System restore

[google3luo359]

I would like to do a system restore and have a couple of questions.

First, I have just run a virus checker and it has cleaned up a few
viruses.
Will those viruses be restored if I do an XP system restore?

Second, when chosing a restore point, if I chose a point, does that
mean everything will be restored from just _before or just after
_after that point?
This is important because the restore point is a software installation
point.

TIA

 

[Bill in Co.]

I would like to do a system restore and have a couple of questions.

First, I have just run a virus checker and it has cleaned up a few
viruses.
Will those viruses be restored if I do an XP system restore?

That depends on what was saved beforehand. I f there were viruses before
the restore point you choose, they'll reappear (unless your virus checker
has the capability of actually getting into the restoration files
themselves, which seems doubtful to me)

Second, when chosing a restore point, if I chose a point, does that
mean everything will be restored from just _before or just after
_after that point?
This is important because the restore point is a software installation
point.

TIA

It will be restored to just that point and everything recorded *before*
then. Anything afterwards will not (so if you installed something
afterwards, it won't be installed anymore).

 

[Lem]

I would like to do a system restore and have a couple of questions.

First, I have just run a virus checker and it has cleaned up a few
viruses.
Will those viruses be restored if I do an XP system restore?

Second, when chosing a restore point, if I chose a point, does that
mean everything will be restored from just _before or just after
_after that point?
This is important because the restore point is a software installation
point.

TIA

System Restore in Windows XP is intended to restore the "system." That
is, it monitors and saves a core set of system and application files,
including the System Registry. It does *not* save or restore user data
or most user application files.

Your "before" and "after" question doesn't make sense. Think of SR as a
snapshot. Did you take the snapshot before the software installation or
after the software installation? If the SR point was created
automatically by some software installation "wizard," chances are 99 out
of 100 that it was taken *before* the installation began.

Note, however, that restoring to that point is *not* the same as
uninstalling the application. To completely uninstall the files added
by the installation, you must uninstall it using Control Panel > Add or
Remove Programs (or some other uninstall option provided by the
application) *before* you do the System Restore. Otherwise, you will
end up with a pre-install registry and post-install files.

As for viruses, it is possible that some files monitored by System
Restore may become infected. If this happens, restoring will restore
the infection. This is why many malware cleanup instructions tell you
to delete all of your system restore points after you have cleaned up
the rest of the system and to then make a new, known clean, restore point.

For much more information about System Restore, see http://bertk.mvps.org/

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

 

[db.·.. >]

yes, it is highly likely
that the virus or trojan
has been on your system
whether active or dormant,
then it is also likely stored
in the restore points/files.

because virus's usually
modify or corrupt system
files, the antivirals zap will
also zap those system files.

however, system files are
vital for the functionality
of windows so they need
to be replaced and unfortunately
antivirus programs cannot
do this.

what i suggest is to do a
windows "repair" with your
windows cd.

the repair option will replace
missing or corrupted system
files with genuine ones.

also, the repair will delete
all the old restore points and
create a brand new one, since
the repair basically rebuilds
windows.

http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/doug92.mspx

 

[Colin Barnhorst]

System Restore is not a means of dealing with malware. Also, the effects of
having had a virus can affect SR itself. From the Help and Support center
in XP:

"Antivirus utilities can affect whether your system can be restored to a
previous point. If a restore point contains an infected file because the
utility is not set to clean the file within the restore point, or if an
infected file has been removed from a restore point by an antivirus utility
because it could not be cleaned, System Restore will not recover the
computer to this partial or infected state. If System Restore could not
restore your computer to a previous state, and you suspect that one or more
restore points contain infected files or have had infected files removed by
the antivirus utility, you can remove all restore points from the System
Restore archive by turning off System Restore and then turning it back on."

 

[google3luo359]

Your "before" and "after" question doesn't make sense. Think of SR as a
snapshot. Did you take the snapshot before the software installation or
after the software installation? If the SR point was created
automatically by some software installation "wizard," chances are 99 out
of 100 that it was taken *before* the installation began.

