System Restore Points not working-Avast already uninstalled

[kondora]

User Level (know just enough to be dangerous - so please reply in plain language if you can).  This program was recommended by the IT company we use at my office.  So when I got home tonight I downloaded the home version, started to run a boot scan and deleted a couple of things, then thought twice and canceled.  Read a little more in the user manual and realized probably should have moved to Virus Chest.  So then ran a standard scan, moving things to virus chest.  At end I realized the first few items I deleted instead of moving, might have been essential.  So I uninstalled Avast, tried to do a system restore and now can't do that (it won't restore to prior restore points).  I checked the board for fixes, but since I've already uninstalled Avast, those fixes aren't available.  Can anyone help me please?
System is Dell w/Microsoft XP Pro Version 2002 - Service Pack 2.   Thank you!

[Tarq57]

Hi, kondora, and welcome to the forum.
It seems to me that the items you have deleted and moved to quarantine were likely to have been malware items (or at least detections) from within the system restore points. Cleaning those items generally leaves that particular restore point unusable. If enough were removed, and from detections within most of your restore points, those will be unusable. It's possible, with experimentation, that you might find a working restore point, but this would be a trial and error thing, and, unless there is a problem with your system, not really worth doing.

Could do with a bit more info, if you can.'
What was the AV installed prior to Avast, and how was this removed?
Was the computer behaving badly before scanning with Avast (eg: showing any symptoms of a virus, or website redirects, or strange unknown icons appearing, that sort of thing?)
How did you remove Avast, and did you have any problem with that?
What AV are you using now? Any other security software?
Apart from system restore failing to restore (I'm guessing it goes through the process, but then you get a message saying "System restore was unable to blah blah...") are there any other problems?
 (This system restore issue might turn out not to be a big problem at all.)

Any files you deleted are gone. They might be recoverable with recovery software; without knowing what they were, this is unlikely.
Any files moved to the chest (quarantine) were deleted when you uninstalled Avast. They probably are not recoverable. (If you remember any of the names or paths, that would be good. I'll bet some of the paths had the words "System Volume Information" in them.)

I (and others more experienced) will be able to make suggestions once the answers come.
The suggestions will be along the lines of :
Completely uninstalling whatever AV is (or was) present, and reinstalling Avast.
Running one or more scans and reporting the names of detections.
Possibly installing another anti malware scanner that works well. (Such as MBAM or SAS.)
Removing all old system restore points.
Any other advisable setting changes or tweaks.
We will, of course, provide a step-by-step.

[kondora]

Thanks for your help.  I just posted a reply, but it didn't go thru, so here I go again.

Computer behavior issues prompting the Avast download: I now think it might be mostly mouse issues.  I troubleshooted mouse with no results, so figured perhaps virus.  (opening emails with single click, difficulty highlighting, re-sizing windows, closes windows instead of resizing, etc.)

Old AV was McAfee but subscription long expired.  No desire to subscribe again since they basically screwed us out of 2 yrs of updates.  Our email address changed and we couldn't remember login, and McAfee has absolutely no way of contacting them to correct.  Never officially uninstalled program, and not sure how to do it (can't contact McAfee for help).

So basically, I've been using System Restore whenever I had a situation where it appeared a virus or trojan was trying to invade (as opposed to using any AV).

I uninstalled Avast per recommended method of Control Panel, and it said it was successful.  But of course it left the directory on C drive:  Alwil Software/Avast4

There were 5 items quaranteed from standard scan. I documented by a screen shot to word document (but can't attach - too large).  So here is the info on those 5:

C:\Documents and Settings\Ellen\Local Settings\...\B2D39FBBd01
Infection: Win32:leDefender-L [Tool]

C:\System Volume Information\...\barf.dll
Infection: Win32:Zlob-AUC [trj]

C:\Documents and Settings\Ellen\Desktop\setup.exe\$INSTDIR\...\barf.dll
Infection: Win32:Zlob-AUC [trj]

C:\System Volume Information\...\A0037564.exe
Infection: Win32:Zlob-CDH [trj]

C:\RECYCLER\...\Dc102.exe
Infection: Win32:Zlob-CDH [trj]

The 3 items that I deleted during the boot scan were in a different area of the quarantine, and I failed to document what those were, but I noticed the dates associated with them were prior to my computer being ordered and built from Dell, so then I got concerned.  I tried to Restore from scan but received message that an error happened (due to being already in use).  So I got more concerned.  That's when I tried to System Restore, did the uninstall and tried System Restore again.  And your'e correct about the error message I was getting on System Restore.

