system restore won't work

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi, My problem is:
I somehow managed to download (unintentionally) a porn site, it keeps
changing my home page, puts icons on my desktop, uninstalls my toolbar and
replaces it with a search bar that I did not download, I have uninstalled
every program that looks unfamiliar. I have run my virus scan, it seems OK
now since I deleted a few bad files, and Adaware, everytime I open IE
Adaware finds more spyware. I try to system restore, but, it won't let me do
it. Help! Thanks
10 answers Last reply
More about system restore work
  1. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi

    Please try these programs as well to check for any spyware that
    might be on your system:

    Spybot - http://www.safer-networking.or­g/
    CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
    Spy Sweeper - www.webroot.com
    Try SpyWareBlaster to stop intrusions:

    http://www.javacoolsoftware.co­m/spywareblaster.html

    Also see the following links:

    http://aumha.org/a/parasite.ht­m
    http://mvps.org/winhelp2002/un­wanted.htm

    --


    Will Denny
    MS MVP Windows Shell/User
    Please reply to the News Groups

    "maeve" <meathome@bigpond.net.au> wrote in message
    news:el0OUTWrFHA.3060@TK2MSFTNGP09.phx.gbl...
    > Hi, My problem is:
    > I somehow managed to download (unintentionally) a porn site, it keeps
    > changing my home page, puts icons on my desktop, uninstalls my toolbar and
    > replaces it with a search bar that I did not download, I have uninstalled
    > every program that looks unfamiliar. I have run my virus scan, it seems
    > OK now since I deleted a few bad files, and Adaware, everytime I open IE
    > Adaware finds more spyware. I try to system restore, but, it won't let me
    > do it. Help! Thanks
    >
  2. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    I would reformat the drive and reinstall the operating system.

    "maeve" wrote:

    > Hi, My problem is:
    > I somehow managed to download (unintentionally) a porn site, it keeps
    > changing my home page, puts icons on my desktop, uninstalls my toolbar and
    > replaces it with a search bar that I did not download, I have uninstalled
    > every program that looks unfamiliar. I have run my virus scan, it seems OK
    > now since I deleted a few bad files, and Adaware, everytime I open IE
    > Adaware finds more spyware. I try to system restore, but, it won't let me do
    > it. Help! Thanks
    >
    >
    >
  3. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    You also should turn system restore off until you rid your pc of the
    infection. The file/s that have embedded themselves into your pc that
    contain the porn site info are also kept in restore points, so if you
    restore your pc to the point that contains those registry entries, you will
    be restoring the infection.

    "maeve" <meathome@bigpond.net.au> wrote in message
    news:el0OUTWrFHA.3060@TK2MSFTNGP09.phx.gbl...
    > Hi, My problem is:
    > I somehow managed to download (unintentionally) a porn site, it keeps
    > changing my home page, puts icons on my desktop, uninstalls my toolbar and
    > replaces it with a search bar that I did not download, I have uninstalled
    > every program that looks unfamiliar. I have run my virus scan, it seems
    > OK now since I deleted a few bad files, and Adaware, everytime I open IE
    > Adaware finds more spyware. I try to system restore, but, it won't let me
    > do it. Help! Thanks
    >
  4. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Please follow Wills advise and remove the installed malware before touching System
    Restore.

    Disabling System Restore and formatting at this point is bad advise.

    Virus and Spyware removal and prevention.
    http://bertk.mvps.org/html/spyware.html

    --
    Regards,
    Bert Kinney MS-MVP Shell/User
    http://bertk.mvps.org


    maeve wrote:
    > Hi, My problem is:
    > I somehow managed to download (unintentionally) a porn
    > site, it keeps changing my home page, puts icons on my
    > desktop, uninstalls my toolbar and replaces it with a
    > search bar that I did not download, I have uninstalled
    > every program that looks unfamiliar. I have run my virus
    > scan, it seems OK now since I deleted a few bad files,
    > and Adaware, everytime I open IE Adaware finds more
    > spyware. I try to system restore, but, it won't let me do
    > it. Help! Thanks
  5. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    "" wrote:
    > Hi, My problem is:
    > I somehow managed to download (unintentionally) a porn site,
    > it keeps
    > changing my home page, puts icons on my desktop, uninstalls my
    > toolbar and
    > replaces it with a search bar that I did not download, I have
    > uninstalled
    > every program that looks unfamiliar. I have run my virus
    > scan, it seems OK
    > now since I deleted a few bad files, and Adaware, everytime I
    > open IE
    > Adaware finds more spyware. I try to system restore, but, it
    > won't let me do
    > it. Help! Thanks

    I’m with Bert.. Will’s advice is good. Reformatting is just WAY
    over kill and not necessary. If you turn off system restore then you
    just removed your ’plan B’ .. old system restore points made
    BEFORE the infection wont carry any remnant of the infection... so if
    using the suggested utilities doesn’t 100% do the job, as long as he
    does a restore to a point before the infection, he’ll be fine.

