Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can a system restore to a past time remove the virus from the computer?

share|improve this question

5 Answers 5

up vote 10 down vote accepted

The short answer is no.

System Restore can help spread a virus though.

See here for more info: Removing Viruses with System Restore. Quoting the relevant parts:

When System Restore first appeared in the market, computer manufacturers and other companies claimed ... that it could remove viruses and fix other problems with the computer.

In reality, System Restore can create copies of the infected files. And some viruses may be capable of infecting the restore volume as well as the actual system files. When a person cleans their computer using an anti-virus, then uses System Restore, they may inadvertently re-infect the computer. Or if they use System Restore as a means of removal, either the restore will fail (if the anti-virus cleans the virus out during the restore process) or the restore will replace the file with an infected version.

share|improve this answer
    
Also from microsoft: windows.microsoft.com/en-US/windows-vista/… –  Mussnoon Oct 20 '10 at 13:10
1  
Someone says yes: askbobrankin.com/system_restore.html –  Fahad Uddin Oct 20 '10 at 16:57
    
@FahadUddin It depends on the point at which the system was restored. If you do a fresh OS install, you should be fine. If you back up your system after some use, however, you might also be backing up those infected files. In that example, if the guy had created a system restore point after he installed his program to 'remove spyware', he would be in the same bind. –  ekaj Jan 2 at 18:44

No.

In fact, to make sure that no virus is still residing on your computer you should first delete all system restore points and do a manual cleaning of the virus or let your antivirus software handle it if it can.

share|improve this answer
1  
Why should I remove the restore points? –  Fahad Uddin Oct 21 '10 at 1:25
    
Because there is the possibility that the virus might have attached itself to some of the files in the restore points. If you do a cleaning and then restore to a previous time you might infect yourself once again. –  Gani Simsek Oct 21 '10 at 11:07

The only sure-fire way to remove a virus is to re-install the operating system.

Once you're infected you never know if you are still infected. Virus scanners are always updating their list of threats they can detect, but virus authors are updating their threats just as fast. There are always threats out there that are not (yet) able to be detected.

Good virus authors will infect every piece of the system needed to stay alive. You can never be sure how thorough the virus author is. The best will include cutting edge rootkits, which, in a real-world case, could include infecting your BIOS (although I've never seen that in theory, not in the real world).

share|improve this answer
1  
The only people willing to put the time and money to infecting a system that deep would be a government agency... and if they're attacking your computer you've got more problems that viruses to worry about. –  KronoS Oct 20 '10 at 16:29
    
@KronoS:I heard that some wellknown OS's also produce virus for their absolete products so that the users may shift to the newer version. –  Fahad Uddin Oct 21 '10 at 1:23
    
Well I did say "in theory". I've yet to hear of a bios rootkit, just that they are possible. My main point still stands... Assuming that BIOS kits aren't out yet, you can only ever clear a computer absolutely via a new OS install. You can never be sure that some trace isn't there to reinstall the virus/trojan/whatever... –  WernerCD Oct 21 '10 at 22:27

That depends on the virus. If it resides in the registry or in a driver of somesort then I think it may be able to or if it was installed using a rogue windows update. Most likely it will not remove the virus because most viruses replicate themselves and make it difficult to remove.

99.7% of the time it will not remove the virus.

share|improve this answer

Theoretically, it can -at best- stop the virus from working. That'd be if it only infected some files that start up now and didn't start up in the past, and if it has left the system restore points intact. But viruses aren't ever that useless to not infect any system files! So no, it won't. Since in practice, it won't even prevent the virus from working, since the virus will infect a bunch of files, some system files.. that'll run inevitably. If it's a virus, then the best thing is to "disable system restore", this wipes system restore folder clean(so if there was a virus stored there it is gone). Then run the virus scan. Then enable it. System restore really won't help you at all for a virus. It can help with other types of malware though.

Malware other than viruses, like spyware or adware, can sometimes be -not removed- by system restore, but stopped from working via a system restore. (if the malware left the system restore intact). By the way, you can make your own registry backup with ERUNT.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.