Help - Search - Members - Calendar
Full Version: System Restore ; Keep Enabled Or Not When Known To Be Infected?
BleepingComputer.com > Security > AntiVirus, Firewall and Privacy Products and Protection Methods
   
ruby1
what is the suggested practise on this forum
if you do have system restore enabled ,KEEP it running if you get infected ?
or disable system restore when there is an infection?

if system restore is NOT enabled and you get infected ,create a restore point ;

I ask this as I see on another thread it is mentioned that system restore is disabled as an infection is on the computer

as I understand it; it is far better to have an infected restore point to roll back to if necessary in the cleaning process than to have NO restore points at all?

what are this forum's suggestions ,views and opinions on this point please and the rationale for them

boopme
As I understand and I'll pass along the explanation. It's better to have the infected point available. Once cleaned then you eliminate and create anew.

Unfortunately, some anti-virus vendors recommend disabling System Restore before attempting malware removal so many folks still follow that advice. Turning System Restore off and then turning it back on has some risk associated with it since that feature does not always work as intended. Further, there is always a possibility of something going wrong during the malware removal process and you end up with more problems. Without a restore point to fall back on, you are then stuck with a limited means of restoring your system such as a Repair Install or Reformat. Although System Restore is not 100% guaranteed to work all the time, it at least gives you another option. When the system is clean, then the OP can create a new Restore Point and purge the old ones to prevent accidental re-infection.

See "System Restore and malware removal - what is best practice? ".

Also read Quietman7's reply today here (post #2)

http://www.bleepingcomputer.com/forums/topic117374.html
ruby1
thank you; I am therefore intruigued to know from which sourse
the comment on this thread
http://www.bleepingcomputer.com/forums/topic117206.html

that states in post number three


QUOTE
as per many suggestions I have seen on here, I have disabled system restore...


my personal view is that it far better to have an infected restore point to fall back on than none at all ; it the cleaning process goes awry, at least you HAVE SOMEWHERE to go back to ; with restore turned OFF you have ZILCH wacko.gif
quietman7
QUOTE
I am therefore intruigued to know from which sourse the comment on this thread

QUOTE
as per many suggestions I have seen on here, I have disabled system restore



Thats the way things were routinely done in the past. Unfortunately, some anti-virus vendors still recommend doing this before attempting malware removal and many folks follow that advice.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.