    This is what I would do:

    Download Spybot and cwshredder and maybe even AdAware SE and install
    them ... don’t run them yet (well, maybe update them, but hold off
    on the scanning).

    Go to Add/Remove Programs and see if there are any obviously installed
    programs you don’t want (like Gator, or search bar, or something
    along those lines).. just because doing as clean an uninstall as you
    can is better than the hack-out job these programs do.
    * If youve never used Add/Remove programs before and aren’t familiar
    with what SHOULD be installed, then maybe you should skip this step.
    I just think it’s always good to at least take a look here first in
    the case you might see something.
    Next, run the scans and fix it all ....

    you might even have to say ’Yes’ and have one of them re-scan
    after a reboot (if it couldn’t get every last bit right then)

    Now, after doing the scans, why not do a system restore anyway ...
    Just pick the most recent date you can think of that was BEFORE you
    "inadvertently" infected yourself. .. i fyou don’t do it before,
    then you WILL restore the baddie and this whole process is a waste.

    Now that you have completed the restore... NOW turn off your system
    restore.... reboot ... noe re-install AT LEAST Spybot (the restore
    would have wiped it out), doi it’s updates, and re-scan... you’ll
    find all those "baddies" you never knew were there...

    After this last scan, I say reboot a final time, then turn system
    restore back on .. and create a restore point! (name it something
    you’ll remember)

    Now, if anything like this ever happens again, you’ll aLWAYS HAVE
    THIS CLEAN RESTORE POINT TO FALL BACK ON.

    It’s good to have an Ace in your pocket ... and it’s good to be
    prepared.

    This is probably way overkill ... but I like to be thorough...

    Good luck!

    --
    Posted using the http://www.windowsforumz.com interface, at author's request
    Articles individually checked for conformance to usenet standards
    Topic URL: http://www.windowsforumz.com/Help---Support-system-restore-work-ftopict415243.html
    Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1384292
  6. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    why is disabling S.R before scanning not recommended?

    "Bert Kinney" <bert@NSmvps.org> wrote in message
    news:OVGayrYrFHA.1028@TK2MSFTNGP12.phx.gbl...
    > Please follow Wills advise and remove the installed malware before
    > touching System Restore.
    >
    > Disabling System Restore and formatting at this point is bad advise.
    >
    > Virus and Spyware removal and prevention.
    > http://bertk.mvps.org/html/spyware.html
    >
    > --
    > Regards,
    > Bert Kinney MS-MVP Shell/User
    > http://bertk.mvps.org
    >
    >
    > maeve wrote:
    >> Hi, My problem is:
    >> I somehow managed to download (unintentionally) a porn
    >> site, it keeps changing my home page, puts icons on my
    >> desktop, uninstalls my toolbar and replaces it with a
    >> search bar that I did not download, I have uninstalled
    >> every program that looks unfamiliar. I have run my virus
    >> scan, it seems OK now since I deleted a few bad files,
    >> and Adaware, everytime I open IE Adaware finds more
    >> spyware. I try to system restore, but, it won't let me do
    >> it. Help! Thanks
    >
    >
  7. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    "lvee" <notmesothere@msn.com> wrote:

    >You also should turn system restore off until you rid your pc of the
    >infection. The file/s that have embedded themselves into your pc that
    >contain the porn site info are also kept in restore points, so if you
    >restore your pc to the point that contains those registry entries, you will
    >be restoring the infection.
    >

    Beg to differ with you on this item.

    System Restore should not be turned off until *after* the malware has
    been cleaned up. Better to restore the system to an infected state
    than to have it rendered unusable and unrestorable because of a
    botched cleanup.

