Tech: System restore

Subject: Tech: System restore
From: scouse
Date: 02 Feb 06 - 07:34 AM

Simple question, system restore On or Off??? Pro's and Con's please.I've heard horror stories.

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 02 Feb 06 - 08:09 AM

It makes some, although not a lot, of difference which operating system you're using.

It is generally considered good practice to have system restore turned on for normal operation. Especially with WinXP, and to a lesser extent with Win2K, the "last working" version that System Restore has on file occasionally can resolve problems during a reboot that you won't "see" happening. Without the backup registry that System Restore maintains, the OS would have to ignore the error, substitute a generic fix, or ask you what to do.

The ONLY time it's necessary to turn it off is when there is a reason to expect that a backup copy of Registry information may contain a virus or other malware. If the removal of a malware item requires you to delete Registry information that was contaminated by the malware, the next reboot may result in replacement of what you deleted and reinstalling of the malware or some of its programs.

Turning off System Restore should be part of the malware removal procedure, when needed; and most procedures where it's needed will recommend that you make a separate manual backup of your registry before turning off System Restore. The automatic restore process can't access a copy that you make manually, but if you screw up your repair it may be better to be able to go back to the "infected" state to start over than to start from scratch.

When you turn off System Restore, and reboot once, ALL PRIOR COPIES of the registry information maintained by System Restore are deleted.

YOU SHOULD ALWAYS HAVE AT LEAST ONE RECENT REGISTRY BACKUP THAT WORKED.

If you don't let System Restore make backups for you, you need to do it manually - and you probably won't, especially if you need to ask...

John

Subject: RE: Tech: System restore
From: Stilly River Sage
Date: 02 Feb 06 - 12:07 PM

I did an incremental backup into a good full backup a couple of days ago. That external hard drive is only turned on long enough to do the backup. I'm certain I don't have any malware poised to wipe my data on Feb. 3, but it makes sense to have a good backup before such known black dates happen just on general principles.

SRS

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 02 Feb 06 - 12:37 PM

Stilly

I'm quite secure with all my AV, AntiAdware, AntiSpyware, and safe surfing that tomorrow won't wipe out all my goodies, but -- I've also got everything on a disconnected Hard Drive that will conveniently not be needed until after...

I recently found that all the "work product" (documents, spreadsheets, email, addy books, photos, etc) from three machines that I have in normal use - all fit nicely on the one "USB packaged" hard drive that I originally got as a "data carriage" for my laptop, despite numerous files that are duplicated on all three machines.

Of course, pertinent to the original thread question, my manual registry backups are kept in my document folders, so they're included in the offloaded stuff.

I'm considering whether adding another similar drive for redundancy might be a better idea than trying to maintain backups on CDs as I've been doing. A fresh backup just of images looks like it would need about 7+ DVDs (close to half the price of a hard drive just for the blanks, and IMO unreliable as an archive). Backup to CDs is time consuming, and keeping track of what's on which is something of a chore. I'm also running out of places to stash them.

John

Subject: RE: Tech: System restore
From: scouse
Date: 02 Feb 06 - 01:45 PM

Yo, John, Thanks for the very informative mail, I think I'll leave it turned on.. I have AVG anti virus ware an the ol' windows firewall.Up to now I've run a safe system.. But one never says "Never happens to Me!!" as they say... .

Subject: RE: Tech: System restore
From: Stilly River Sage
Date: 02 Feb 06 - 02:40 PM

John, where are you buying your DVDs? Or your external drives? Either I am buying hardware in the wrong place or you're paying too much for DVDs. I bought 100 DVD+Rs for $35 on sale at Office Depot a few months back, and I've seen them pretty close to that price at Fry's since then. That would be about $2.50 for seven DVDs--a fabulous price for an external hard drive!

I made a full backup to CDs a few months ago, and I have backups now on this external drive. I will make another backup (probably to DVD) again later just to have that redundancy. The external drives are best when sitting in one place and not jostled around. They, like any hard drive, can fail, so aren't the perfect answer.

