Windows Forum

Ask something
Discussion Locked

Deleting XP restore point

0 helpful
5 replies

by trav62

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A friend had taken her system to a local pc repair shop because it wasn't running well. They discovered her Windows XP was "blacklisted". Their fix was to 1)uninstall XP, 2)install a used hard drive, 3)install Windows 98se on this hard drive and make it C:, 4)leave the original drive alone (except for the XP removal and making it D:) so she didn't lose any files. Unfortunately, the XP file structure is still intact including the restore points. 1 of these RPs has spyware. If the infected files (or the whole RP) are manually deleted, they reappear upon rebooting. I cannot reload XP due to her not being able to locate her XP disc. Question: How to remove a restore point when XP is no longer the OS?

5 replies

by blackcurrant

What did the repair shop do? I don't understand how an XP restore point can 'restore' if XP has been uninstalled.

Why would a repair shop install Windows 98 on a machine that had been running XP?

Windows 98 will be controlling the system, so how can an XP restore point restore? Windows 98 will not be able to recognise a restore point surely?

I'm confused by this. Can you post more details - explain exactly what the shop did?

Anyway, why not just move the data to the C drive (or back it up to removable media), and repartition/reformat the D drive?

Good luck!

by willcomp

Boy, somebody sure got sold the Brooklyn Bridge in this one.

How do you know restore file has adware/spyware in it? Scanned with Ad-Aware, Spybot, etc?

If XP was on an NTFS drive, how is 98 reading it?

At any rate, system restore files are in "System Volume Information" folder (w/o quotes). That folder is a super-hidden folder (MS terminology) and may be difficult to access.

And, find a reputable repair shop.

Dalton

by romk

Yes the original question contains a number of anomalies which others have already picked up. In relation to Answer 2 ?How do you know restore file has adware/spyware in it? Scanned with Ad-Aware, Spybot, etc??

In my case, because Kaspersky Anti Virus (KAV) tells me so. Unfortunately I cannot include a screen dump, but at the end of a full system scan, KAV tells me

The following dangerous objects were detected on your computer.....c:\system volume information\-restore{32dda52e .....and the rest}\rp32\ao224998.dll is a riskware not-a-virus:RemoteAdmin.Win32.WinVNC.1540 for which Googling and the only other place which recognised Win32.WinVNC.1540 was www.viruslist.com which only tells me that "Currently there is no description available for this program."

So problem 1 is that there is spyware/riskware inside a restore point for which all I can do is delete it (then I have no restore points), or exclude it as a threat. Problem 2 is that each time a new resore point is created, spyware/riskware is embedded into it. So theoretically I can never be rid of it unless I do a clean install of XP. Have already flushed all restore points, but it comes back as soon as a new restore point is created. A real Catch 22, what to do?

Perhaps I should not worry about it and just exclude it and learn to live with the beast.

Cheers, RomK

by caryxander

You can access the "System Volume Information" folder using a simple utility called ExplorerXP . It's a Windows Explorer replacement, but you can just use it to read the contents of the "System Volume Information" folder. All the restore points are located in that folder in a sub-folder named "_restore{7411CB10-E339-49DB-ABEC-446C6A43671E}" The SID number will be different, but it will still start with _restore. You can manually delete any restore points you want from there. As an FYI, after you install ExplorerXP, you can copy the executable from the install ddirectory and run it stand alone after that. It will run on any Windows system w/out having to be installed.

by jyd496rr

ExplorerXP Where can i find this File
searched most of the usual sights and open sorce networks can't seem to locate this.

This discussion is closed to new replies.