Why isn't system restore reccomended as a first step in the malware removal guide?

Re: Why isn't system restore reccomended as a first step in the malware removal guide

We actually say not to toggle system restore until after we are sure the user is clean, not before, as it may be an only hope of survival if something happens during the removal procedures! :major

If you read many of the threads here, you will find that it is quite common for a user to not be able to get into system restore! Some are, and we then must still have scans run to make sure there was no malware in that restore point.

 

Re: Why isn't system restore reccomended as a first step in the malware removal guide

It doesn't pose any risk. What I was indicating is that very many viruses will stop the use of system restore.

So, if one can do that, and then run scans to make sure no malware is in that restore point, they should be in good shape. Read some of our logs and you will see that quite often, the scans find malware in system restore folders. That is why we still need to check logs even when a restore has been done. :major

 

Re: Why isn't system restore reccomended as a first step in the malware removal guide

You are most welcome. Safe surfing.

 

Re: Why isn't system restore reccomended as a first step in the malware removal guide

As TimW stated, in many modern day malware infections, System Restore has been disabled and so has safe boot mode, however, your below comment is not a good thing to do.

The danger in this can be two fold.

1. You are basically uninstalling every single program, update, and setting that the user has made after the date of this restore point. If you did this on any of my systems, I would not be very happy with you since so much would be lost and would require reinstallation, updating and retweaking. The oldest system restore point could be bare bones Win XP and the user could already have XP SP3.
2. You could be restoring a Restore Point with even more problems then you currently have and it could potentially even render the PC unbootable.

Most security companies foolishly want you to actually disable System Restore immediately when there is an infection. We take a different and much better/more secure approach, to keeping restore points until active malware is around. See step 4 of Windows XP Cleaning Procedure for our comments.

 

Re: Why isn't system restore reccomended as a first step in the malware removal guide

In some ways, what you are doing is only a few steps away from just doing a complete Reformat and Re-installation, in that ( depending upon how far you roll it back ) they are losing possibly irretrievable data and/or files. So unless doing a restore is the absolute only thing you can do ( which 99% it isn't), you are better off removing the malware first, doing your program updates and then removing all restore points once you are sure the system is clean. That way, your customer is not risking losing any personal data or files from an old restore point. Just my 2 cents worth.:major


( Which is just rewording what Chaslang already stated. )

 

Re: Why isn't system restore reccomended as a first step in the malware removal guide

Stay at it long enough and you will.