suspicious script?!?

[robym6]

When I go to System Restore settings, McAfee VirusScan says the file C:\WINDOWS.000\system32\restore\rstrui.exe contains suspicious scripting activity. What's up with this?

[Geekgirl]

Hey robym6

Can you be alittle more specific? Like what are you doing in System Restore to give you that error? Only settings for System Restore are to turn it on and off.

[robym6]

Hello
I went to Windows XP Help and Support, from there I went to System Restore (the third green button under "pick a task"). In the middle left of the window that comes up, there's the link "System Restore Settings." A couple of seconds after I click that link, a McAfee VirusScan message pops up on the right of the screen that says: "The file C:\WINDOWS.000\system32\restore\rstrui.exe contains suspicious scripting activity and has been stopped."

I can't be much more specific than that :~)

Thanks RM.[/u]

[Geekgirl]

Well Have you run your anti-virus program to see if you may have been infected?

You can try using

or this link shared by lilpinkflower


Also, I asked for 1 of your posts to be locked so we can give you better assistance

I suggest run those apps then run HJT again and post another logfile in your other thread that contains your first HJT logfile with an explaination.