Last week I saw a name-brand 300 gig external drive on sale at Fry's online store (Outpost.com) for $150 after a $50 rebate.

SRS

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 02 Feb 06 - 02:52 PM

scouse -

Everyone should have:

Ad-Aware (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5)

Spybot S&D (http://www.safer-networking.org/en/download/index.html)

HiJack This (http://www.majorgeeks.com/download3155.html)

Run AdAware and Spybot and update them at least once a month to get rid of "noxious" things. They're very helpful if you run into a real problem. Having them available on your machine before something happens is a "VGT" (very good thing) but they have to be kept updated, like AntiVirus, so you need to unpdate and run regularly for them to be anygood.

Hijack This is a MAJOR TOOL when things get really bad and the idea here is to have it if and when you need it. You can run it and make a log file of your current setup if you like - recommended if you understand what it's for - but you should NOT ATTEMPT to use it to make changes to your system without "pro" assistance, unless you're pretty knowledgeable. Just get it.

If you want to understand what HiJack This is good for, look at the "procedure" at That Comupter Guy. The critical thing you need to know is that Hijack This makes a log of what's on your machine, and that log can be shown to the experts who can tell you what to do about it. ALL such help resources will expect you to have run AdAware AND Spybot before making a Hijack This log for submittal, and links to get them are also at this webpage.

After you've read the instructions, which are pretty much common for several sites that can give assistance, you might want to take a look at the Tom Coyote Forum to see how it works.

Expect to spend a couple of hours doing research, if you have normal curiosity and if you pursue getting a good notion of where the help will be WHEN DISASTER COMES.

All above programs are free, although there are more sophisticated paid versions if you find one helpful. Donations accepted for the free versions, if you're inclined.

OPTIONAL: If you have *WinXP, you can get the free "Microsoft Malware Remover." It's still being called a "beta" but it's been around for at least a year now. It applies fairly sophisticated methods to look for "bad programs" that might have crept in, including spyware, adware, and some other stuff. It was one of the first to officially declare the **Sony rootkit DRM "malware" and to announce that the "Malware Remover" would take it out. It can be "intrusive," since the default is to run daily, and on my machine it takes close to an hour to scan everything. Most people wouldn't have a problem with letting it run while they sleep, but I'm not consistently off for the same hour every day.

*Mainly for WinXP Professional, although I think it's available for WinXP Home. It may be available for Win2K(?).

** Put "Sony" in the filter box and refresh back 60 days if you haven't heard of this one.

John

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 02 Feb 06 - 03:16 PM

Stilly -

My DVD burner is "unreliable" on +R disks, and they're the only ones available in bulk - that I've seen. The unsettled format standards, in my opinion, make DVD unsuitable for archiving, and recovery from DVD is painfully slow regardless of the format. Reports on stability, especially for the bulk disks, have also been rather mixed, which is another reason I'm reluctant to consider DVD for much archiving.

I generally buy only very small quantities, and the last that I bought were nearly $7 per disk. I don't consider them the best way to go, so I haven't looked for any recently. The situation may have changed.

For my use, a 300 GB drive is overkill. The "sweet spot" for bits per buck is closer to the 160 GB to 180 GB size in my area, and it's less trouble doing the periodic cleanups and defrags with smaller drives. As mentioned before, a desktop hard drive in an "external USB case" makes a lot of sense to me, since you can swap the drives to other uses. It's also very handy to have one of the cases in case of a hard drive failure or other need for a swap in your machine, since you can mirror what's left on the old drive without fighting to get the new one on the inside (which usually means temporarily removing another drive).

If and when reasonably priced real RAID systems become a bit easier to get into, I'd perhaps consider 300 GB there, but of course that would be a major investment even at "reasonable." By the time I get to that, the 1 TB drives will be common(?).

Recent "expert opinion" has begun to move toward "server storage" (i.e. on redundant hard drives) as the most reliable and cost-effective method of archiving. I'm not fully convinced - yet - but they're making very good sense.