System Restore has gotten to feel like my "safety blanket" and so not having my safety blanket doesn't feel so good.

But other than the continuing mouse issues, I'm not noticing anything major happening to my system.  And even the 5 quaranteed items above, were actually dated back in mid 2008 and late 2007, so probably not the source of what I thought was happening to my system now.

I hope this helps, and I hope this posts this time.  Thank you so much... you're truly appreciated.

[Confused Computer User]

Hi kondora,

Just some info you might have missed that Tarq57 mentioned.

So basically, I've been using System Restore whenever I had a situation where it appeared a virus or trojan was trying to invade (as opposed to using any AV).

System restore does not necessarily remove malware. It just resets certain system files to a point in time where a snap shot of those settings was taken. Essentially when you install something or do an update, vista makes a mark of it and takes a snap shot of your system settings at that point. then if problems arrive you can reset these settings to the way they were before having done an installation. Programs and files ( and viruses) aren't removed by doing this. So the problem is still there.

Never officially uninstalled program, and not sure how to do it (can't contact McAfee for help).

The answer to your problem is here:

This article provides the steps to remove SecurityCenter from your computer.
http://ts.mcafeehelp.com/faq3.asp?docid=71525
Also for direct download: http://download.mcafee.com/products/licensed/cust_support_patches/VSCleanupTool.exe
and http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe (2007)

If you need, you can find many free versions of these registry cleaners here:
http://www.snapfiles.com/Freeware/system/fwregtools.html

Sometimes, McAfee won't be completely removed if, before, you do not uninstall Avast, including the use of its "Uninstall Application" if necessary (www.avast.com/eng/faq-install-uninstall-avast.html).

I'm not certain about your quarantined items so I'll refrain from comments about those.

System Restore has gotten to feel like my "safety blanket" and so not having my safety blanket doesn't feel so good.

This is not a good ting in my opinion and you should always keep a backup of your work. Also if you are having major issues with the computer I suggest a format and reinstall of the system. That generally avoids any problems. (I use restore to factory defaults but I am uncertain if this might work once he computer is infected. I will post back once I am certain of this)

Cheers.

[Tarq57]

I agree with Confused Computer User.
A format and re-install is one option, and a pretty good one, as the chances are you have quite a load of malware on board. There are plenty of wise users who advocate a full format and re-install anytime the computer has had certain types of malware present. This is a valid viewpoint in some situations, especially if the computer is used for banking or CC transactions.

System restore is being used inappropriately. Best to backup your important docs, photos etc (anything on the computer you don't want to loose) to an external medium, such as an external hard drive, a re-writable DVD CD, or even a flash drive. (In order of capacity/reliability.)

Personally I'd have a crack at cleaning it up. There's no guarantee this would work, and it could take a while, but the exercise is interesting.
If it doesn't work, you're looking at a re-install anyway, so it's a bit of time lost, and a fair bit of learning.
Whether I am qualified to talk someone else through a cleanup from afar is another matter, but I've done it on my own and friends computers a couple of times. And there are other folk on this forum who are very knowledgeable, and who would probably help.

Let us know what you'd like to do.
(BTW, the mouse thing may or may not be malware. It might just need the drivers re-installed, or the laser/trackball cleaned.)

[Confused Computer User]

(BTW, the mouse thing may or may not be malware. It might just need the drivers re-installed, or the laser/trackball cleaned.)

Good observation on the mouse. I am among the few (at least from the people I know) who still uses a Mouse with trackball. If indeed that is the case for you then a good cleaning is recommended. You would be surprised by what comes out of a mouse after 6 months.
Use this article as a guide:
http://www.computerbath.com/mouse_or_trackball_acting_up.htm
Personally I use tweezers to take most of the dirt out of it but if you wish to be more diligent you can give the article a read.

[kondora]

Thanks to you both.  I attached a wireless mouse today and it works much better, so suffice to say the old mouse appears to need something.  Cleaning might be possible, but it's not a trackball... I think it's just dying a natural death.  Mouse devices are cheap, so no big deal to replace.  Talk about over-reacting, right?

But, this is a good lesson.  Maybe a good time for me to realize my "safety blanket" wasn't so so safe after all.  I just REALLY hate the time it takes to do all this stuff (rectifying and correcting).  As you alluded, it's very time consuming.

Seriously.... I spent more than 12 continuous hours about a year ago trying to fix a problem caused from Microsoft.  Their IE update didn't load properly.  After all the calls I made, Dell wanted me to spend a good amount of money to get it fixed (and even with paying them the money, I would still have to perform the fix, which was a total wipe-out of system)... Thankfully before laying out those funds, I found someone who felt their solution was a little "over the top" and was able to creatively help me download another browser software (Mozilla), via access from my remote office software.  From that I was able to get my Microsoft upgrade to finish it's update.  Very, very stressful times though.