    When the malware cleanup is finished then System Restore should be
    disabled and restarted; or purged. A slightly safer way of doing this
    is to:
    1. Create a new restore point immediately after the cleanup is
    finished.
    2. Use Disk Cleanup's advanced options to remove all but the most
    recent restore point.

    Ron Martell Duncan B.C. Canada
    --
    Microsoft MVP
    On-Line Help Computer Service
    http://onlinehelp.bc.ca

    In memory of a dear friend Alex Nichol MVP
    http://aumha.org/alex.htm
  8. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi lvee,

    If something goes wrong in the virus/malware removal process you will have no way to
    reverse your actions. Sometimes the removal process can be more damaging to the system
    than the infection. Two examples would be if the system became unbootable, or if the
    ability to connect to the internet to retrieve additional cleaning utilities is lost. So
    it is a good practice to leave System Restore intact until the cleaning process is over.
    Just don't forget to clean out SR after cleaning is complete.

    Note: Virus infection detected within restore points will not re-infected a system unless
    the system is restored using System Restore.

    --
    Regards,
    Bert Kinney MS-MVP Shell/User
    http://bertk.mvps.org


    lvee wrote:
    > why is disabling S.R before scanning not recommended?
    >
    > "Bert Kinney" <bert@NSmvps.org> wrote in message
    > news:OVGayrYrFHA.1028@TK2MSFTNGP12.phx.gbl...
    >> Please follow Wills advise and remove the installed
    >> malware before touching System Restore.
    >>
    >> Disabling System Restore and formatting at this point is
    >> bad advise. Virus and Spyware removal and prevention.
    >> http://bertk.mvps.org/html/spyware.html
    >>
    >> --
    >> Regards,
    >> Bert Kinney MS-MVP Shell/User
    >> http://bertk.mvps.org
    >>
    >>
    >> maeve wrote:
    >>> Hi, My problem is:
    >>> I somehow managed to download (unintentionally) a porn
    >>> site, it keeps changing my home page, puts icons on my
    >>> desktop, uninstalls my toolbar and replaces it with a
    >>> search bar that I did not download, I have uninstalled
    >>> every program that looks unfamiliar. I have run my
    >>> virus scan, it seems OK now since I deleted a few bad
    >>> files, and Adaware, everytime I open IE Adaware finds
    >>> more spyware. I try to system restore, but, it won't
    >>> let me do it. Help! Thanks
  9. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi, Thanks for all this advise. The problem is now fixed. I installed
    spybot, and where Adaware and Trend Micro didn't destroy the spyware, Spybot
    did! I was so grateful as I didn't have to call my son to fix my problem
    which is very degrading sometimes. Thanks again, didn't need to use system
    restore!