John

Subject: RE: Tech: System restore
From: Sorcha
Date: 02 Feb 06 - 04:26 PM

Well, MY geek says to keep it turned off, and I've never been able to get it work anyway.

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 02 Feb 06 - 05:19 PM

Sorcha -

Except in the case of a verified reason to suspect infected backups, System Restore performs useful functions in keeping your system clean. In normal operation, you'll never see it do anything; but it can perform some "good things" invisibly, when needed. You won't suffer major harm from not having a current registry backup that it can access, but it can result, for example, in substitution of "generic" drivers and settings in place of the ones you want to have installed.

If your geek has told you to turn it off, then one must assume that your geek expects, and has explained how, you should be making manual registry backups on a regular schedule - or (s)he's just hoping for more business.

Maybe your geek is just lonesome.

John

Subject: RE: Tech: System restore
From: muppitz
Date: 02 Feb 06 - 05:45 PM

I can't seem to get my system restore to work either Sorcha, I'd like to have a restore point cos it's working perfectly, if anything went wrong, I'd like to return to NOW!
Whenever I try to turn it on I get an error message:
"System Restore has been turned off by group user policy, contact your system administrator"
As far as I'm aware I AM that administrator but this exceeds the limits of my technical knowledge!

If anyone has a suggestion I'd be more than pleased to listen!

muppitz x

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 03 Feb 06 - 12:57 AM

muppitz -

Start | Help, click on Index, put "Group Policy" in the search box, and you actually will find some information about what may be happening to you.

There are too many things that could have been done there to make guessing worthwhile; but with the bit of information that you should find there you should be able to at least find the right places to look for something that's related to what's going on with your machine.

You may also be able to turn on System Restore if you just log on as "Administrator" rather than as a "user," assuming that you've set up your Administrator account.

There shouldn't be a need for any such policy unless you have multiple users defined. Sometimes when you create a new account, if you haven't done the Admin setup first, a "policy" will be created to use certain existing setup items, and only the "Administrator" can change most of those things.

As an interim thing, you can make a manual backup of your registry. The full "preferred procedures" are given in How to back up, edit, and restore the registry in Windows XP and Windows Server 2003 (KB article 322756) and a couple of other Knowledge Base articles you'll find linked in that one.

John

Subject: RE: Tech: System restore
From: EBarnacle
Date: 03 Feb 06 - 12:59 AM

The microsoft fix definitely works with XP home edition also. As soon as I am done here, I will give it its daily run.

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 03 Feb 06 - 01:13 AM

Re the link on manual backups of the registry and the whole bucket of worms related to System Restore:

Those still suffering with Win98 or WinMe may be interested in the KB article Description of the Windows Registry Checker Tool (Scanreg.exe)
which is (sort of) the ancient and obsolete version of System Restore.

Win2K and WinXP users shouldn't take this article literally, since it doesn't apply directly to them, but a quick read-through might help in understanding why leaving System Restore turned on except when there's a specific reason to turn it off temporarily is a good idea, since the processes are sufficiently similar to indicate a generic philosophy for some of what goes on even with the current operating sytems.

John

Subject: RE: Tech: System restore
From: Bert
Date: 03 Feb 06 - 01:35 AM

Back up everything that you want to keep then start fresh with Linux.

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 27 Mar 06 - 07:52 PM

Subject: RE: Tech: System restore
From: McGrath of Harlow
Date: 27 Mar 06 - 08:13 PM

How long will it be before we don't have to worry about this stuff?

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 27 Mar 06 - 08:41 PM

Nothing new here folks. A friend was having trouble typing in links by 'phone help, so I refreshed to send him here where he could use the links at 02 Feb 06 - 02:52 PM.

John

Subject: RE: Tech: System restore
From: Bill D
Date: 27 Mar 06 - 08:43 PM

I suspect it will be a problem for a very long time....we expect computers to do so many things in places where others can cause problems. It's not like making a better toaster...