I'm not a dimwit... though to most of you guys I probably am (again more along the line of "knowing enough to be dangerous" kind of person).  But I'm smart enough to know that one slip; one simple mistake, and everything gets screwed up. 

But I really would like to have my System Restore feature back.  And I really want a good AV system working for me... and don't have any issue paying for something worth having. 

My office workload (like so many people in America) is such that personal time is compromised by workload commitments right now.   So thankfully you guys have provided me some initial comfort to know that, while I need to get this corrected, my system doesn't appear to be too screwed up right now and I have a few days to get working on this.

I'd like to peruse your comments/recommendations, take action on them, and hopefully be able to lean on you guys if I need more help. 

I can't thank you enough for your replies and guidance.  When all done and corrected, I would hope I can some day help you, by offering any personal references for you in the future.

Thank you and please keep an eye on this post for the next week or so.  I really may need just a little more guidance.

Thanks so much!!

[Tarq57]

You sure don't strike me as a dimwit.
(But then, you're reading text from a person who has chosen an avatar that has well represented his computer learning style.)

Still not sure what you intend doing. You almost certainly have malware still active on the PC.

If you intend formatting/reinstalling, can I suggest you download Microsofts' XP SP3 to a disk or flash drive first? It will make installing updates very much faster. http://www.microsoft.com/DownLoads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=en

If you intend fixing it from present condition, well, that will be fun. Look forward to it. (Shouldn't be that bad, but as I say, no guarantees.)

[Tarq57]

PS. Also, download or save the installer files for any security programs, such as Avast, maybe a firewall (you can get away with Windows Firewall for now), and anything else you'd like to install before connecting to the net for the first time. (This is assuming a re-install is your choice.)
You might find it worthwhile having a look at PCDecrapifier, too.

[DavidR]

Here is some light reading for you, hopefully you might find what you are seeking there.

SYSTEM RESTORE - Info - Troubleshooting
System Restore MVP site - http://bertk.mvps.org/

There are many, many reasons why a System Restore may fail. For example, see "Why are previous restore points not working?" in the "Troubleshooting" section of this official Microsoft page:
http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

There's lots more on that page that's worth reading too. Note especially the sections on "Does System Restore protect personal data files?" (the short answer: no); "What should I do if System Restore does not work?"; "Why are my restore points missing or deleted?"; "Why does the System Restore Wizard lockup?"; and so on. Just a few minutes on that page ought to convince just about anyone that System Restore is not intended for heavy-duty system protection!

[Eddy]

Disable system restore. It is crap anyway. Why? Well for a start it using a lot of hd space. Secondly:
System restore enabled.
System gets infected.
Malware detectors don't see the new malware.
Later on you clean your system.
You go back because you have a problem.
Guess what? The malware is back too

Thirdly... How to do a system restore when you can't enter the restore points?

Best solution. Do a clean install, install the os, drivers, applications you are using.
Create a image of the system and make backups of data on a regulare base.

[DavidR]

Whilst I agree that system restore is flawed and I have it disabled on my systems, but you must replace it with something else to achieve the same (or rather better) functionality to give you a way to step back the system.

That is hard disk imaging software that will make an exact copy of your partition/s or drive (as Eddy mentioned), there are some free versions but most are a paid for option. You should then do regular weekly images of those partitions so if you have a serious problem, you just restore the last drive image.

[Lisandro]

System restore saved me a lot of times.
It's not even close perfection, it's not a full backup, but it's quick and allows restoration of files and bad installation from software.

[Confused Computer User]

I agree with tech on this. I don't use system restore as a backup but as a way to reset my setting to point in time before a program messed with them. It's a last minute effort before resorting to more drastic measures.

now for kondora.

I'd like to peruse your comments/recommendations, take action on them, and hopefully be able to lean on you guys if I need more help.

Everyone here is usually willing to help. And don't put yourself down. I'm no expert either but when I try to help I speak from experience so if I learned something I help others avoid my mistakes.

If you wish to format and reinstall then the gurus can help. I generally use the hidden partition on my dell to reinstall system. This should still be on your system unless it was deleted.

[DavidR]

I suggest you read some of the information in the links I gave earlier and you will see it isn't something that you should 'rely' on 100%. So if you haven't got something to replace it (that is more reliable) or to back it up, if it fails you are screwed (a good technical term) as the originating poster found.