart the computer.
    
5. Run a Computer scan.