Please feel free to ask any questions to learn all about Computer Security.

[Guest]

[Bracca]

Yeah i would like to ask about the system restore. So i am going to do a full system scan in safe mode this weekend, and decided to ask from you guys, to refresh my memory that is, that from where can i disable the system restore properly. AND, how do i know which system restore days/times to remove, if i suspect that those days might include an virus? How to be sure? And another question relating to this. Should i start my computer in safe mode with, or without internet connection included to the safe mode? I know this might be a lil tricky to understand, since my english is not quite perfect, but try to understand atleast something.

[andyman35]

To turn off system restore:
Right click on the 'My Computer' icon,choose 'Properties' then click on 'System Restore' tab.You can turn it off  there.Once switched off any restore points will be deleted.You only need to use 'Safe mode with networking' if you're intending to do an online Virus scan,otherwise you're just using the local database of your AV.

[Matty_R]

Hi Bracca,

To turn off "System Restore" you need to go to Start/Control Panel/System/System Restore/Check the box "Turn off system restore on all drives"
Also Start/Run/Type in "services.msc"(no quotes) and then find System Restore Service in the list/Right click on it and choose "Properties"/Next to "Start-up type" choose "Disabled" from the drop down/APPLY/OK

To clear Restore points Start/All Programs/Acessories/System tools/Disk Clean up/More Options/Bottom option clears all but your most recent resore points.

With regard to Safe mode it may be worth starting with internet connection so you can get the latest Virus definitions for your scanner,it`s up to you.

Regards,
Matty

[andyman35]

Sometimes malware can infect the hosts file and prevent you from updating your AV,in this scenario an online scan would be the way to go (assuming of course the online scan sites are still accessible).But we'll worry about that if it happens.

[Matty_R]

This is an excellant point and one which also got me thinking about not seeing many mentions to the benefits of having a decent Hosts file.This could well be a good topic 

[andyman35]

This is an excellant point and one which also got me thinking about not seeing many mentions to the benefits of having a decent Hosts file.This could well be a good topic 

I put forward the idea a while ago that it'd be a good idea to allow importing of a good Hosts file (Mvps or Hphosts) into Comodo firewall.

[wasted]

hi i'm new to all this but recently i installed anti spyware and registry cleaner and thought that they were pretty great until i could no longer access my 'outlook express' and 'help and support', the spyware had stopped all mail and interfered with the help options on my start menu so i just want to know if there is some way to reinstate these without further bother.? thanks.

[andyman35]

hi i'm new to all this but recently i installed anti spyware and registry cleaner and thought that they were pretty great until i could no longer access my 'outlook express' and 'help and support', the spyware had stopped all mail and interfered with the help options on my start menu so i just want to know if there is some way to reinstate these without further bother.? thanks.

Hi there and welcome to the forums.

I'm a bit confused,did you have a spyware infection or was it the anti-spyware/cleaner  that messed up your settings? If it's the latter then it's not uncommon for a reg cleaner to 'clean' needed files along with the junk.

If you were offered the option to back up your registry before cleaning then it should be a case of simply restoring the backup.If not then a system restore should clear up the issues.Hope this helps,if not please post back with as much detail as possible for further assistance.

[morgan]

Is comodo scanning my computer every night? Something is; when I turn it on in the morning all my pretty icons are gone, but that might be Mozilla. I do not want comodo to scan. Is that automatic?

I already have a virus protector (avira) and a scanner for malware (malware) so why would I need a scan? I do need a firewall but nothing else. So  (a) can I eliminate the scan  (b) why is a scan even necessary, given the other products? What do it do that they don't?

Being a newby I'm not used to this board. Will try to find this post and reply again, but would also welcome an email: leftbank[at]hotmail.com

Thangya, thangya verramuch.

[morgan]

It's leftbank[at], not [at] hotmail.com  Maybe the symbol don't travel well.

[Info-Sec]

Is comodo scanning my computer every night? Something is; when I turn it on in the morning all my pretty icons are gone, but that might be Mozilla. I do not want comodo to scan. Is that automatic?

I already have a virus protector (avira) and a scanner for malware (malware) so why would I need a scan? I do need a firewall but nothing else. So  (a) can I eliminate the scan  (b) why is a scan even necessary, given the other products? What do it do that they don't?

Being a newby I'm not used to this board. Will try to find this post and reply again, but would also welcome an email: leftbank[at]hotmail.com

Thangya, thangya verramuch.

You must occasionally scan for several reasons:

1) Lets say Virus A is detectable by avira.  However while Virus A was being downloaded Avira was disabled.  Virus A would install.

2) Lets say Virus A is detectable by avira again.  However when Virus A was installed, it is covered by  rootkit B, and avira can not find Virus A.  However in the near future avira releases a signature to detect rootkit B thus destroying Virus A HOWEVER!!  It is very possible the rootkit would mask all activities done by the virus, so theoretically the only way to detect it would be to run a manual scan.

3) This is the most common scenario:  Every day security companys release updates.  Especially with antivirus and antispyware software, it is important to run scans to detect previously undetected viruses hanging around on your computer.

Hope that helped.

[asker]

I tried Comodo Buffer Overflow utility. Defense+ and Windows Vista UAC intercepted it, but ThreatFire from PCtools did not even blink. I fully trust ThreatFire but since this test I have gone a little suspicious about effectiveness of Threatfire. Do you have any idea why ThreatFire did not react? Is it possible it recognized your testing utility as something not dangerous or did it completely fail?
I do not want to use Defense+ because it is too intrusive with warnings no matter how much I strive to silent it. Since I test a lot of software I can not afford this. I wish it was smart hips.

www.computorial.blogspot.com

[andyman35]

I tried Comodo Buffer Overflow utility. Defense+ and Windows Vista UAC intercepted it, but ThreatFire from PCtools did not even blink. I fully trust ThreatFire but since this test I have gone a little suspicious about effectiveness of Threatfire. Do you have any idea why ThreatFire did not react? Is it possible it recognized your testing utility as something not dangerous or did it completely fail?
I do not want to use Defense+ because it is too intrusive with warnings no matter how much I strive to silent it. Since I test a lot of software I can not afford this. I wish it was smart hips.

www.computorial.blogspot.com

It's difficult to say with regards to TF,why it didn't react.It could well be that it determined that nothing malicious was actually occurring.

[asker]

It's difficult to say with regards to TF,why it didn't react.It could well be that it determined that nothing malicious was actually occurring.

maybe you are right. But I would like to be sure. 
Thanks for reply andy

[Info-Sec]

maybe you are right. But I would like to be sure. 
Thanks for reply andy

Yes, threatfire is very good at alerting you to real malicious behavior.  For example a bufferoverflow may occur, but if no code is being injected, threatfire will not alert you.

[Tags:]