Sign in with
Sign up | Sign in
Your question

system restore won't work

Last response: in Windows XP
Share
Anonymous
August 31, 2005 3:15:09 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi, My problem is:
I somehow managed to download (unintentionally) a porn site, it keeps
changing my home page, puts icons on my desktop, uninstalls my toolbar and
replaces it with a search bar that I did not download, I have uninstalled
every program that looks unfamiliar. I have run my virus scan, it seems OK
now since I deleted a few bad files, and Adaware, everytime I open IE
Adaware finds more spyware. I try to system restore, but, it won't let me do
it. Help! Thanks

More about : system restore work

Anonymous
August 31, 2005 3:15:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi

Please try these programs as well to check for any spyware that
might be on your system:

Spybot - http://www.safer-networking.or­g/
CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
Spy Sweeper - www.webroot.com
Try SpyWareBlaster to stop intrusions:

http://www.javacoolsoftware.co­m/spywareblaster.html

Also see the following links:

http://aumha.org/a/parasite.ht­m
http://mvps.org/winhelp2002/un­wanted.htm

--


Will Denny
MS MVP Windows Shell/User
Please reply to the News Groups

"maeve" <meathome@bigpond.net.au> wrote in message
news:el0OUTWrFHA.3060@TK2MSFTNGP09.phx.gbl...
> Hi, My problem is:
> I somehow managed to download (unintentionally) a porn site, it keeps
> changing my home page, puts icons on my desktop, uninstalls my toolbar and
> replaces it with a search bar that I did not download, I have uninstalled
> every program that looks unfamiliar. I have run my virus scan, it seems
> OK now since I deleted a few bad files, and Adaware, everytime I open IE
> Adaware finds more spyware. I try to system restore, but, it won't let me
> do it. Help! Thanks
>
Anonymous
August 31, 2005 3:15:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I would reformat the drive and reinstall the operating system.

"maeve" wrote:

> Hi, My problem is:
> I somehow managed to download (unintentionally) a porn site, it keeps
> changing my home page, puts icons on my desktop, uninstalls my toolbar and
> replaces it with a search bar that I did not download, I have uninstalled
> every program that looks unfamiliar. I have run my virus scan, it seems OK
> now since I deleted a few bad files, and Adaware, everytime I open IE
> Adaware finds more spyware. I try to system restore, but, it won't let me do
> it. Help! Thanks
>
>
>
Related resources
Anonymous
August 31, 2005 3:15:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

You also should turn system restore off until you rid your pc of the
infection. The file/s that have embedded themselves into your pc that
contain the porn site info are also kept in restore points, so if you
restore your pc to the point that contains those registry entries, you will
be restoring the infection.

"maeve" <meathome@bigpond.net.au> wrote in message
news:el0OUTWrFHA.3060@TK2MSFTNGP09.phx.gbl...
> Hi, My problem is:
> I somehow managed to download (unintentionally) a porn site, it keeps
> changing my home page, puts icons on my desktop, uninstalls my toolbar and
> replaces it with a search bar that I did not download, I have uninstalled
> every program that looks unfamiliar. I have run my virus scan, it seems
> OK now since I deleted a few bad files, and Adaware, everytime I open IE
> Adaware finds more spyware. I try to system restore, but, it won't let me
> do it. Help! Thanks
>
Anonymous
August 31, 2005 3:15:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Please follow Wills advise and remove the installed malware before touching System
Restore.

Disabling System Restore and formatting at this point is bad advise.

