I got a virus. How do I 'restore' my computer to the day before
 

My wife was able to restore our Dell computer once, after a virus. She somehow managed to get the computer to go back to the day before.
It worked.

She doesn't remember how she did the restoration. I've been entrusted (as are you) to help solve this problem.

A search of restore/restoration didn't help. Can you.

Thanks.

if xp
 

system> all programs> accessories > system tools > system restore.............. then pick your date from the calendar

MisterNice

Its likely the virus will still be present and that the system restore may not work at all... in fact it could leave you worse off.

I've said this before and its often not what anyone wants to hear, but...
Your only real viable option is to backup all your files to an external or 2nd disk. Wipe the computer, re-install windows, install some good virus protection and then move the files back.

I did just this to a friends box that was severally compromised just this week.

Specifically, here are the steps I recommend.

1) Download Blink from eEye, install it on the infected computer and do a full scan. (its tempting to leave it at that and move on, but since you are infected, you can never trust the system again, you cannot even trust the Bink is reporting accurately) the goal here is to try and clean the files before you back them up, as a cautionary measure against bringing them back over to the new system.
2) copy your documents and settings to a 2nd drive or external USB drive. I actually like the built in "transfer settings" wizard that its in the Accessories folder in the start menu. It will do all the hard work, including copying in-use protected files
3) wipe the drive, format it during a fresh install of windows
4) Install the latest service packs and updates
5) install Blink from eEye again ... this is the best virus/malware/intrusion detection software out there, period.
6) bring your files back over... either through the transfer wizard again, or by manually copying
7) re-install programs

Its not a fun process at all...it sucks in fact. But its the only way to know that your system is clean. Blink will do an amazing job of keeping you clean and safe going forward. But you might also take the time to change a few habits and processes...install Firefox, or use the VMware Player and a browsing appliance (www.vmware.com) ... start making weekly backups, etc

Good luck!

We'll give it a go tomorrow. Wish me luck. Otherwise, iMac, here we come.

dh

Do you have any idea which virus?
There are a bunch of specific tools here:
http://www.f-secure.com/security_cen...val_tools.html
and you can downlaod an evaluation version of their product here:
http://www.f-secure.com/home_user/su...s/evaluations/

And then get yourself some anti-virus software.

AVG still has a free version.

The Blink product http://www.eeye.com/html/index.html that I mentioned above is free for the first year and then somewhere around $25/year.

I'm still blown away by how powerful yet lightweight it is... I'd recommend it over anything else that I've tried.

My second choice is ClamWin - free as in speech followed by AVG's free version...

As we all know, Norton is a virus in and of itself ;)

One other approach - a bit safer.

Install a fresh copy of Windows (preferably to a different drive or partition). If the same drive/partition, choose to install into a different directory (like c:\safeboot). Not a bad time to purchase a second hard drive, IMHO. Do not access anything on the infected drive/partition (unless you install to the same drive, in which case you have no choice).

Install your virus scanner and update to current definitions.

Update Windows with all current security patches (windows update).

Scan & clean. Note: by booting to an alternate Windows, you can effectively clean system files.

Check the cleaned (or quarantined) files. If any seem to be critical windows files, copy a replacement from your safe windows to the "bad" one. (Alternatively, after cleaning, do an upgrade install of Windows on top of the "bad" install. As before, update with all security patches & make sure your virus scanner is installed and up to date).

This is why the TCO for Mac (or Linux) is probably way lower than for Windows.

Virus
 

I would run a virus scan, the online version of bitdefender works well, free and runs background and memory too. Then, let it do its work, then download something like the AVG free product and run that.

Then, once all are done, then do the restore if all things are clear. then, run the bitdefender and AVG again.

Then, keep the AVG running forever!

Not sure to help in this situation, but I did want to mention backups again.

I'm a bit more geek than most, so this may not work for everyone -- but I dump an image of my HD to an external drive once a month -- and the drive can hold three images. Restoring an image will lose any new data you've saved -- but it will bring your machine back clean.

I had a laptop stolen last year on a Saturday; on Sunday I got another identical laptop we had at work -- Monday morning I walked into work with a fully operating machine. Since I don't store email on the laptop but on servers...I lost virtually nothing.

And as a mention for backups -- keep them separate from your computers for just those kinds of reasons. If the external drive had been inside my house, I am sure it would have gotten taken as well.

Steve

Yes - backups are hugely important. But... if you're trying to recover from a virus, especially a new one, it's possible that the backups are infected. This typically happens when a signature update & subsequent scan (usually weekly) find the virus. The infection could be as old as the oldest useful backup. So, use the backup, but scan it from a clean machine before applying it.

Star by TURNING OFF RESTORE! If you go back the virus is till present. You won't remove it that way.

So TURN OFF RESTORE!

Then download a trial of an antivirus software that you plan to eventually purchase. Burn that on a disk as well so you have a back up.

Close browser and mail and anything you can think of.

Install antivirus. Run the updated and run a complete check of your system. Go away and have lunch/coffee and come back to see the results. If anything is moved to quarantine - delete.

Then go to symantec.com and download (for free) every concievable virus removal tool you can find. Burn them on a disk.

Get your computer OFF LINE so it is not connected to the internet anymore.

Run ALL of the removal tools (even if you have a tool for a virus that didn't get flagged) one after another.

Run your antivirus software and see if it finds anything. If it does - see if you have the tool for it and run it again. If not - go online and find the removal tool.

If you go about it as above you will not have to do a complete install. However - Once your system is cleaned I'd recommend you back up your files, format the hard drive and reinstall everything including the antivirus.

Also make sure your firewall is activated and get anti spyware while your at it. Including pop-up blockers.

This is what I used to do when I was working for a small ISP and servicing client computers.

Just note that for removal tools to efficiently work RESTORE MUST BE TURNED OFF!!

Then leave it off. Restore is evil. It is much better to get a good back up software/workflow and stick with that than using restore.

Remember - Restore is EVIL!

:-)

Come one, what do you really feel about RESTORE :D

Restore is God's punishment to I.T. people. Restore is what virus makers count on as they know their virus will ressurect and do it's evil things. Restore is a virus created by microsoft and users are fooled to think it is not.

I really hate restore.

Apple is coming out with something similar in Leopard. Unless it is really really really good I am so not going to activate it on my mac.

Oh yeah - the best advice is actually folow my list of what to do, back up files, reinstall PC, sell PC, buy Mac, put files on Mac.

*ducking*
:p:p

Actually, you should never count on the integrity of any part of the system you're trying to recover. Do NOT download and make disks of the anti virus software on the infected machine. You'll likely end up with infected cd's. Also, you really want to boot from something clean. You could even install a minimal Window's partition onto a USB drive (if you can't boot from an external USB drive, you can install a new boot loader (grub, for example, or a multitude of commercial offerings) which redirect booting to the usb device.

You really want to do the scan from a clean system. That will, btw, usually detect infections in the RESTORE area. Doesn't make restore useful, but prevents re-infection.