up vote 11 down vote favorite
share [g+] share [fb]

Can a system restore to a past time remove the virus from the computer?

link|improve this question
93% accept rate
feedback

5 Answers

up vote 8 down vote accepted

The short answer is no.

System Restore can help spread a virus though.

See here for more info: Removing Viruses with System Restore

link|improve this answer
Also from microsoft: windows.microsoft.com/en-US/windows-vista/… – Mussnoon Oct 20 '10 at 13:10
Someone says yes: askbobrankin.com/system_restore.html – Startup Crazy Oct 20 '10 at 16:57
feedback
up vote 2 down vote

The only sure-fire-100% way to remove a virus... is to re-install.

Once your infected, you never know if you are still infected. Virus scanners are always updating... but so are Virus Writers. There are always items out there that are unknown.

Good virus makers will infect every piece of the system needed to stay alive. And you can never be sure how thorough the virus maker is. The best will include cutting edge rootkits (Which, in a real worse case, could include infecting your BIOS... although I've only seen that in thoery, not "For realz")

link|improve this answer
The only people willing to put the time and money to infecting a system that deep would be a government agency... and if they're attacking your computer you've got more problems that viruses to worry about. – KronoS Oct 20 '10 at 16:29
@KronoS:I heard that some wellknown OS's also produce virus for their absolete products so that the users may shift to the newer version. – Startup Crazy Oct 21 '10 at 1:23
Well I did say "in theory". I've yet to hear of a bios rootkit, just that they are possible. My main point still stands... Assuming that BIOS kits aren't out yet, you can only ever clear a computer absolutely via a new OS install. You can never be sure that some trace isn't there to reinstall the virus/trojan/whatever... – WernerCD Oct 21 '10 at 22:27
feedback
up vote 1 down vote

That depends on the virus. If it resides in the registry or in a driver of somesort then I think it may be able to or if it was installed using a rogue windows update. Most likely it will not remove the virus because most viruses replicate themselves and make it difficult to remove.

99.7% of the time it will not remove the virus.

link|improve this answer
feedback
up vote 1 down vote

Theoretically, it can -at best- stop the virus from working. That'd be if it only infected some files that start up now and didn't start up in the past, and if it has left the system restore points intact. But viruses aren't ever that useless to not infect any system files! So no, it won't. Since in practice, it won't even prevent the virus from working, since the virus will infect a bunch of files, some system files.. that'll run inevitably. If it's a virus, then the best thing is to "disable system restore", this wipes system restore folder clean(so if there was a virus stored there it is gone). Then run the virus scan. Then enable it. System restore really won't help you at all for a virus. It can help with other types of malware though.

Malware other than viruses, like spyware or adware, can sometimes be -not removed- by system restore, but stopped from working via a system restore. (if the malware left the system restore intact). By the way, you can make your own registry backup with ERUNT.

link|improve this answer
feedback
up vote 1 down vote

No.

In fact, to make sure that no virus is still residing on your computer you should first delete all system restore points and do a manual cleaning of the virus or let your antivirus software handle it if it can.

link|improve this answer
Why should I remove the restore points? – Startup Crazy Oct 21 '10 at 1:25
Because there is the possibility that the virus might have attached itself to some of the files in the restore points. If you do a cleaning and then restore to a previous time you might infect yourself once again. – Gani Simsek Oct 21 '10 at 11:07
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.