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 27 Mar 06 - 08:45 PM

McG -

The writers last week were celebrating the second birthday of a worm that appeared two years ago and that is still the most frequently found infection in circulation. The AV guys say it remains at 55% of infections found, on over half the user machines they scan; because too many people don't keep their machines clean, so they keep passing it back and forth.

There haven't been a lot of new viral types recently (compared to a few months ago; but new phishing types and scams, and new non-viral malware keeps coming up.

John

Subject: RE: Tech: System restore
From: Bert
Date: 27 Mar 06 - 10:51 PM

Personally I only back up my own data, and restore all software from the original CDs. I don't trust a damned thing that Microsoft does automatically.

Oh and also don't keep ANY data in the My Documents folder. I had one occasion where Microsoft wouldn't let me back up My Documents.

Subject: RE: Tech: System restore
From: JohnInKansas
Date: 27 Mar 06 - 11:54 PM

Bert -

If you're using WinXP or Win2K you should be allowing Microsoft to automatically deliver security updates. They are important, and there's no other reliable way to be sure you get them in a timely manner. You can set up to have them downloaded, but not installed until you review them. I've had no problems with letting them install automatically.

I'll agree with you on the My Documents folder. It's a "phony" representation of what's on your machine, and often things "in it" seem to be only shortcuts, disguised to look like real files. A backup from "My Documents" sometimes doesn't actually back up anything, and seems (in my experience) to seldom get everything you expect.

The "My Documents" folder is (in a philosophical sense) just a listing of things that can be anywhere on your drive(s). It isn't really showing you what's in a particular location in the file structure, it's only showing which things (somewhere on the drive - within the file structure) have a particular function - i.e. "belong to you." It's all very mystical, but we're supposed to be too dumb to understand it. I don't - it's not interesting enough. I just don't use it, except occasionally as a temporary "scratch pad" place to put stuff until I can sort it to my own folders.

And "cutesy names" upset my digestion and create excessive glandular secretions that are unpleasant. If I wanted "cute" I'd be driving a Mac.

John

Subject: RE: Tech: System restore
From: Grab
Date: 28 Mar 06 - 05:56 PM

The problem of viruses, trojans and rootkits will stop when dickheads stop writing them. Until the population is free from dickheads, the beat goes on...

Subject: RE: Tech: System restore
From: Bert
Date: 28 Mar 06 - 11:45 PM

What it did to me was to tell me it couldn't back up that directory because it contained a file that was in use by the system but didn't tell me which one.

I'm going over to Linux, already have it on one machine and as soon as I've learned some more of it's tricks, I'll put it on my main machine.

Subject: RE: Tech: System restore
From: katlaughing
Date: 29 Mar 06 - 11:24 AM

Last night our harddrive went nuts. We woke to a screen saying a windows file was corrupt or missing to reinstall it. CDs are packed right now, so went to system recovery. Have gone through all of the stps and it says it is ready to go, then hangs-up forever at the final phase where it is a blcak screen wt\ith the window logo and the little green time counter thingy. It says Please Wait and nothing happens, hasn't for over an hour.

Any simplse/stupid thing I can do to kick start it? Or does that mean it has really crashed and has to go to hospital?

Thanks much,

katdumb

Subject: RE: Tech: System restore
From: Stilly River Sage
Date: 29 Mar 06 - 11:29 AM

Can you find the disks? It might be cheaper to spend time rather than money for a trip to the techie. I'd reinstall with the disks then get all of the updates in as fast as possible. Then scan it with what you have available (and perhaps download some if your assortment of free protective software is slim) and see what you can see.

SRS

Subject: RE: Tech: System restore
From: katlaughing
Date: 29 Mar 06 - 12:15 PM

Thanks, SRS. I think we can find the disks. I have been able to get bakc on. Went away for another hour, came back. It said it was missing or there was a currupt AM18.dll file, etc.

BUT, everything was up, as usual, so I reinstalled Mozilla, Thunderbird, etc. and all of my email addys etc. are here, so. Will now spend the rest of the day doing enw backups and buying an external harddrive!

Thanks!