What type of malware can reside in windows restore?

Posted by qwertymk on Super User See other posts from Super User or by qwertymk
Published on 2011-01-02T08:09:01Z Indexed on 2011/01/02 8:55 UTC
Read the original article Hit count: 340

Filed under:

restore

|

malware

|

system-restore

|

checksum

I was reading aking1012's comment on How to create Windows Vista/Windows 7 Startup disk or Rescue disk or system restore points on a CD? .

He says that:

The first thing I usually do is disable system restore. Some REALLY nasty malware hides in there and is very difficult to delete. As far as rescue media, I make a full backup image. It doesn't directly address the question so it's a comment not an answer, but I thought it was worth noting

What type of malware can hide there, and how is that possible as the restore info must be stored with a checksome to make sure it's not modified, right?

© Super User or respective owner

Related posts about restore

Restore DB - Error RESTORE HEADERONLY is terminating abnormally.

as seen on Stack Overflow - Search for 'Stack Overflow'
I have taken backup of SQL Server 2008 DB on server, and download them to local environment. I am trying to restore that database and it is keep on giving me following error. An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo) … >>> More
Restore DB - Error RESTORE HEADERONLY is terminating abnormally

as seen on Stack Overflow - Search for 'Stack Overflow'
I have taken backup of SQL Server 2008 DB on server, and download them to local environment. I am trying to restore that database and it is keep on giving me following error. An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo) … >>> More
SMO restore of SQL database doesn't overwrite

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to restore a database from a backup file using SMO. If the database does not already exist then it works fine. However, if the database already exists then I get no errors, but the database is not overwritten. The "restore" process still takes just as long, so it looks like it's working… >>> More
Restore monitor detection to one only or restore start menu to bottom

as seen on Super User - Search for 'Super User'
I have a co-worker that is no longer able to see his start menu. He used to have it pinned to the left edge of his screen. I tried to troubleshoot it a bit and discovered if we do Windows + R then "cmd" [enter] the command prompt opens (but we don't see the start menu or run box), meaning the start… >>> More
Restore monitor detection to one only or restore start menu to bottom [Windows 7]

as seen on Super User - Search for 'Super User'
I have a co-worker that is no longer able to see his start menu. He used to have it pinned to the left edge of his screen. I tried to troubleshoot it a bit and discovered if we do Windows + R then "cmd" [enter] the command prompt opens (but we don't see the start menu or run box), meaning the start… >>> More

Related posts about malware

Open dns still detects malware activity after having scanned and removed malware

as seen on Super User - Search for 'Super User'
I'm using open dns to block unwanted sites. Everytime I go to the dashboard I always see this malware activity in all of the networks that I have in open dns. What do I do?I'm using avast free, spybot, and sas. And used them all to full scan the system. And they have removed the malware. But I still… >>> More
HTG Explains: Do Non-Windows Platforms Like Mac, Android, iOS, and Linux Get Viruses?

as seen on How to geek - Search for 'How to geek'
Viruses and other types of malware seem largely confined to Windows in the real world. Even on a Windows 8 PC, you can still get infected with malware. But how vulnerable are other operating systems to malware? When we say “viruses,” we’re actually talking about malware in general… >>> More
How to Use An Antivirus Boot Disc or USB Drive to Ensure Your Computer is Clean

as seen on How to geek - Search for 'How to geek'
If your computer is infected with malware, running an antivirus within Windows may not be enough to remove it. If your computer has a rootkit, the malware may be able to hide itself from your antivirus software. This is where bootable antivirus solutions come in. They can clean malware from outside… >>> More
Not All “Viruses” Are Viruses: 10 Malware Terms Explained

as seen on How to geek - Search for 'How to geek'
Most people seem to call every type of malware a “virus”, but that isn’t technically accurate. You’ve probably heard of many more terms beyond virus: malware, worm, Trojan, rootkit, keylogger, spyware, and more. But what do all these terms mean? These terms aren’t just… >>> More
Keep Malware Off Your PC With Sandboxie

as seen on Internet.com - Search for 'Internet.com'
Malware can infect your PC from anywhere on the Web. Sandboxie, a free application, blocks it. >>> More