suspect program

I have Macafee security software and it has detected a
suspect program in C:\RESTORE\ARCHIVE\FS33.CAB. The
program is called Xwxload and does not show up in file
search.
Can I delete the entire FS33 CAB file safely?
This seems to be the cause of several problems on my
computer.
Paul

Can I delete the entire FS33 CAB file safely?

No, not without destroying the system restore archive.

This seems to be the cause of several problems on my
computer.

That is most unlikely. The contents of a cab file in the restore archive is
100% inactive and cannot and will not cause problems whilst in that location.

There is no need to be concerned about any virus or trojan in the _RESTORE
archive as they are harmless there and can only cause problems if you later
choose to restore to a checkpoint created AFTER infection and BEFORE you
cleaned your system. Any worms, trojans and viruses in the _restore archive
will automatically be discarded in time as newer data is archived and older
files discarded The problem with disabling system restore is that it flushes
the _restore archive and whilst that removes any virus remnants it also
removes any good usable checkpoints. If you do want to clear this folder I
wouldn't advise doing so until _after_ you have thoroughly cleaned your system
and got it working again just in case you need to use system restore to get
your system working correctly again. Once your system is clean and fully
functional you can clear the folder.

Moving on to how to clear the archive. There are two approaches to resolving
your problem:
Firstly try reducing the space allocated to the System Restore archive as this
could flush out these unwanted files. Do this using the slider found at
System | Performance | File System | Hard Disk and reduce the allocated space
until you flush out the unwanted files.

If that fails, reset System Resto
System | Performance | File System | Troubleshooting and check "Disable
System Restore", Apply and IMMEDIATELY reboot. This will flush you restore
folder and erase all checkpoints, then,
System | Performance | File System | Troubleshooting and uncheck "Disable
System Restore", Apply and again IMMEDIATELY reboot. This should now
automatically create a new checkpoint immediately following the restart.
Finally adjust the space allocated to the restore folder,
System | Performance | File System | Hard Disk and adjust the restore slider
to your preferred setting. A figure of 200MB is normally more than adequate
for day to day use allowing perhaps a week of checkpoints to be available
although increasing this to perhaps 400-500MB for a few days during periods of
large installs such Microsoft Office is advisable.

See also MS KB 263455 - "Antivirus Tools Cannot Clean Infected Files in the
_Restore Folder" (http://support.microsoft.com?kbid=263455).
--
Mike Maltby MS-MVP



Paul Lynott wrote:

I have Macafee security software and it has detected a
suspect program in C:\RESTORE\ARCHIVE\FS33.CAB. The
program is called Xwxload and does not show up in file
search.
Can I delete the entire FS33 CAB file safely?
This seems to be the cause of several problems on my
computer.
Paul