Virus and Spyware removal and prevention.
http://bertk.mvps.org/html/spyware.html

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org


maeve wrote:
> Hi, My problem is:
> I somehow managed to download (unintentionally) a porn
> site, it keeps changing my home page, puts icons on my
> desktop, uninstalls my toolbar and replaces it with a
> search bar that I did not download, I have uninstalled
> every program that looks unfamiliar. I have run my virus
> scan, it seems OK now since I deleted a few bad files,
> and Adaware, everytime I open IE Adaware finds more
> spyware. I try to system restore, but, it won't let me do
> it. Help! Thanks
Anonymous
August 31, 2005 3:15:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

"" wrote:
> Hi, My problem is:
> I somehow managed to download (unintentionally) a porn site,
> it keeps
> changing my home page, puts icons on my desktop, uninstalls my
> toolbar and
> replaces it with a search bar that I did not download, I have
> uninstalled
> every program that looks unfamiliar. I have run my virus
> scan, it seems OK
> now since I deleted a few bad files, and Adaware, everytime I
> open IE
> Adaware finds more spyware. I try to system restore, but, it
> won't let me do
> it. Help! Thanks

I’m with Bert.. Will’s advice is good. Reformatting is just WAY
over kill and not necessary. If you turn off system restore then you
just removed your ’plan B’ .. old system restore points made
BEFORE the infection wont carry any remnant of the infection... so if
using the suggested utilities doesn’t 100% do the job, as long as he
does a restore to a point before the infection, he’ll be fine.

This is what I would do:

Download Spybot and cwshredder and maybe even AdAware SE and install
them ... don’t run them yet (well, maybe update them, but hold off
on the scanning).

Go to Add/Remove Programs and see if there are any obviously installed
programs you don’t want (like Gator, or search bar, or something
along those lines).. just because doing as clean an uninstall as you
can is better than the hack-out job these programs do.
* If youve never used Add/Remove programs before and aren’t familiar
with what SHOULD be installed, then maybe you should skip this step.
I just think it’s always good to at least take a look here first in
the case you might see something.
Next, run the scans and fix it all ....

you might even have to say ’Yes’ and have one of them re-scan
after a reboot (if it couldn’t get every last bit right then)

Now, after doing the scans, why not do a system restore anyway ...
Just pick the most recent date you can think of that was BEFORE you
"inadvertently" infected yourself. .. i fyou don’t do it before,
then you WILL restore the baddie and this whole process is a waste.

Now that you have completed the restore... NOW turn off your system
restore.... reboot ... noe re-install AT LEAST Spybot (the restore
would have wiped it out), doi it’s updates, and re-scan... you’ll
find all those "baddies" you never knew were there...

After this last scan, I say reboot a final time, then turn system
restore back on .. and create a restore point! (name it something
you’ll remember)

Now, if anything like this ever happens again, you’ll aLWAYS HAVE
THIS CLEAN RESTORE POINT TO FALL BACK ON.

It’s good to have an Ace in your pocket ... and it’s good to be
prepared.

This is probably way overkill ... but I like to be thorough...

Good luck!

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Help---Support-system-rest...
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1384292
Anonymous
August 31, 2005 3:15:11 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

why is disabling S.R before scanning not recommended?

"Bert Kinney" <bert@NSmvps.org> wrote in message
news:o VGayrYrFHA.1028@TK2MSFTNGP12.phx.gbl...
> Please follow Wills advise and remove the installed malware before
> touching System Restore.
>
> Disabling System Restore and formatting at this point is bad advise.
>
> Virus and Spyware removal and prevention.
> http://bertk.mvps.org/html/spyware.html
>
> --
> Regards,
> Bert Kinney MS-MVP Shell/User
> http://bertk.mvps.org
>
>
> maeve wrote:
>> Hi, My problem is:
>> I somehow managed to download (unintentionally) a porn
>> site, it keeps changing my home page, puts icons on my
>> desktop, uninstalls my toolbar and replaces it with a
>> search bar that I did not download, I have uninstalled
>> every program that looks unfamiliar. I have run my virus
>> scan, it seems OK now since I deleted a few bad files,
>> and Adaware, everytime I open IE Adaware finds more
>> spyware. I try to system restore, but, it won't let me do
>> it. Help! Thanks
>
>
Anonymous
August 31, 2005 3:15:11 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

"lvee" <notmesothere@msn.com> wrote:

>You also should turn system restore off until you rid your pc of the
>infection. The file/s that have embedded themselves into your pc that
>contain the porn site info are also kept in restore points, so if you
>restore your pc to the point that contains those registry entries, you will
>be restoring the infection.
>

Beg to differ with you on this item.

