The Mudcat Café TM
Thread #116057   Message #2489494
Posted By: JohnInKansas
09-Nov-08 - 09:51 PM
Thread Name: Tech: System Restore Not Restoring
Subject: RE: Tech: System Restore Not Restoring
1. Any time System Restore is turned off, all existing restore points are deleted. If you've turned off System Restore anytime recently you should expect that there would be no restore points earlier than the last time it was turned back on.

2. A new restore point generally is saved only when the computer is shut down, and even then only if "things have changed," so it's not unusual to have few restore points to choose from if you mostly just leave the computer on. If nothing has changed, it may(?) "roll the date" on the older (only) restore point when you reboot, since you're expected to look for a restore point that's the "most recent working" point.

If the only restore point shown is "today," the implication is that System Restore was turned off, and was just turned back on today, unless your system is just "re-dating" the only restore point since the last "significant change."

The real sptcmd.exe file is installed by several different sources, but most notably by Dell where it is part of their system monitoring package, and is used for Dell Support functions. The filename has been used by various trojans/viruses as a "disguise" for their malware. The "real one" should be in C:\Program Files. Phony ones usually(?) appear in other places, such as C:\Windows.

A first step would be to scan with a good AntiVirus program, updated before the scan to make sure you have the latest info for the program to use. If you have a bit of malware "aliased" under this filename, the AV scan should find it. If you don't have a top-grade AV program, you can get a free "remote scan" at most AV sellers' websites.

(Most free remote scans will tell you whether you're infected; but you may have to buy the program to get it to remove the infection. If malware is detected, you may be able to find instructions for how to remove it manually. Once you've detected something with a good AV, you may be able to get a "less good" (or "differently marvelous") program to remove it.)

The reason for scanning first is that if you've been infected, deleting the .exe file may not completely remove all of the associated malware, and may make it more difficult to track down all the bits later. If you're very sure that you've been having only safe surfs, you may feel safe just removing the .exe without scanning first.

If you can confirm that you don't have any malware using that filename, you may still want to get rid of it - especially if it is the version from Dell and you're past the warranty period.

Since the Dell version starts every time you reboot, and you can't remove a program that's running, you'll need to open Task Manager. Ctl-Alt-Del should do this, or you can get to it through the Control Panel.

In Task manager, on the "Processes" tab, find the sprtcmd.exe "process," click on it, and then click "End Process." This shuts it down so that you can go to Control Panel Add/Remove Programs and remove it from the computer. Once you turn it off in Task Manager, DON'T REBOOT until you've finished removing it in Control Panel, since a reboot will just turn it back on and make it impossible to remove.

If your sprtcmd.exe is from Dell, and you still want to use it for whatever their support purposes may be, you probably should hook up to the Dell support website and see if they have an update, or another fix for the shutdown problem.

If you've lost the desktop link to "Dell Support" you may find a "Readme" file somewhere in the "Dell stuff" on your computer that has the link that you can "send to desktop" to put it back there, but Dell support is pretty easy to "Google up."

John