I just had to do a system restore on a Windows XP machine infected by some malware or virus. Among other things, the virus had hidden all files and folders on all drives, removed all shortcuts in the start menu, and somehow blanked and locked the desktop. After fixing some things manually (but not the desktop issue) I thought about System Restore. Performing the System Restore was successful and also fixed the desktop issue.

But this left me with the questions:

  • What exactly does System Restore restore and not restore?
  • Are there any notable differences between Windows XP and Windows Vista/7 System Restore?

Edit: I know in general what System Restore restores: you Windows configuration but not your files. I am interested in more detailed information, like does it also resets meta property of files (like read-only, hidden), if it restores programs what parts of the program are restored (only .exe file, or also related files in 'application data', ...?), ...



  • Registry (note: some current values will persist)
  • Profiles (local only—roaming user profiles not impacted by restore)
  • COM+ DB
  • WFP.dll cache
  • WMI DB
  • IIS Metabase
  • Files with extensions listed in the Monitored File Extensions list

Not Restored:

  • DRM settings
  • SAM hives (does not restore passwords)
  • WPA settings (Windows authentication information is not restored)
  • Contents of the My Documents folder(s)
  • Specific directories/files listed in the Monitored File Extensions list
  • Any file with an extension not listed in the Monitored File Extensions list
  • Items listed in both Filesnottobackup and KeysnottoRestore (HKLM->System->ControlSet001->Control->BackupRestore->Filesnottobackup and keysnottorestore)
  • User-created data stored in the user profile
  • Contents of redirected folders
  • 1
    Not sure if this is true. I did a system restore and it failed, but still modified the contents of My Documents, undoing folder name changes and deleting files, etc. – endolith Oct 24 '14 at 14:17
  • Monitored File Extensions List link is broken. – Drew Chapin Nov 5 '17 at 10:56
  • @DrewChapin: The site is currently down. This page includes the official list of Monitored File Extensions. – Mehper C. Palavuzlar Nov 6 '17 at 5:27

If you have restored you computer to a point during the virus infection, you may have reintroduced the virus. See How antivirus software and System Restore work together for details.

Regarding the files that system restore deals with, Microsoft says -

System Restore can make changes to Windows system files, registry settings, and programs installed on your computer. It also can make changes to scripts, batch files, and other types of executable files on your computer. Personal files, such as documents, e‑mail, photos, and music files, are not changed.

  • so, to the question of what does system restore, restore , answer: The viruses sometimes :-) – Psycogeek Oct 5 '11 at 6:41
  • 1
    I took a restore point a few weeks back to minimize the virus issue, and I've checked for the virus after restore. Regarding your answer, I am looking for more detailed information than Microsoft's vague description (i.e., what does the '..can make ...' mean?) – Rabarberski Oct 5 '11 at 7:27

System Restore is a component of Microsoft's Windows Me, Windows XP, Windows Vista and Windows 7, but not Windows 2000, operating systems that allows for the rolling back of system files, registry keys, installed programs, etc., to a previous state in the event of system malfunction or failure.

In System Restore, the user may create a new restore point manually, roll back to an existing restore point, or change the System Restore configuration. Moreover, the restore itself can be undone. Old restore points are discarded in order to keep the volume's usage within the specified amount. For many users, this can provide restore points covering the past several weeks. Users concerned with performance or space usage may also opt to disable System Restore entirely. Files stored on volumes not monitored by System Restore are never backed up or restored.

System Restore backs up system files of certain extensions (.exe, .dll, etc.) and saves them for later recovery and use. It also backs up the registry and most drivers.

  • Thanks for your answer. However I am looking for more detailed information (which file extensions specifically, in which folders (all of them?), which drivers, ...). – Rabarberski Oct 5 '11 at 7:29
  • Files such as important system files and .dll's , folders such as system32, and drivers such as chipset, graphic, audio, lan drivers. – Random Guy Oct 5 '11 at 7:30

in these days of virtual machines, anybody that -has- virtual machines (perhaps ypu do?) most do. I don't unfortunately! But anybody with them can do a test. You put files of various extensions in various directories, do a system restore see if the files disappear. I did a test long ago, but don't have the notes I made. I know with windows xp c:\program files and the user profile, and the desktop, are at risk directories, certain new files(maybe only certain extensions) will disappear from there.and files in subdirectories of program files. exe files would disappear. Any directory you create in root like c:\sdfsf is definitely fine/left alone. No doubt youre registry is pushed back

in xp it says "the process does not cause you to lose saved documents or work and is completely reversible". maybe they get away with that message because they say it's reversible! I don't recall if it removes "new" TXTs on desktop , it wouldn't surprise me. It does remove "new" EXEs. By new I mean since the restore.

EXEs are definitely a file type it likes to remove, from the directories it likes to remove from. It might remove whole directories too, I don't recall, but worth a try, you may find any new directory created in c:\program files is removed.

http://msdn.microsoft.com/en-us/library/windows/desktop/aa378870(v=vs.85).aspx "The following is a list of monitored file name extensions. Files with these extensions are monitored by System Restore in Windows Vista and later. The files that are monitored or excluded from monitoring in Windows XP are specified in the file %windir%\system32\restore\Filelist.xml. The file Filelist.xml does not exist in Windows Vista and later."

(it's a long list, maybe not a good idea for me to copy/paste it)

  • Sorry, but your answer is very 'conditional' – Rabarberski Oct 5 '11 at 9:05
  • If you ever did the test yourself, i'd strongly suggest testing c:\program files, and the desktop, with EXE files there. In XP You will definitely find the EXEs there getting removed for example. – barlop Oct 5 '11 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.