System Restore should not be turned off until *after* the malware has
been cleaned up. Better to restore the system to an infected state
than to have it rendered unusable and unrestorable because of a
botched cleanup.

When the malware cleanup is finished then System Restore should be
disabled and restarted; or purged. A slightly safer way of doing this
is to:
1. Create a new restore point immediately after the cleanup is
finished.
2. Use Disk Cleanup's advanced options to remove all but the most
recent restore point.

Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm
Anonymous
August 31, 2005 3:15:12 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi lvee,

If something goes wrong in the virus/malware removal process you will have no way to
reverse your actions. Sometimes the removal process can be more damaging to the system
than the infection. Two examples would be if the system became unbootable, or if the
ability to connect to the internet to retrieve additional cleaning utilities is lost. So
it is a good practice to leave System Restore intact until the cleaning process is over.
Just don't forget to clean out SR after cleaning is complete.

Note: Virus infection detected within restore points will not re-infected a system unless
the system is restored using System Restore.

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org



lvee wrote:
> why is disabling S.R before scanning not recommended?
>
> "Bert Kinney" <bert@NSmvps.org> wrote in message
> news:o VGayrYrFHA.1028@TK2MSFTNGP12.phx.gbl...
>> Please follow Wills advise and remove the installed
>> malware before touching System Restore.
>>
>> Disabling System Restore and formatting at this point is
>> bad advise. Virus and Spyware removal and prevention.
>> http://bertk.mvps.org/html/spyware.html
>>
>> --
>> Regards,
>> Bert Kinney MS-MVP Shell/User
>> http://bertk.mvps.org
>>
>>
>> maeve wrote:
>>> Hi, My problem is:
>>> I somehow managed to download (unintentionally) a porn
>>> site, it keeps changing my home page, puts icons on my
>>> desktop, uninstalls my toolbar and replaces it with a
>>> search bar that I did not download, I have uninstalled
>>> every program that looks unfamiliar. I have run my
>>> virus scan, it seems OK now since I deleted a few bad
>>> files, and Adaware, everytime I open IE Adaware finds
>>> more spyware. I try to system restore, but, it won't
>>> let me do it. Help! Thanks
Anonymous
September 1, 2005 12:11:58 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi, Thanks for all this advise. The problem is now fixed. I installed
spybot, and where Adaware and Trend Micro didn't destroy the spyware, Spybot
did! I was so grateful as I didn't have to call my son to fix my problem
which is very degrading sometimes. Thanks again, didn't need to use system
restore!

