Obviously i would have to disagree.. I use restore points all the time and works like a charm.. But that is usually a last case scenario.. What is wrong with running spybot?? Or having an antivirus program?? Seems to be working fine on our 15,000 user company network..
As I stated in my last reply to Boomshaker, I was talking about the System Restore portion of your post. It causes more harm than good in most malware cases. Disinfect it is what should come first, then if all else fails, which it very rarely does, use a restore point.
There is nothing wrong with AntiVirus, of course. I talked to him about that via PM as he is a friend and I supplied him with it.
As for Spybot on a network, (not home use) I am surprised you are still using it. We had nothing but problems pushing software, and reg entries to boxes remotely with it. Even with trusted zones via the control center, and exclusions we still ran into snags so we had to remove it from about 300,000 nodes. Either way, not a bad product for home use, as I said we just had a problems on multiple networks with software deplyment. Oh, it also tended to hang the OS too when the nodes had certain virus scanners because the kernel locked out the file trying to make a decision on which function it should forward the request to first. Again though these weren't the reasons I was pointing out.
Almost forgot, the main reason I mention not to use system restore until a last resort is it can effectively make your antivirus or anti-malware non-functional. Depending on the antivirus you are using, if the DAT files were updated, the restore function sometimes will restore the older DAT files, yet not update the registry correctly, or the signature logging section of the antivirus. At that point the antivirus thinks it is updated, yet it is not and may not function correctly. To top it off, sometimes Norton and McAfee have a problem unintalling once a restore has been done, and have to be chain-sawed out to remove them. Not fun, especially with McAfee 7 or higher. So fixing the problem at that point thatw as caused with the restore is a pain in the ass at least. As far as my procedures go, I always clean the problem first, then try to get everything working properly. If all else fails, I do a Last Known Good. If that fails, I do a restore, but usually at that point it's much easier to re-image the box.
.gif "IP Gear")
