|
Posted by B.W. on June 15, 2007, 1:11 am
If you were Registered and logged in, you could reply and use other advanced thread options
should clear the restore cache after the system is cleaned, but your
explanation clears that up.
Thanks B.W.
>
> | Watching a show the other night where it was suggested it is advisable
> to
> | turn off Restore while using anti spyware programmes.
> |
> | Is this so and when do you turn it off and then on?
> |
> | Also I believe it was recommended you delete all restore point during
> this
> | procedure.
> |
> | Advice on these suggestions would be appreciated.
> |
> | TIA
> |
> | B.W.
> |
>
> I used to be convinced that one should dump the System restore cache PRIOR
> to cleaning a
> system. However after many discussions and based upon personal tests and
> experince, I have
> come to the conclusion that this should be done AFTER a system is cleaned.
>
> Here's the problem. Most malware are binary files that the System
> Restore cache will
> create a backup of in restore points. When one gets infected, copies of
> the infector are
> now stored in the System Restore cache. If you clean the system then
> restore to a prior
> Restore Point that contains infectors, the OS become re-infected.
>
> If you clean a PC and don't expect to restore to a previous Restore Point
> then eventually
> the infected files will cache-out. In that situation, one does NOT need
> to dump the System
> Restore cache.
>
> If you dump the System Restore cache PRIOR to cleaning the system, you
> will also remove a
> fall back point. That is, if during the cleanup the system becomes
> unstable, you will not
> be able to restore the system from a previous Restore Point. If you did
> restore the system
> back to that state, you can clean the system differently such that the
> system won't become
> unstable and/or unusable. Thus an infected Restore Point is better than
> no Restopre Point
> at all.
>
> Later, when the system is cleaned and verified to be stable, you can then
> dump the System
> Restore cache, reboot the PC and then re-enable the system Restore cache
> and subsequently
> manually create an initial Restore Point.
>
> Thus it is better the dump the cache AFTER and not BEFORE the system has
> been cleaned of
> malware.
>
> HTH
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
| 
XML site map