system restore points

The official ESET KB article on what to do if you have a virus suggests using system restore. I have witnessed this occasionally work.

I have also heard from the big-name vendors that you should disable system restore to allow any viruses that may lurk there to be disabled.

Any opinions on which is correct? Does it depend on the infection?

I am currently dealing with a system that did have Security Shield 2011. I killed it in the task manager. A subsequent scan with ESET Online scan found the trojan and deleted/quarantined it.

 

I'd keep it enabled so that you can revert to a functional restore point in the event of a serious issue.
If malware is found in the system restore folder I, for one, prefer scanning & cleaning it under the account that has read/write permissions to that folder.

 

Hello,

Restore points are encrypted, it is a nest of false positives.

Personally, I never do scan for this files. If a system has never been infected, there is no reason why the restore points are infected.

Disable restore points is a very bad advice.

 

And how do I verify which account has read/write access to this folder?