General discussion

  • Creator
    Topic
  • #2181852

    Deleting XP restore point

    Locked

    by trav62 ·

    A friend had taken her system to a local pc repair shop because it wasn’t running well. They discovered her Windows XP was “blacklisted”. Their fix was to 1)uninstall XP, 2)install a used hard drive, 3)install Windows 98se on this hard drive and make it C:, 4)leave the original drive alone (except for the XP removal and making it D:) so she didn’t lose any files. Unfortunately, the XP file structure is still intact including the restore points. 1 of these RPs has spyware. If the infected files (or the whole RP) are manually deleted, they reappear upon rebooting. I cannot reload XP due to her not being able to locate her XP disc. Question: How to remove a restore point when XP is no longer the OS?

All Comments

  • Author
    Replies
    • #3170331

      Reply To: Deleting XP restore point

      by blackcurrant ·

      In reply to Deleting XP restore point

      What did the repair shop do? I don’t understand how an XP restore point can ‘restore’ if XP has been uninstalled.

      Why would a repair shop install Windows 98 on a machine that had been running XP?

      Windows 98 will be controlling the system, so how can an XP restore point restore? Windows 98 will not be able to recognise a restore point surely?

      I’m confused by this. Can you post more details – explain exactly what the shop did?

      Anyway, why not just move the data to the C drive (or back it up to removable media), and repartition/reformat the D drive?

      Good luck!

    • #3170267

      Reply To: Deleting XP restore point

      by willcomp ·

      In reply to Deleting XP restore point

      Boy, somebody sure got sold the Brooklyn Bridge in this one.

      How do you know restore file has adware/spyware in it? Scanned with Ad-Aware, Spybot, etc?

      If XP was on an NTFS drive, how is 98 reading it?

      At any rate, system restore files are in “System Volume Information” folder (w/o quotes). That folder is a super-hidden folder (MS terminology) and may be difficult to access.

      And, find a reputable repair shop.

      Dalton

    • #3208649

      Reply To: Deleting XP restore point

      by romk ·

      In reply to Deleting XP restore point

      Yes the original question contains a number of anomalies which others have already picked up. In relation to Answer 2 ?How do you know restore file has adware/spyware in it? Scanned with Ad-Aware, Spybot, etc??

      In my case, because Kaspersky Anti Virus (KAV) tells me so. Unfortunately I cannot include a screen dump, but at the end of a full system scan, KAV tells me

      The following dangerous objects were detected on your computer…..c:\system volume information\-restore{32dda52e …..and the rest}\rp32\ao224998.dll is a riskware not-a-virus:RemoteAdmin.Win32.WinVNC.1540 for which Googling and the only other place which recognised Win32.WinVNC.1540 was http://www.viruslist.com which only tells me that “Currently there is no description available for this program.”

      So problem 1 is that there is spyware/riskware inside a restore point for which all I can do is delete it (then I have no restore points), or exclude it as a threat. Problem 2 is that each time a new resore point is created, spyware/riskware is embedded into it. So theoretically I can never be rid of it unless I do a clean install of XP. Have already flushed all restore points, but it comes back as soon as a new restore point is created. A real Catch 22, what to do?

      Perhaps I should not worry about it and just exclude it and learn to live with the beast.

      Cheers, RomK

    • #2976064

      Re: Deleting XP restore point

      by caryxander ·

      In reply to Deleting XP restore point

      You can access the “System Volume Information” folder using a simple utility called ExplorerXP <http://www.explorerxp.com/>. It’s a Windows Explorer replacement, but you can just use it to read the contents of the “System Volume Information” folder. All the restore points are located in that folder in a sub-folder named “_restore{7411CB10-E339-49DB-ABEC-446C6A43671E}” The SID number will be different, but it will still start with _restore. You can manually delete any restore points you want from there. As an FYI, after you install ExplorerXP, you can copy the executable from the install ddirectory and run it stand alone after that. It will run on any Windows system w/out having to be installed.

      • #3024462

        ExplorerXP Where can i find this File

        by jyd496rr ·

        In reply to Re: Deleting XP restore point

        ExplorerXP Where can i find this File
        searched most of the usual sights and open sorce networks can’t seem to locate this.

Viewing 3 reply threads