System Restore as malware removal

[Morvotron]

Always asked this question to myself. If I get infected with a trojan on Friday 1st and perform a system restore to Thursday 31st, does the malware get deleted? Are the processes still there?

 

[SpartacusSystem]

Good question! I seem to think traces of the trojan would still be left over.

 

[ForgottenSeer 19494]

System Restore makes backup of Registry settings, System files and some program files. If you revert it might break something like the autostartup of malware but it again depends on the type of malware and i believe that more often than not this won't happen. Malware actually can infect system restore points, so sometimes it's recommended to stop System Protection and start it again after you've dealed with a malware infection (thus clearing existing points) and creating a new clean one. Bitdefender and some other AV companies has guides for doing it like this one.

 

[hjlbx]

I think it is not recommended practice nor should one rely solely upon system restore to disinfect one's system.

There are many variables involved and as with many things IT, the answer is not so simple.

This question is best answered by malware removal expert @TwinHeadedEagle .

 

[Exterminator]

It can remove some viruses yes but generally speaking the answer would be no.
Unless you are absolutely sure it is a virus that can be removed by using system restore it would not be advisable.
Using system restore with malware present on the system can result in other restore points being infected as well.
Ideally removing the virus first is the best option before using system restore.

If you are unsure how to mitigate a malware problem then post your problem here Malware Removal Assistance
You are not going to find any better help for free or for a small donation.(Hint)

 

[LabZero]

The malware can also infect the previous restore points.
The fundamental problem of the infections is the malware often infects the System32 folder and other OS paths, and not everything will be restored using the restore point .
Then use a restore point with the operating system infected is dangerous and very often useless .
Indeed, it is better to clear all restore points for safety.

The best solution is to provide an OS images backup plan on an external support.

 

[frogboy]

Backups are always the best plan and everybody should do them i think.

 

[LabZero]

Backups are always the best plan and everybody should do them i think.

Very good point, backup and recovery plan is a must regarding the safety.