I didn't take a snapshot before the software installation.
The point was created automatically by some software installation
"wizard".

... To completely uninstall the files added
by the installation, you must uninstall it using Control Panel > Add or
Remove Programs (or some other uninstall option provided by the
application) *before* you do the System Restore. Otherwise, you will
end up with a pre-install registry and post-install files.

OK, thanks.

As for viruses, it is possible that some files monitored by System
Restore may become infected. If this happens, restoring will restore
the infection. This is why many malware cleanup instructions tell you
to delete all of your system restore points after you have cleaned up
the rest of the system and to then make a new, known clean, restore point.

So AVG doesn't clean up everything, restore points and all, when it
does a virus cleanup?

 

[google3luo359]

System Restore is not a means of dealing with malware. Also, the effects of
having had a virus can affect SR itself. From the Help and Support center
in XP:

Thanks Colin. I'm not intending to do a system restore to deal with
malware.

Just for clarification.
I was pretty satisfied with the results of the virus cleanup by AVG.

I did notice a couple of things though that bugged me.
When I go into Start/My Computer and double-click on C:\, D:\ or E:\,
I get "C:\ access denied" or "D:\ access denied" or "E:\ access
denied".

This never happened before and is unacceptable.
I searched for a fix on Google and there were dozens of references to
this problem but nothing appeared that would fix it for me.

Another thing that bugged me was when I go into Start/My Computer and
right-click on C:\ the first two items in the list are gobbledy-gook
characters.


My intention then for trying a system restore was not to outsmart
malware, but to get back my system files as outlined above to their
previous state.
Just before I was about to do the restore though, I thought about the
possibility of restoring some viruses, unintentionally.

 

[Bill in Co.]

Thanks Colin. I'm not intending to do a system restore to deal with
malware.

Just for clarification.
I was pretty satisfied with the results of the virus cleanup by AVG.

I did notice a couple of things though that bugged me.
When I go into Start/My Computer and double-click on C:\, D:\ or E:\,
I get "C:\ access denied" or "D:\ access denied" or "E:\ access
denied".

This never happened before and is unacceptable.
I searched for a fix on Google and there were dozens of references to
this problem but nothing appeared that would fix it for me.

Another thing that bugged me was when I go into Start/My Computer and
right-click on C:\ the first two items in the list are gobbledy-gook
characters.


My intention then for trying a system restore was not to outsmart
malware, but to get back my system files as outlined above to their
previous state.
Just before I was about to do the restore though, I thought about the
possibility of restoring some viruses, unintentionally.

Yup - and that may happen. But even if it did, you could hopefully rerun
the antivirus program and clean it up.

 

[Gerry]

Try this.

How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/kb/308421

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[google3luo359]

Yup - and that may happen. But even if it did, you could hopefully rerun
the antivirus program and clean it up.

Thanks Bill.

 

[google3luo359]

Try this.

How to take ownership of a file or folder in Windows XPhttp://support.microsoft.com/kb/308421

Thanks Gerry.

I'm using WinXP Media Center Edition Build 2600.xpsp_sp2

I went to the site you mentioned (before too).
It states:

"If you are using Windows XP Professional, you must disable Simple
File Sharing. By default, Windows XP Professional uses Simple File
sharing when it is not joined to a domain."

I disabled File Sharing.

Then it states:

To take ownership of a folder, follow these steps:
1. Right-click the folder that you want to take ownership of, and then
click Properties.
2. Click the Security tab, and then click OK on the Security message
(if one appears).
3. Click Advanced, and then click the Owner tab.

There is NO Security tab when I Right-click the 'folder' (C:\).
Hence I can't go any further.

I logged in in Safe Mode and still couldn't see a Security tab.
I actually lost one of the four tabs (Sharing) when I did this.

Any other ideas I could try.

BTW, despite not being able to access the drive when I double-click on
a drive, if I type the drive into the address bar at the top, I can
have full access to the files!!!