15 plus gigabytes in _Restore file!!!

[WJWheels]

A lady called me up because she was running out of room on her Windows ME computer. I looked and she had almost a full 18 gig drive but did hardly anything but surfing and email.

Well, further look showed over 15 gig in the _Restore folder. Opening it shows 4 or 5 files of a few kb total. The description however shows several folders and many thousands of files - all hidden.

So far I've tried to delete them to no avail. I've also tried to run the semantic Klez removal tool. It ends unsuccessfully, but does report finding thousands of infected files - most in the _Restore folder. I also opened in dos and tried to change the "hidden" attribute by using the command (while within the _Restore folder) "attrib -h /S" . This ran for almost 24 hours with the drive light illuminated, and finally we shut it off.

Hopefully someone has an idea how to get to these files and delete them. I'm not sure if my "attrib -h /S" command is correct either. Any and all help is appreciated.

TIA

[morriswindgate]

You gotta turn restore off before you can delete the file
do this and then just delete the restore file in each partition of the hard drive.

http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm

[WJWheels]

I did turn restore off - checked the box in "troubleshooting". In fact it was already checked when I first looked at it. Even when I cleared the box (unchecked it) and rebooted, the checkmark was there again. Is the virus doing this?

[morriswindgate]

When you disabled it did you hit the "Apply" Button? Also you need to go into the Folder Options (My Computer look under tools) and in view check show hidden folders.

[WJWheels]

yep, yep... I did all that Morris - about 20 times actually. The situation is that the file will not delete and though a virus checker starts checking it, it will not finish. In dos it also shows there are only 5 small files in the folder. However the folder size is 15+ gig. There's only a sliver of room left on the hdd.

Is "attrib -h /s" the proper dos command to unhide the files in a folder and its subfolders?

[galaxian]

To disable System Restore you go to CP ? Performance > File System >TroubleShooting Tab

http://support.microsoft.com/default...;en-us;q263455

And BTW, you do not need to click on Apply in order to affect a change. You would use the Apply if you wanted to make a change effective, and then from the same panel, choose another option or another tab to make another change.

[WJWheels]

It won't unlock. _Restore is holding over 15 gigabytes. She (the owner of the pc) has NEVER set a checkpoint for system restore. She doesn't even know what it is! As I said the box was already checked to "disable" when I first looked at it on the troubleshooting tab. I'd like to delete it in dos if possible, but I can't see the files there either.

[padawan]

Format? The best solution for a user that wouldn't know better anyway.

[WJWheels]

I think that's what it's coming down to. Thanks.

[slingslingbinks]

hum, no restore point's thought that win me did that by it's self from time to time, at least once a week. does it list a restore date of dec. 30 1899? i had win me on this puter, i had so many problems with restore dates of dec. 30 1899, and many other regestry problem's, that i bought a xp update and all is ok now. i was also doing factory restore's at least 3 times a month, and after reinstalling all of my program's, only to have to redo it all over again in a week, it got real old, quick. i know 3 other buddies with win. me, and they have had no problem's. i'm sorry but fighting with compaq for over a year, on there copy of me. has left a bad tast in my mouth for window's version me. c-ya sling