system restore and stinger

[Ron]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

helping someone with a Dell P4 with WIN XP Home Ed. ran Stinger virus
tool and it said some viruses in Restore files. According to
instructions on McAfee Stinger site it says to disable system restore in
WIN ME/XP then run Stinger and then re enable System Restore when
done. Sounds logical. But when you go to Disable System Restore it says
all existing restore points will be lost. McAfee site instructions
doesn't mention this. Is this really what will happen and should we
proceed given that warning?

 

[Guest]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

One cannot selectively delete restore points. When you
turn-off System Restore, all restore points will be deleted.
This is the only way to remove any virus files that have
infected System Restore files.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

------------------------------------------------------------------------------------------

"ron" <merrittr@a-znet.com> wrote in message:
news:40C85B9C.70DFEEE3@a-znet.com...

| helping someone with a Dell P4 with WIN XP Home Ed. ran Stinger virus
| tool and it said some viruses in Restore files. According to
| instructions on McAfee Stinger site it says to disable system restore in
| WIN ME/XP then run Stinger and then re enable System Restore when
| done. Sounds logical. But when you go to Disable System Restore it says
| all existing restore points will be lost. McAfee site instructions
| doesn't mention this. Is this really what will happen and should we
| proceed given that warning?
|
|
|
|
|

 

[Guest]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

On Thu, 10 Jun 2004 09:01:16 -0400, ron wrote:

> helping someone with a Dell P4 with WIN XP Home Ed. ran Stinger virus
> tool and it said some viruses in Restore files. According to
> instructions on McAfee Stinger site it says to disable system restore in
> WIN ME/XP then run Stinger and then re enable System Restore when
> done. Sounds logical. But when you go to Disable System Restore it says
> all existing restore points will be lost. McAfee site instructions
> doesn't mention this. Is this really what will happen and should we
> proceed given that warning?

If the virus is hiding in System Restore, it's impossible to know which
restore point is holding on to it. It's impossible to remove just one
restore point from the bunch. Dumping the restore points, dumps the virus.
Re-enable System Restore afterwards to start creating new restore points.

A half-step measure would be using Disk Cleanup> More Options to delete all
but the most recent restore point. XP will then adjust this store that all
the data needed for that one restore point is available.

Then check for the virus. If the restore points come up clean, you have at
least one restore point reflecting current configuration on hand. Not much
of an improvement compared to starting over on the restore points but it's
another method available to you.

However if a virus is found in that one remaining restore point, you'll
need to disable/re-enable System Restore as originally suggested by the
McAfee instructions.

--
Sharon F
MS-MVP ~ Windows XP Shell/User

 

[Guest]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

If you don't know which restore point contains the virus ( and there is no
way to know) then all restore points must be considered dangerous and should
be purged.

--

Harry Ohrn MS-MVP [Shell/User]
www.webtree.ca/windowsxp


"ron" <merrittr@a-znet.com> wrote in message
news:40C85B9C.70DFEEE3@a-znet.com...
> helping someone with a Dell P4 with WIN XP Home Ed. ran Stinger virus
> tool and it said some viruses in Restore files. According to
> instructions on McAfee Stinger site it says to disable system restore in
> WIN ME/XP then run Stinger and then re enable System Restore when
> done. Sounds logical. But when you go to Disable System Restore it says
> all existing restore points will be lost. McAfee site instructions
> doesn't mention this. Is this really what will happen and should we
> proceed given that warning?
>
>
>
>
>

 

[Ron]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

Sharon F wrote:

> On Thu, 10 Jun 2004 09:01:16 -0400, ron wrote:
>
> > helping someone with a Dell P4 with WIN XP Home Ed. ran Stinger virus
> > tool and it said some viruses in Restore files. According to
> > instructions on McAfee Stinger site it says to disable system restore in
> > WIN ME/XP then run Stinger and then re enable System Restore when
> > done. Sounds logical. But when you go to Disable System Restore it says
> > all existing restore points will be lost. McAfee site instructions
> > doesn't mention this. Is this really what will happen and should we
> > proceed given that warning?
>
> If the virus is hiding in System Restore, it's impossible to know which
> restore point is holding on to it. It's impossible to remove just one
> restore point from the bunch. Dumping the restore points, dumps the virus.
> Re-enable System Restore afterwards to start creating new restore points.
>
> A half-step measure would be using Disk Cleanup> More Options to delete all
> but the most recent restore point. XP will then adjust this store that all
> the data needed for that one restore point is available.
>
> Then check for the virus. If the restore points come up clean, you have at
> least one restore point reflecting current configuration on hand. Not much
> of an improvement compared to starting over on the restore points but it's
> another method available to you.
>
> However if a virus is found in that one remaining restore point, you'll
> need to disable/re-enable System Restore as originally suggested by the
> McAfee instructions.
>
> --
> Sharon F
> MS-MVP ~ Windows XP Shell/User

Thanks for the information. just wanted to make sure we weren't losing any
thing we didn't have to. Would be nice if the Stinger site would make that
point known in their write up of the XP/ME instructions

Ron.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

On Fri, 11 Jun 2004 06:19:33 -0400, ron wrote:

> Thanks for the information. just wanted to make sure we weren't losing any
> thing we didn't have to. Would be nice if the Stinger site would make that
> point known in their write up of the XP/ME instructions

You're welcome, Ron and good luck with this.

--
Sharon F
MS-MVP ~ Windows XP Shell/User