System Restore - Take 2

[Waguih Boctor]

Hi, (First attempt was about an hour ago, apparently didn't take)

I noticed a few days ago that my Start button indicated that a new program
had been installed and I know I hadn't installed anything. It immediately
occured to me that some spyware might have found its way through my NAT
LinkSys router and my Zone Alarm Pro firewall. I went to System Restore and
restored to a System Checkpoint from the previous day. So, a couple of
questions;

1. If some program was installed behind my back, should my System Restore
take care of it? And how can I be certain that it did?

2. When performing the System Restore, I noticed that for the last couple of
months, I've had a System Checkpoint created just about every day, probably
every day that I've powered up, and not always at the same time. In looking
up Help, I couldn't find any reference to the term "System Checkpoint". Is
this a legit reference? And why would it be getting created so frequently?

3. In a networked home environment, how can I enhance my defense against
such spyware? Again, I'm using router with NAT and Zone Alarm Pro 4.x.

Thanks for any help, explanation and/or advice.

 

[Alex Nichol]

XP's System Restore program should not be used as a means to
uninstall unwanted programs. All System Restore does is return
your Windows XP "system files" to a state they were in on the date
a Restore Point was created. Thus, an unwanted "program file" will
remain installed on your computer.

That is not quite right.

See
http://microsoft.com/technet/itcommunity/Newsgroups/FAQSRWXP.asp
It does monitor some application files - it is a matter of type. SR
will restore (or remove) .exe and .dll files, and of course restores the
original registry, so it will in effect take an application out of
services, though there may be some incidental files left in the
application's own directory (such as install.log for example). But
quite often a regular uninstall leaves such loose ends anyway.

If uninstalling a program after a reasonably short test, a SR will have
the big benefit of getting such registry matters as File Associations
back exactly as they were - uninstalling rarely can manage that

 

[Alex Nichol]

Thank you for shedding light on this, Alex. I'm curious, though, as to why
it started running daily all of a sudden three months ago or so. I installed
and uninstalled and actually created several explicit Restore Points before
that time when I was installing various components and programs

You may have had the task scheduler turned off - it must be on for SR to
run daily, even though it does not appear as an explicit scheduled task.
And turning on your Scheduled NAV will have turned the service on