Anyone use system restore when a system is infected ?

[Bob]

I have an XP professional SP3 system on a LAN, which was infected with two
trojans. I removed the system from the LAN, did a full scan, found threats,
ran another in safe mode, found threats - they were all removed. But when I
boot back up to windows - non-safe mode, there are more threats !

Now ---- I would like to restore to a point before the threats hit - 1 week
ago, when the restore completes, I will stop, then re-start system restore to
clear restore points, then i will do another full scan.

I do have Symantec security/the latest definitions gor a/v and spyware.

Anyone do this with success ?


Thanks,
Bob

 

[VanguardLH]

I have an XP professional SP3 system on a LAN, which was infected with two
trojans. I removed the system from the LAN, did a full scan, found threats,
ran another in safe mode, found threats - they were all removed. But when I
boot back up to windows - non-safe mode, there are more threats !

Now ---- I would like to restore to a point before the threats hit - 1 week
ago, when the restore completes, I will stop, then re-start system restore to
clear restore points, then i will do another full scan.

I do have Symantec security/the latest definitions gor a/v and spyware.

Anyone do this with success ?

System Restore does not eliminate malware installed after the restore
point. It can also reinstate malware after eradication if the restore
point itself is infected.

http://en.wikipedia.org/wiki/System_Restore

System Restore is a purpose-specific partial backup. If it was
effective against malware, there would be no anti-malware software. You
will probably have to enlist other anti-malware products in your army to
combat the infection(s). For me, if it takes more than 2 evenings to
eradicate a pest, I do a fresh install of the OS (the data is available
from backups). That's how long it takes to do a fresh install of the
OS, install my applications, and then reapply my tweaks or configuration
changes to the OS and applications. Doesn't make sense to waste more
time trying to eradicate a pest than it takes to flatten and rebuild.

 

[nass]

I have an XP professional SP3 system on a LAN, which was infected with two
trojans. I removed the system from the LAN, did a full scan, found threats,
ran another in safe mode, found threats - they were all removed. But when I
boot back up to windows - non-safe mode, there are more threats !

Now ---- I would like to restore to a point before the threats hit - 1 week
ago, when the restore completes, I will stop, then re-start system restore to
clear restore points, then i will do another full scan.

I do have Symantec security/the latest definitions gor a/v and spyware.

Anyone do this with success ?


Thanks,
Bob

Hi Bob,
You didn't tell us what the infection is. It could be the restore points too
infected!

Unexplained computer behaviour may be caused by deceptive software
http://support.microsoft.com/kb/827315

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
install the free trial of Windows Live OneCare
http://onecare.live.com/standard/en-gb/default.htm
http://www.microsoft.com/mscorp/safety/technologies/onecare/default.mspx
Windows Defender detects and removes spyware
http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting or you can send it to me on my email
provided at the bottom:
When all else fails, HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)

Can you please send me a copy at (e-mail address removed) ,
remove the obvious to email me.
HTH,
nass

 

[Twayne]

I have an XP professional SP3 system on a LAN, which was infected
with two trojans. I removed the system from the LAN, did a full scan,
found threats, ran another in safe mode, found threats - they were
all removed. But when I boot back up to windows - non-safe mode,
there are more threats !

Now ---- I would like to restore to a point before the threats hit -
1 week ago, when the restore completes, I will stop, then re-start
system restore to clear restore points, then i will do another full
scan.

I do have Symantec security/the latest definitions gor a/v and
spyware.

Anyone do this with success ?


Thanks,
Bob

Your post isn't clear to me, but:

Assuming you mean to turn restore off, restart, then turn it back on and
restart, that will indeed remove any infestation from any restore points
that were infected., by removing all restore points and starting over
again.

But ... you do realize that is ALL it will do, right? System Restore
manages nothing but the registry and some support apps. If none of
those were infected, it will accomplish nothing for you. It does not
restore everything in the operating system. Infestatons often are
located in other places.
What you suggest is a good move for AFTER an infection has been
removed/repaired. So that one never brings back an infected file from
the storage. IF any are infected.
It would be unusual for clearing restore points to be all that needed
to be done. If the infestation is elsewhere, going back to a restore
point is not going to accomplish anything.

HTH,

Twayne