Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: System Restore point

14 Jan 2013   #1

Windows 7 Ultimate x64
 
 
System Restore point

Figured this would be the best place for this discussion. If incorrect please move.

System restore point.... They're used a lot to fix viruses. Its one of the first thing I check when one is brought to me. I'm sure that a virus could find its way into your restore point data but how likely is that to happen?

Has anyone ever experienced restoring a PC and it still be infected?


My System SpecsSystem Spec
.

14 Jan 2013   #2

Windows® 8 Pro (64-bit)
 
 

Yes. It has happened with me. Because the virus was present in a different drive on the HDD. So it did not make a difference restoring system (C Drive).
My System SpecsSystem Spec
14 Jan 2013   #3

Windows 7 Ultimate x64
 
 

I didnt even think of that. Was the PC's partitioned out user data or program files?
My System SpecsSystem Spec
.


14 Jan 2013   #4

Win7 Ultimate X64
 
 

Some virus target system restore just for this purpose as AV often do not have access to "hidden" files, ensuring the virus can stay after removal
My System SpecsSystem Spec
14 Jan 2013   #5

Windows® 8 Pro (64-bit)
 
 

There were 3 drives. The C drive contained the programs. The E drive contained all user media like music, video, etc. which also contained some infected files.

After system restore, the PC looked fine but the viruses would enter in few hours again. Hence we determined that the viruses were hidden in another partition altogether.
My System SpecsSystem Spec
14 Jan 2013   #6

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 

Most viruses can infect restore points nowadays, but it's usually the 1st restore point (although I'm sure some are quite capable of infecting all of them). I usually tell people when they are restoring due to a virus, to go the 2nd, or better yet, 3rd restore point.

As Dinish pointed out, if you have a hidden partition somewhere on the system, usuall written by a rootkit, a system restore doesn't do any good.
My System SpecsSystem Spec
14 Jan 2013   #7

Windows 7 Ultimate x64
 
 

Why do they target just one? And by first do you me the lasted one created or the first one ever created?
My System SpecsSystem Spec
14 Jan 2013   #8

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 

It's usually the last one created, the one most people will roll back to in an attempt to purge the virus. Hence the reason it embeds itself into that point. I have seen systems though where the virus will either delete or disallow access to restore points altogether.
My System SpecsSystem Spec
14 Jan 2013   #9

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by Borg 386 View Post
I have seen systems though where the virus will either delete or disallow access to restore points altogether.
I actually think i have seen one of them before. Unless the user just turned them off. LOL
My System SpecsSystem Spec
Reply

 System Restore point




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 07:34 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33