Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got the following warning from my antivirus:

enter image description here


 Potential threat found

 C:\System Volume Information\restore{ .....\A00009511.exe

  Win32/HackAV.GV potentially dangerous application

 The event happened during an intent to access a file from the
 application: C:\WINDOWS\system32\svchost.exe

What is happening here?
Is some dll invoked by svchost infected?
Why is it trying to access a _restore file?

share|improve this question

The service detecting the infection, hosted by svchost, is probably the ekrn service (ESET's scanning service).

Usually this means it's found an infected file in a old system restore point.

To 'clean' this I usually disable System Restore to destroy all the restore points, re-enable it, and then make a fresh restore point.

share|improve this answer
I already did that a few days ago, but the thing re-appeared, so I guess something worst is happening. Do you know how to check if the ekrn is the one trying to access the file? – Dr. belisarius May 13 '11 at 10:12
@belisarius - yeah, that's kind of weird (that it came back). Have you done a full scan of the computer? You can probably use MS' Process Monitor (google it) and filter for writes to the system volume info folder. Currently I like using HitmanPro for a quick '2nd opinion' scan. – Ƭᴇcʜιᴇ007 May 13 '11 at 12:18
The full scan reports only the _restore file, but I don't trust it, because that does not explain why it is coming back, and why svchost.exe is accessing it. I will try deleting the restore points and monitoring writes to the volume info. Nice idea. – Dr. belisarius May 13 '11 at 12:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.