    "strock" <UseLinkToEmail@WindowsForumz.com> wrote in message
    news:3_1384292_dd4ca8c8ce268d28f82a1d8562e1e591@windowsforumz.com...
    > "" wrote:
    > > Hi, My problem is:
    > > I somehow managed to download (unintentionally) a porn site,
    > > it keeps
    > > changing my home page, puts icons on my desktop, uninstalls my
    > > toolbar and
    > > replaces it with a search bar that I did not download, I have
    > > uninstalled
    > > every program that looks unfamiliar. I have run my virus
    > > scan, it seems OK
    > > now since I deleted a few bad files, and Adaware, everytime I
    > > open IE
    > > Adaware finds more spyware. I try to system restore, but, it
    > > won't let me do
    > > it. Help! Thanks
    >
    > Iâ?Tm with Bert.. Willâ?Ts advice is good. Reformatting is just WAY
    > over kill and not necessary. If you turn off system restore then you
    > just removed your â?Tplan Bâ?T .. old system restore points made
    > BEFORE the infection wont carry any remnant of the infection... so if
    > using the suggested utilities doesnâ?Tt 100% do the job, as long as he
    > does a restore to a point before the infection, heâ?Tll be fine.
    >
    > This is what I would do:
    >
    > Download Spybot and cwshredder and maybe even AdAware SE and install
    > them ... donâ?Tt run them yet (well, maybe update them, but hold off
    > on the scanning).
    >
    > Go to Add/Remove Programs and see if there are any obviously installed
    > programs you donâ?Tt want (like Gator, or search bar, or something
    > along those lines).. just because doing as clean an uninstall as you
    > can is better than the hack-out job these programs do.
    > * If youve never used Add/Remove programs before and arenâ?Tt familiar
    > with what SHOULD be installed, then maybe you should skip this step.
    > I just think itâ?Ts always good to at least take a look here first in
    > the case you might see something.
    > Next, run the scans and fix it all ....
    >
    > you might even have to say â?TYesâ?T and have one of them re-scan
    > after a reboot (if it couldnâ?Tt get every last bit right then)
    >
    > Now, after doing the scans, why not do a system restore anyway ...
    > Just pick the most recent date you can think of that was BEFORE you
    > "inadvertently" infected yourself. .. i fyou donâ?Tt do it before,
    > then you WILL restore the baddie and this whole process is a waste.
    >
    > Now that you have completed the restore... NOW turn off your system
    > restore.... reboot ... noe re-install AT LEAST Spybot (the restore
    > would have wiped it out), doi itâ?Ts updates, and re-scan... youâ?Tll
    > find all those "baddies" you never knew were there...
    >
    > After this last scan, I say reboot a final time, then turn system
    > restore back on .. and create a restore point! (name it something
    > youâ?Tll remember)
    >
    > Now, if anything like this ever happens again, youâ?Tll aLWAYS HAVE
    > THIS CLEAN RESTORE POINT TO FALL BACK ON.
    >
    > Itâ?Ts good to have an Ace in your pocket ... and itâ?Ts good to be
    > prepared.
    >
    > This is probably way overkill ... but I like to be thorough...
    >
    > Good luck!
    >
    > --
    > Posted using the http://www.windowsforumz.com interface, at author's
    > request
    > Articles individually checked for conformance to usenet standards
    > Topic URL:
    > http://www.windowsforumz.com/Help---Support-system-restore-work-ftopict415243.html
    > Visit Topic URL to contact author (reg. req'd). Report abuse:
    > http://www.windowsforumz.com/eform.php?p=1384292
  10. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Hi Ivee,

    lvee wrote:
    > Thanks, Bert, for the detailed answer. I never
    > considered it that way until your post. I do, however,
    > understand that S.R. will only re-infect if you restore
    > to the point that contains the infection, and I think I
    > may have mentioned that..too lazy to read my own post, :)
    > I have always thought it best to disable S.R. simply
    > because it may be difficult to determine where the
    > infected restore point is located, but I suppose if you
    > go back far enough you'd be okay, but then again, if you
    > went back too far you'd risk removing updates, etc. Which, I guess would not be such a
    > big deal as you can
    > always install them again.

    If restore points contain infected files, then they should be purged after cleaning is
    complete.

    Going back more than a week or so in SR can cause more problems than is solves. Best
    practice is to have a good antivirus application installed and kept up to date daily.

    > So, all in all, after reading your post and considering
    > all your points, I guess I'd have to agree that yours is
    > the better way...thanks, for teaching an old dog
    > something new.

    Your very welcome.
    >
    > "Bert Kinney" wrote
    >> Hi lvee,
    >>
    >> If something goes wrong in the virus/malware removal
    >> process you will have no way to reverse your actions.
    >> Sometimes the removal process can be more damaging to
    >> the system than the infection. Two examples would be if
    >> the system became unbootable, or if the ability to
    >> connect to the internet to retrieve additional cleaning
    >> utilities is lost. So it is a good practice to leave
    >> System Restore intact until the cleaning process is
    >> over. Just don't forget to clean out SR after cleaning is complete. Note: Virus
    >> infection detected within restore points
    >> will not re-infected a system unless the system is
    >> restored using System Restore. --
    >> Regards,
    >> Bert Kinney MS-MVP Shell/User
    >> http://bertk.mvps.org
    >>
    >>
    >>
    >> lvee wrote:
    >>> why is disabling S.R before scanning not recommended?
    >>>
    >>> "Bert Kinney" wrote
    >>>> Please follow Wills advise and remove the installed
    >>>> malware before touching System Restore.
    >>>>
    >>>> Disabling System Restore and formatting at this point
    >>>> is bad advise. Virus and Spyware removal and
    >>>> prevention. http://bertk.mvps.org/html/spyware.html
    >>>>
    >>>> --
    >>>> Regards,
    >>>> Bert Kinney MS-MVP Shell/User
    >>>> http://bertk.mvps.org
Ask a new question

Read More

Download System Restore Windows XP