"strock" <UseLinkToEmail@WindowsForumz.com> wrote in message
news:3_1384292_dd4ca8c8ce268d28f82a1d8562e1e591@windowsforumz.com...
> "" wrote:
> > Hi, My problem is:
> > I somehow managed to download (unintentionally) a porn site,
> > it keeps
> > changing my home page, puts icons on my desktop, uninstalls my
> > toolbar and
> > replaces it with a search bar that I did not download, I have
> > uninstalled
> > every program that looks unfamiliar. I have run my virus
> > scan, it seems OK
> > now since I deleted a few bad files, and Adaware, everytime I
> > open IE
> > Adaware finds more spyware. I try to system restore, but, it
> > won't let me do
> > it. Help! Thanks
>
> Iâ?Tm with Bert.. Willâ?Ts advice is good. Reformatting is just WAY
> over kill and not necessary. If you turn off system restore then you
> just removed your â?Tplan Bâ?T .. old system restore points made
> BEFORE the infection wont carry any remnant of the infection... so if
> using the suggested utilities doesnâ?Tt 100% do the job, as long as he
> does a restore to a point before the infection, heâ?Tll be fine.
>
> This is what I would do:
>
> Download Spybot and cwshredder and maybe even AdAware SE and install
> them ... donâ?Tt run them yet (well, maybe update them, but hold off
> on the scanning).
>
> Go to Add/Remove Programs and see if there are any obviously installed
> programs you donâ?Tt want (like Gator, or search bar, or something
> along those lines).. just because doing as clean an uninstall as you
> can is better than the hack-out job these programs do.
> * If youve never used Add/Remove programs before and arenâ?Tt familiar
> with what SHOULD be installed, then maybe you should skip this step.
> I just think itâ?Ts always good to at least take a look here first in
> the case you might see something.
> Next, run the scans and fix it all ....
>
> you might even have to say â?TYesâ?T and have one of them re-scan
> after a reboot (if it couldnâ?Tt get every last bit right then)
>
> Now, after doing the scans, why not do a system restore anyway ...
> Just pick the most recent date you can think of that was BEFORE you
> "inadvertently" infected yourself. .. i fyou donâ?Tt do it before,
> then you WILL restore the baddie and this whole process is a waste.
>
> Now that you have completed the restore... NOW turn off your system
> restore.... reboot ... noe re-install AT LEAST Spybot (the restore
> would have wiped it out), doi itâ?Ts updates, and re-scan... youâ?Tll
> find all those "baddies" you never knew were there...
>
> After this last scan, I say reboot a final time, then turn system
> restore back on .. and create a restore point! (name it something
> youâ?Tll remember)
>
> Now, if anything like this ever happens again, youâ?Tll aLWAYS HAVE
> THIS CLEAN RESTORE POINT TO FALL BACK ON.
>
> Itâ?Ts good to have an Ace in your pocket ... and itâ?Ts good to be
> prepared.
>
> This is probably way overkill ... but I like to be thorough...
>
> Good luck!
>
> --
> Posted using the http://www.windowsforumz.com interface, at author's
> request
> Articles individually checked for conformance to usenet standards
> Topic URL:
> http://www.windowsforumz.com/Help---Support-system-rest...
> Visit Topic URL to contact author (reg. req'd). Report abuse:
> http://www.windowsforumz.com/eform.php?p=1384292
Anonymous
September 1, 2005 2:13:27 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Hi Ivee,

lvee wrote:
> Thanks, Bert, for the detailed answer. I never
> considered it that way until your post. I do, however,
> understand that S.R. will only re-infect if you restore
> to the point that contains the infection, and I think I
> may have mentioned that..too lazy to read my own post, :) 
> I have always thought it best to disable S.R. simply
> because it may be difficult to determine where the
> infected restore point is located, but I suppose if you
> go back far enough you'd be okay, but then again, if you
> went back too far you'd risk removing updates, etc. Which, I guess would not be such a
> big deal as you can
> always install them again.

If restore points contain infected files, then they should be purged after cleaning is
complete.

Going back more than a week or so in SR can cause more problems than is solves. Best
practice is to have a good antivirus application installed and kept up to date daily.

> So, all in all, after reading your post and considering
> all your points, I guess I'd have to agree that yours is
> the better way...thanks, for teaching an old dog
> something new.

Your very welcome.
>
> "Bert Kinney" wrote
>> Hi lvee,
>>
>> If something goes wrong in the virus/malware removal
>> process you will have no way to reverse your actions.
>> Sometimes the removal process can be more damaging to
>> the system than the infection. Two examples would be if
>> the system became unbootable, or if the ability to
>> connect to the internet to retrieve additional cleaning
>> utilities is lost. So it is a good practice to leave
>> System Restore intact until the cleaning process is
>> over. Just don't forget to clean out SR after cleaning is complete. Note: Virus
>> infection detected within restore points
>> will not re-infected a system unless the system is
>> restored using System Restore. --
>> Regards,
>> Bert Kinney MS-MVP Shell/User
>> http://bertk.mvps.org
>>
>>
>>
>> lvee wrote:
>>> why is disabling S.R before scanning not recommended?
>>>
>>> "Bert Kinney" wrote
>>>> Please follow Wills advise and remove the installed
>>>> malware before touching System Restore.
>>>>
>>>> Disabling System Restore and formatting at this point
>>>> is bad advise. Virus and Spyware removal and
>>>> prevention. http://bertk.mvps.org/html/spyware.html
>>>>
>>>> --
>>>> Regards,
>>>> Bert Kinney MS-MVP Shell/User
>>>> http://bertk.mvps.org
!