I have 155 Klez infected files all in the C:\_system\Restore\. I cannot seem to disable system restore to delete these files. Box is checked and PC rebooted many times. Nothin running. The box to disable system restore is always checked when I view it. What next? Thanks..

Let me put it another way. SYSTEM RESTORE disable box IS checked and may very well be disable. but when I run the virus removal tool it states that the infected files cannot be deleted or quarantined and suggests that I disable SYSTEM RESTORE. Will I be able to delete these files manually under safe mode?

Have you ever actually used "System Restore" in the past year and three months or so succesfully? There is a patch Q290700 to fix "System Restore" if it will not reset to a previous restore date. One last question are you, although I am certain you have done it this way, using the Control Panel>System>Performance>File System>Troubleshooting>Disable System Restore>OK>Close>Restart to disable "system restore"?

yes exactly as shown. I also find it hard to believe that the ONLY infected files on my ayatem are ALL in this folder. Doesnt make sense to me. I know for sure I have seen the file "WINKLYN.EXE" in the windows\system directory as a hidden file and I did manage to delete once, but it comes back. Thanks for the adv will adv
John

Here's a link to the patch...
Microsoft Knowledge Base Article - 290700

this is for Windows Me

hello
you will need to delete these files from dos. reboot with m.e bootdisk in drive and chose with out cd-rom suport.
and at the
a:deltree*.* c:\windows\systemrestore
and click enter.
you may have this system restor some where else on drive inwitch case point deltree to it by useing the corect dos path. and the last folder in path is the one deltree will delete with all sub folders.
make sure its pointing to system restore.
should you not have system restore as last file in path it will delete any thing else
thats at the end becarefull this is permanent.
system restore will create a new folder once you reable it.but it will be empty untill you set a new restore point.

Use a Windows ME boot diskette, as noted, and do a:
Deltree C:\_RESTORE
to remove the System Restore files. AV programs and you may delete files, but they are saved in the Windows ME hidden System Restore folder (_RESTORE).

You may also have to do the same if your AV is keeping copies in a folder such as C:\_SYSTEM\RESTORE.

Thanks ALL. That did it! I have restored some 5 gigs of space and after running the Klez removal tool it showed 'o' virus and no files infected. I feel great. One word however, deleting that _restore folder can be a bit tricky. I had to try several methods even changed the attribs on the folder. But it did work. Thanks again.....