[mo713]

I recently had the thinkpoint malware which caused browser redirects and various other problems. The first thing I tried was to do a system restore, but all restore points had been deleted by the malware. I was told by this forum that no current protection program would have caught the malware and stopped it, but now I wonder if there is any kind of software protection that will at least "lock up" the system restore points and block ANYTHING from destroying them without special permission, or at the very least, perform a backup of those files in a different place that is secret and hidden from automated malware programs?

Does such an application exist? A restore point preserver ?

[Advertisements]

Wouldn't really help anything.
System Restore is really fickle when it wants to be, and by design no restore point lasts forever. By default they last either until the allocated space for System Restore is full, 90 days have passed, or the points are manually purged, whichever happens first first.

If you want to preserve the state of the system at a specific point in time, your best bet would be to use an imaging problem such as Norton Ghost or Acronis and take a copy to an external drive.

[Neil Jones]

Wouldn't really help anything.
System Restore is really fickle when it wants to be, and by design no restore point lasts forever. By default they last either until the allocated space for System Restore is full, 90 days have passed, or the points are manually purged, whichever happens first first.

If you want to preserve the state of the system at a specific point in time, your best bet would be to use an imaging problem such as Norton Ghost or Acronis and take a copy to an external drive.

[mo713]

I realize it wouldn't be a perfect cure, but at least it would prevent the deletion of recent restore points as a deliberate sabotage by rogue software. In other words, I don't want the restore points to go away until *I* am ready, or until the system does it under the normal rules for purging.

I don't want some rogue program to come in, delete the good restore points, and then start messing things up and there is no longer a restore point to revert to .

[Neil Jones]

I appreciate what you're saying, but System Restore is as it is in XP and that's what we have to work with.
In any case, a roll-back with Restore doesn't guarantee to fix anything anyway. With some infections you can't even get that far to run it.

[phillipcorcoran]

Furthermore, a System Restore Point could itself contain malware which was "backed up" along with everything else. So whenever you're cleaning up a malware infection, that cleanup should always include deleting all restore points to avoid the risk of restoring malware.

A much more reliable form of total system backup (which doesn't get automatically deleted) is to create an 'image' of the C: drive on a second hard drive (internal or external) using disk-imaging software (after making sure your system is malware-free first of course).

Edited by phillipcorcoran, 15 December 2010 - 11:59 AM.