System Restore Headache!

[Guest]

The other day I was running my spyware program and it showed me there was
spyware in a system restore point. I thought it would be a good idea to get
rid of the restore point so I deleted all of my restore points. Obviously a
big mistake! When I rebooted, my desktop looked like it did when I first got
my computer and all my data/picture/music files were gone. I went back to
system restore and there was one restore point left from the day before,
called system checkpoint. Figuring I had nothing to lose, I restored back to
that point and all my files, settings, etc came back. I created a new
restore point at that point and thought I would be ok. Unfortunately, now
everytime I shut down or reboot the computer reverts back to the point where
my files and settings are gone and I have to start all over again. What the
heck did I do and can this be fixed? Thanks!

 

[Guest]

Forgot to mention, I have XP Pro w/SP 2 and I was logged on as administrator
when performing these tasks.

 

[Guest]

Forgot to mention, I have XP Pro w/SP 2 and I was logged on as administrator
when performing these tasks.

Hi Andee,
Try to scan for Viruses and malware, you didn't mention the name of the
spyware or what application you used.
Here are some tips on troubleshooting:
http://bertk.mvps.org/html/srfail.html

If still no joy try to run the HijackThis and send the Log to the
appropriate forum for analysis.
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
P.S do you have any Third party Toolbars?, Turn Off the AV when trying to
restore and try to restore in Safe mode.
HTH.
Let us know.
Regards,
nass

 

[Bob Harris]

First, save all personal files off of the PC. A write-once CD or DVD would be a good place. Be sure to confirm that you can read the optical media ! Be sure that they are NOT encrypted, or you may never get them back, if you hvae to reinstall XP, even if the user ID and password are the same.

Next, try saving as many settings as you can. For example, Internet Explorer favorites are nothing but a bunch of little files stored under C:\Documents and Settings\your_name\favorites. These can be copied & pasted to another directory, then burned to CD, copied to USB flash drive, etc. Explorer also has an export option. Most email clients have export options for address books.

Then, maybe try the XP file and transfer wizard to save more things, some of which are locked during normal XP operation. (Copy & paste will not work on locked files, but this wizard will.) Caution: If the underlying problem (malware of some sort I assume) is also copied, then this may not be a good solution.

Then, try to remove the malware, as described in the previous reply. If successful, try restoring the setting via the wizard. If the malware returns immediately, remove again and do not use the wizard to restore anything.

Depending on the severity of ther problem you may need to reinstall XP, which means formating the C: partition and losing everything on it. In this case you would also need to reinstall all programs. In your PC came with XP, it has some special procedure to "restore" the PC to the day you received it. That may restore programs originally purchased with the PC, as well as XP itself. Obviously, any XP updates will be lost when reinstalling or restoring. Thus, save this option to last.

In any event, once your personal files are copied off of the PC, the worst that can happen is that after a full re-install you will need to spend some time re-configuring the system. For the future, consider that maybe you should keep your personal files anywhere except under Documents and Settings, and perferrably on a separate partition or even a separate hard drive from XP.

 

[Guest]

Thanks to both of you for getting back to me. The program I used to check
for spyware is CounterSpy but I don't remember the name of the spyware it
found; just remember it said it was in the restore point. When I do a scan
now, I don't see that message anymore so I assumed I was in the clear once I
deleted all of my restore points. I will certainly try your suggestions;
have to wait until tomorrow to print directions as my home printer does not
work. Will let you know how I make out. Thanks again!!!

 

[Ron Martell]

The other day I was running my spyware program and it showed me there was
spyware in a system restore point. I thought it would be a good idea to get
rid of the restore point so I deleted all of my restore points. Obviously a
big mistake! When I rebooted, my desktop looked like it did when I first got
my computer and all my data/picture/music files were gone. I went back to
system restore and there was one restore point left from the day before,
called system checkpoint. Figuring I had nothing to lose, I restored back to
that point and all my files, settings, etc came back. I created a new
restore point at that point and thought I would be ok. Unfortunately, now
everytime I shut down or reboot the computer reverts back to the point where
my files and settings are gone and I have to start all over again. What the
heck did I do and can this be fixed? Thanks!

See MVP Bert Kinney's System Restore pages:
http://bertk.mvps.org/index.html

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

 

[Guest]

I got my response back from Hijack This forum and the good news is that I
didn't have any malware lurking around in my system. The gentleman who
replied suggested it could be my new user accts were corrupted and I should
delete and try again. Will see what happens with that. Thanks again to all
for your help!