Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Restore Points


  • Please log in to reply
9 replies to this topic

#1 pdmike

pdmike

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:05:27 PM

Posted 08 June 2015 - 09:52 AM

You know - something bad gets into your computer.  One way to handle it is System Restore.  Just take it back to when everything was OK and, if you don't mind losing stuff you acquired between then and now, the bad guy is no longer there.  I have taken care of several browser hijacks and other assorted problems over the years using this method.

 

I am running Windows 7 and I have a question or two about System Restore.  I have learned recently that you can't just pick a date you want to go back to, enter it, and take your computer back to that date.  I had always thought you could do that.  Nope.  You only have so many restore dates to select from.

 

You can CREATE a restore date, but you have to do it ahead of time.  Just go into System Restore and set up the present date as a restore date.  Label it "All Good" or something to let you know it is a desirable restore date if you ever need it, and you're good to go.  Well, for a limited period of time.  And this is my question:

 

Restore points only "last" so long and then they are automatically deleted - at least that's the way it appears to me to be.  Is there some way to create a restore point that never gets deleted?  I realize as I write this that this is probably not something you would want to do, because the longer between the restore date and the system restore, the more stuff you will lose.  But still - I don't always remember to create a new restore point on a weekly basis, and it would be nice to be able to do it only once a month or so.

 

Anybody know anything about this?  Or have some comments in general about using System Restore as a quick workaround when bad stuff appears on your computer?


Edited by pdmike, 08 June 2015 - 09:54 AM.


BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:08:27 PM

Posted 08 June 2015 - 10:05 AM

Hi pdmike :)

Unfortunately from what I know (and what I read), it's not possible to create a "permanent" restore point and save it in the System Restore feature. As soon as the storage space starts missing (the one accorded to the System Restore), it'll start deleting older restore points to make place for a new one. In that case, you should consider taking a System Image of your system instead, at a time where it was all clean and running properly.

Also, I never suggest to do a System Restore when you are infected with a malware, since these can be corrupted and you can end up in an infection way worse than the one you began with. I only suggest to do a System Restore during malware removal when there's just nothing that works and we cannot run any tools (but even there, you could try to fix the issue using FRST in the Recovery PE).

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 pdmike

pdmike
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:05:27 PM

Posted 08 June 2015 - 10:19 AM

Thank you, Aura.  Good advice.  I had always had some reservations about using System Restore to get rid of malware.  Your comments clear that up - from now on, I will always come here first and use System Restore only as a true, last resort.

 

Can you tell me a bit about System Image?  I would like to do a system image on both my computer and my wife's computer.  We are both running Windows 7.  I know that I can do it with Carbonite (we are subscribers and users - love it).  I think I can also do it using the Control Panel in Windows 7, right? 

 

Doing a system image requires a lot of space on the destination drive, right?  Don't you have to have an external hard drive to do this?  I do have one, but may need to get another one for my wife's computer.

 

What is a system image exactly? 

 

Anything you could help me with here would be much appreciated.


Edited by pdmike, 08 June 2015 - 10:20 AM.


#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:08:27 PM

Posted 08 June 2015 - 10:26 AM

For more information about a System Image, you can read the Microsoft Article below :)

http://windows.microsoft.com/en-us/windows7/what-is-a-system-image

To sum it up, a system image is an identical copy of the drive on which it was taken, and it can be restored on other drives to be used elsewhere. This is ideal when you have to reinstall Windows or you have a failing hard drive and want to replace it. It allows you to "copy/paste" in a certain way Windows quickly on the drive and be operational again. And depending of the size of the drive you take an image of, yes it takes a lot of space, and yes you should store it on an external storage device like a hard drive.

Macrium Reflect Free is a good free imaging software.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 pdmike

pdmike
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:05:27 PM

Posted 08 June 2015 - 12:05 PM

Thanks!  I will put your advice to use.



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:08:27 PM

Posted 08 June 2015 - 12:15 PM

No problem pdmike, you're welcome :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#7 rp88

rp88

  • Members
  • 3,060 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:12:27 AM

Posted 08 June 2015 - 01:46 PM

pdmike, I strongly agree with aura's advice to make a system image rather than rely on system restore points. I for one have had incidents where a restore point would not work for me at all to get my system back to an earlier state whilst system images have been very reliable for me.

You can make system images with macrium, and it is a good idea to but as you can also make system images with a toll built into control panel in windows you should probably make that sort as well. Having both types can be helpful, if one ever doesn't work the other type might still. For macrium system images you can use any external device (a series of dvds, a USB stick or an external HDD), as macrium manages to make the images remarkably small you can probably get them onto a high capacity (64GB) USB and not need a big HDD to hold one. Windows's built in image making tool (available on windows 8.1, windows 8 and windows 7 I believe) only lets you make them on a series of dvds or an external device calling itself a "local disk", most USB sticks will call themselves "removable disks" and most external HDDs call themselves "local disks" but sometimes you might be lucky and find a brand of USB which is making "Local disks".

If you have multiple partitions (for example one for personal files(often D:\), one for the operating system and programs (often C:\), and a "system reserved partition") you needn't include that personal files drive in the image but should include all the rest.

It is important to make sure images are made on devices which can be stored away from the computer and are not permanently attached, because image holding devices which are permanently attached are more vulnerable to being infected or damaged.

Typical sizes for images will be 55GB for a windows made system image when you have no personal files to back up and up to 20 or so programs installed, and 30GB for a macrium image made of a system in the same state. If an image were to include personal files, or were made on a system with many programs installed, or one which had been in use for ages and not had it's temp files cleaned then the images could be much larger.

Edited by rp88, 08 June 2015 - 01:46 PM.

Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,751 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:27 PM

Posted 08 June 2015 - 02:05 PM

System Restore was not designed to be a virus or spyware removal tool and should not be depended on. Sometimes using that feature as a method of recovery helps with regaining system stability but other times it may not. Whether it will be successful to some extent depends on what type of infection you are dealing with, what damage the malware has already caused, whether it disabled System Restore and if not, what is restored during the process.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 pdmike

pdmike
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles, CA
  • Local time:05:27 PM

Posted 08 June 2015 - 02:50 PM

OK - thanks rp88 and quietman7 as well.  :bowdown:  :bowdown:



#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,751 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:27 PM

Posted 08 June 2015 - 03:22 PM

You're welcome on behalf of the Bleeping Computer community.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users