xp pro System Restore

[Guest]

I have had a few problems lately,and am trying to do a system restore to an earlier point in time. Going through the normal xp restore procedure does'nt work ,it seems to go through the motions but does not accept the restore.Is there any other method available? I got notice that I had the trogan horse "downloader Keenval.e" I think I got rid of it I think but that could be the reason I cannot restore. Any help would be appreciated greatly..Thanks. Ian

 

[Will Denny]

Hi

Was the trojan in the System Volume Information folder? If so:

To delete the virus - although all existing checkpoints will be erased as
well:

Right click My Computer, select Properties and then the System Restore tab.
Enable 'Turn off System Restore on all drives' and reboot your PC. After
that 1st reboot go back into SR and disable 'Turn off System Restore on all
drives' and reboot your PC again. After that 2nd reboot you should have one
new SR checkpoint and the virus would have deleted.

--

Will Denny
MS-MVP Windows - Shell/User


| I have had a few problems lately,and am trying to do a system restore to
an earlier point in time. Going through the normal xp restore procedure
does'nt work ,it seems to go through the motions but does not accept the
restore.Is there any other method available? I got notice that I had the
trogan horse "downloader Keenval.e" I think I got rid of it I think but that
could be the reason I cannot restore. Any help would be appreciated
greatly..Thanks. Ian

 

[Alex Nichol]

To delete the virus - although all existing checkpoints will be erased as
well:

Right click My Computer, select Properties and then the System Restore tab.
Enable 'Turn off System Restore on all drives' and reboot your PC. After
that 1st reboot go back into SR and disable 'Turn off System Restore on all
drives' and reboot your PC again. After that 2nd reboot you should have one
new SR checkpoint and the virus would have deleted.

Or - I think better in some ways - wait for a new clean restore point to
have been made, then go to
Start - All Programs - Accessories - System Tools - Disk Cleanup
and in the 'More Options' click the button to Delete all but the most
recent restore point. The old points - and the virus - will go.

 

[Will Denny]

| Will Denny wrote:
|
| >To delete the virus - although all existing checkpoints will be erased as
| >well:
| >
| >Right click My Computer, select Properties and then the System Restore
tab.
| >Enable 'Turn off System Restore on all drives' and reboot your PC. After
| >that 1st reboot go back into SR and disable 'Turn off System Restore on
all
| >drives' and reboot your PC again. After that 2nd reboot you should have
one
| >new SR checkpoint and the virus would have deleted.
|
| Or - I think better in some ways - wait for a new clean restore point to
| have been made, then go to
| Start - All Programs - Accessories - System Tools - Disk Cleanup
| and in the 'More Options' click the button to Delete all but the most
| recent restore point. The old points - and the virus - will go.

Hi Alex

What if the virus/corrupted file is in the last checkpoint? The same error
message/problem will occur. I'm not sure what is 'so good' about the last
checkpoint. A virus is a virus... and should be completely erased from the
SIV folder - IMHO of course!

 

[Alex Nichol]

Hi Alex

What if the virus/corrupted file is in the last checkpoint? The same error
message/problem will occur. I'm not sure what is 'so good' about the last
checkpoint. A virus is a virus... and should be completely erased from the
SIV folder - IMHO of course!

That's why, after cleaning, you wait for a new clean point to be made
(or make it manually). But I get scared of butterfingers attempts in
disabling and re enabling SR

 

[Will Denny]

| Will Denny wrote:
|
| >Hi Alex
| >
| >What if the virus/corrupted file is in the last checkpoint? The same
error
| >message/problem will occur. I'm not sure what is 'so good' about the
last
| >checkpoint. A virus is a virus... and should be completely erased from
the
| >SIV folder - IMHO of course!
|
| That's why, after cleaning, you wait for a new clean point to be made
| (or make it manually). But I get scared of butterfingers attempts in
| disabling and re enabling SR
|
|
| --
| Alex Nichol MS MVP (Windows Technologies)
| Bournemouth, U.K. (e-mail address removed)8E8L.org (remove the D8 bit)

Hi Alex

I'm still not convinced that the virus will *definitely* be deleted if the
last checkpoint is still left. Unless, of course, it is known exactly where
in the SIV folder the virus is located. A manual look may determine that.