Hi everyone
I've made various analyses these days and every analysis show me an alert for things like:
C:\System Volume Information\_restore{AF11A44E-87A6-4ABD-8713-3C178D60C753}\RP297\A0131762.sys
The strange thing is MBAM can remove it (after restarting the computer) but if I do another analysis the day after, or sometimes the same day, I have another file, at the same place but with a different name, for example:
A0131762.sys
A0114805.sys
A0131682.sys
...

I also have Avira Antivir personal (free antivirus) and Spybot
My OS is Windows XP

Can you help me?
Here is the most recent log:


------------------------
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1421
Windows 5.1.2600 Service Pack 3

24/11/2008 23:42:49
mbam-log-2008-11-24 (23-42-49).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 188188
Temps écoulé: 1 hour(s), 50 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{AF11A44E-87A6-4ABD-8713-3C178D60C753}\RP297\A0131762.sys (Trojan.Downloader) -> Quarantined and deleted successfully.

Hi There.

Would you mind using the /developer switch? And posting that log? thanks!

oops sorry hum... where is this please? I 'm a bit lost here...

Hello volc

Before reporting a false positive, go here first and then post the developer mode log here

OK! I didn't know it was a false positive...
Thanks, I'll do that tomorow, it's 1:15 AM here, I need to sleep
Ciao