# sysreserve.ini / Malware.Trace : what does it do?

**URL:** <https://boards.straightdope.com/t/sysreserve-ini-malware-trace-what-does-it-do/569438>\
**Category:** Factual Questions\
**Created:** [January 29, 2011, 7:06pm UTC](https://boards.straightdope.com/t/sysreserve-ini-malware-trace-what-does-it-do/569438 "2011-01-29T19:06:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\
**Post date:** [January 29, 2011, 7:06pm UTC](https://boards.straightdope.com/t/sysreserve-ini-malware-trace-what-does-it-do/569438/1 "2011-01-29T19:06:06Z")

</div>

I recently used MalwareBytes to clean out an infection of System Tool 2011 / “Rogue.Spyware”, as well as sysreserve.ini / “Malware.Trace”. I understand what System Tool 2011 does. What does sysreserve.ini do? I’m finding a lot of references online to cleaning this thing out and not much indicating what it is or what it does.

I’m not asking for help cleaning out a computer, I’m just curious as to what the infection could have done.

---

<div class="post-metadata">

**Author:** ![robert\_columbia](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@robert\_columbia](https://boards.straightdope.com/u/robert_columbia)\
**Post date:** [January 30, 2011, 12:06am UTC](https://boards.straightdope.com/t/sysreserve-ini-malware-trace-what-does-it-do/569438/2 "2011-01-30T00:06:20Z")

</div>

System Tool 2011 was identified as Rogue.SystemTool, not Rogue.Spyware.

---

<div class="post-metadata">

**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\
**Post date:** [January 30, 2011, 1:37am UTC](https://boards.straightdope.com/t/sysreserve-ini-malware-trace-what-does-it-do/569438/3 "2011-01-30T01:37:45Z")

</div>

INI files are usually just a place to store settings. Since it’s listed as a Malware.Trace, that means it’s just a file that is left by a previously removed piece of malware, perhaps even System Tool 2011.

In general, stuff that’s labeled Malware.Trace is used as a quick identifier that a certain piece of malware is installed, although it’s not the malware itself. But it’s rare for a program to be able to identify the trace file without also being able to identify the malware file.

Still, to be safe, I’d run an antivirus scan with a rootkit detector. A live CD version would be the best. [Avira](http://www.avira.com/en/support-download-avira-antivir-rescue-system) has one that works really well. Just use it overnight or something.