Note: I am not a trained or approved Malware fighter. In this reply, I am submitting information that I believe important to clarify points to avoid misunderstanding that may otherwise be conveyed in this Thread. I am not instructing anyone who has posted in this thread, or who is reading this thread, to follow particular steps or procedures relative to malware removal. This is information and policy only.
_______________
A big Thank You to TomK who is one of our highly respected Malware fighters. (for his comment above)
Tom's recent background is in teaching, which may explain the teaching question he posts to challenge the reader to work it out via their own thinking and research.
My role in the Forums and this Thread is that of Admin, so I tend toward recommendations, instruction, and policy.
__________________-
There was a time when in preparation for the process of Malware Removal, when clearing out temporary file it was popular to make a recommendation to delete old Restore Points, possibly on the theory that doing so was a more complete method of eliminating traces from the bad-guy. Happily, I cannot find any instance where such a practice was advocated by any site or training site associated with UNITE. In fact, just the opposite.
Unhappily, the places where I have found recommendations to delete Restore Points early on and before Malware Removal is complete, come from websites of some of the major antivirus publishers and their related question-answer or forum-like settings. * This is, in my opinion, misleading and wrong.
_______________________
At WTT Forums we do not advocate deletion of Restore Points, until after the Malware Removal process is absolutely complete.
That's the Policy.
Why?
In the process of utilizing advanced tools and techniques for removing Malware, it occasionally occurs that the malware had substituted for / over-written an essential Windows Operating System file or Registry Tag. If/when that infected file/tag is removed, the operating system may fail to function properly and may even fail to boot, leaving OP with a blank screen and dysfunctional machine. While it is theoretically possible to then utilize Recovery Console by booting from CD (a pre-windows environment) through which one can use command-line instruction to extract and replace missing Windows files and/or rebuild Registry Tag(s), such a circumstance may just as often leave OP with only the option of Format and Reinstall.
If a Restore Point still exists, however, the OP can fall back to that position from Advanced Boot Options (F8) (even if it is still an infected position when the Restore Point is activated) Thus with Restore Point(s) in place, the OP and helpers have an opportunity to move forward and "do-over" their procedures.
Please note: It is highly recommended that if you are about to launch an advanced procedure, Creating a New Restore Point is valuable. In fact, routine instances abound where creating a restore point prior to intended action is recommended, to wit: Installing a new Software, downloading and installing MS updates, making changes in the Registry(which should also include a full Registry Backup before making changes), scanning with onboard and/or online malware removal tools, before installing a questionable device driver. In fact, MS does include some automated routines to cause a Restore Point to be created in some of these situations.
______________________
About Restore Points…
System Restore is a Windows tool that allows for recording the exact registry and system configuration settings at a given time.
Restore Points are saved in System Volume Information folder and are not accessible to the user, even if logged in as Administrator.
Access is limited to the System account.
Thus, one can reasonably consider that System Restore Points are contained in something similar to Quarantine, and have no effect upon User Account logins of Windows, even if any restore point is infected. It is, while housed in _restore,….. dormant, harmless, quarantined.
If your mind wanders and is curious about exceptions to the above statement, and you think of: What if Windows is infected with an infection that has given itself System account access. Well, in that case, you need the assistance of a Malware Removal specialist anyway, because your machine is infected, regardless of what may be sitting dormant in a Restore Point.
________________________
About clearing Old Restore Points…
After you have completed your own procedures, or have completed the instructions of a Malware Removal Specialist, it is just fine (recommended) to create a fresh Restore Point that represents your now well-functioning machine's configuration.
Then you can use MS built in Disk Cleanup to Delete all but the most recent Restore Point.
In XP – Start - All Programs - Accessories - System Tools - Disk Cleanup - More Options(tab) - Remove all but the most recent Restore Point
______________________________________
For more about System Restore (particularly in XP) have a look at this excellent Tutorial:
http://www.bleepingcomputer.com/tutorials/tutorial56.html
For information about using System Restore:
http://forums.whatthetech.com/index.php?showtopic=95725
Prove me right!
