Re: Disabling System Restore Points after a successful restore.

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Bert:

Glad you saw this post. I'm a little puzzled by your response, so I hope you
can straighten something out for me on this topic.

I have always understood that the possibility that an infected computer's
restore points contain a copy of the virus is greater than the possibility
that restoring the system would fix whatever problems an antivirus program's
removal procedures might cause. Therefore, if you are fairly certain that
you have a virus, you wouldn't want to keep your restore points.

--
Ted Zieglar
"You can do it if you try."

"Bert Kinney" <bert@xxxxxxxxxx> wrote in message
news:uUCax5wMGHA.1032@xxxxxxxxxxxxxxxxxxxxxxx
Rebecca Sansom wrote:
Hi

Sorry I have a bit of a sillly question.

I have successfully rolled back my system using system restore to a
date before I got a popup virus that Norton was unable to remove.
The virus looks like it has gone from my pc.

I want to now run a complete virus check and Norton advises that I
disable system restore before I do this.

This is bad advise. Disabling System Restore should be done only after
all infection cleanup is completed. The reason being, if something goes
wrong (anything is possible) you will have no way to reverse your
actions. The only way to re-infect the system is to undo the current
restore point. Update Norton and do a virus scan. If Norton finds the
virus in the System Volume Information fold only, that's the time to
purge all existing restore points by disabling SR.

This action will delete all the restore points and I am therefore
afraid that this will then lose
me the state that I now have i.e virus free and return the virus?

No, System Restore does not work that way. You will only loose the
ability to undo the current state and restore to a previous date. The
current state of the system will not be changed by disabling SR.

Is this the case or can I just go ahead and disable system restore
without losing my restored state.

No. By disabling SR it's all or none. Once the system is infection free,
other than the System Volume Information folder (where SR holds it's
restore points) disable SR, then enable it.

For more on System Restore:
Description of System Restore
http://bertk.mvps.org/html/description.html

Any advice much appreciated.

Rebecca

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org



.

Relevant Pages

  • Re: malicious code as "amyuni PDF printer converter?"
    ... Discussions in Home Users Security Discussion: ... Discussions in Virus Discussions: ... restore was unsuccessful and I have since disabled the restore at ... the recommendation of Norton. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: w97m.marker.gen virus
    ... We have actually ran Norton both ways - with system ... The virus is still on ... >The restore folder is a function of the System Restore ...
    (microsoft.public.security.virus)
  • Re: XP Home & hacktool
    ... virus in the restore point. ... > The infector is rendered impotent while in quarantine. ... > FireWall to allow it to download the needed AV vendor related files. ...
    (microsoft.public.windowsxp.help_and_support)
  • RE: Cannot open AD utils
    ... Since you know the problem was the result of a virus, ... that server from scratch to remove any remnants of the virus. ... Use the Backup Program to Back Up and Restore the System ... Naming information could not be located because network path not found. ...
    (microsoft.public.win2000.active_directory)
  • RE: Cannot open AD utils
    ... Since you know the problem was the result of a virus, ... that server from scratch to remove any remnants of the virus. ... Use the Backup Program to Back Up and Restore the System ... Naming information could not be located because network path not found. ...
    (microsoft.public.win2000.active_directory)