Virus Recovery in Vista
using Microsoft 'System Restore'
& 'Window Backup' program
-------------------------------------------
        created 9/10
                updated 3/18/13
Go to homepage

System Restore does not work right in Windows 7
        But does rescue me from a virus

Windows Backup --- Useful Windows backup program

System Restore does not work right in Windows 7 (update 12/20/12, 12/31/12) (2/14/13) (3/18/13)
        My experience is that Microsoft ruined 'System Restore' in its next operating system after Vista, Windows 7. Oh, it's still there, but it no longer works reliably. I find restore points routinely disappear, and even if a restore point it there, it may not roll back properly. I read similar complaints online. Three different times when my Windows 7 machine failed to boot I hoped System Restore would save me with this result: 1) fail (runs and reports successful roll back, but no boot), 2) fail (no restore point), 3) four repeated tries yields fail, fail, fail, (partial) success (4th time as before it reports an error, but system boots).

Microsoft admits to a Windows 7 bug deleting Restore points (2/14/13)
        In recent months I have come to relay on System Restore to recover from frequent FBI lock virus attacks that disable Safe mode, so I have been checking restore points every few days. I try and keep three points. For a while they will be stable, then one or two will disappear. I looked today and a few days ago I had three, not I was down to one, and of course not a recent one, but the oldest from about six weeks ago. Ah yes, Microsoft.

4 of 5 just disappear (update 3/18/13)
        Happened yet again! I've been keeping three restore points in recent months, and when Microsoft's weekly backup program runs it adds another one. I looked early Mon and had more restore points than usual, five. The computer ran all day even when I was out as it was recording. I look Mon evening and 4 of the 5 restore points are gone! Only the oldest, now three months old, remains. When the hell is Microsoft going to fix Windows 7? Maybe never, I guess they can't be bothered. This is what happens when a company gains near monopoly control (see my essay on Comcast cable).

Needed for virus recovery
       It is important that System Restore work, because FBI lock and related viruses in recent months have gotten more sophisticated and usually now block Safe mode, so the only recover technique that can be depended on to regain control of your machine after a nasty virus attack is System Restore. System Restore is perfect for virus recovery because what it does is remove recently installed .exe files, and this is guaranteed to kill the virus. (At least every virus I have ever seen is run by a .exe files, sometimes with a backup copy hiding on the hard drive.)

        I did a search on 'how to prevent windows 7 from deleting restore points' and turned up a May 2011 story, where Microsoft admits to a bug in Window 7 causing restore points to be deleted. Is this the only Restore Point deleting bug, somehow I am skeptical. For one thing this reports says the paging system can delete all the restore points, but I find something it taking them out one or two at a time.
        "Microsoft has confirmed an issue causing Windows 7 to delete System Restore Points on reboot. According to the Redmond company, in a specific scenario, the operating system can remove all the System Restore Points created when the user restarts the machine.

        A highly fragmented system paging file can cause Windows 7 to delete all System Restore Points at reboot, Microsoft explained. Despite having identified the source of the problem, the Redmond company did not provide a fix to resolve it." Ah yes, Microsoft!

http://news.softpedia.com/news/Stop-Windows-7-from-Deleting-System-Restore-Points-on-Reboot-199154.shtml

Works sometimes (12/31/12)
        My opinion of System Restore in Windows 7 has improved a little in the last two weeks since in that time it has saved me twice. As I describe above in 3), it took four tries to recovered from a failed boot and even when it succeeded it threw an error saying it had failed!

        Two weeks later I got hit by a variant of the infamous FBI lock virus that blocked access to Safe mode, and thus blocked the usual method of removing virus. This leaves very few ways to regain control and clean your machine that are not difficult and time consuming. The best choice in this case is to try System Restore if you have a restore point. I had several restore points including three in last two days. I chose one the day before when I knew the system was clean (as reported by anti-malware), and it worked (sort of)!

But does rescue me from a virus
        The good news is that it did roll back my machine a day removing the virus .exe file, thus allowing me to regain normal use of my computer with my files intact. The bad news is that it did not work cleanly. As it did when it finally saved me from a major system crash, it again threw an error message that it "did not complete successfully", followed by another error message 30 seconds later that "System Restore completed successfully" Yes indeed, Microsoft in action.

        I used my tablet computer camera to capture the two  message windows System Restore put up. The first 'not successful' message appears on a blue screen, and note it says system files were not changed. Clearly this is a lie, since seconds later my machine boot normally, the virus lock gone, and now I am told by Microsoft that my system has been 'restored'. Real class Microsoft...


                  System Restore throws this 'did not complete' error message                             a minute later System Restore reports 'completed successfully'
(screen captures 12/30/12)

        Just hours before I had tested System Restore when my machine was OK, the only time I have ever done so. And guess what during this test System Restore worked, restored to the point chosen and did not throw an error message.
-------------------------------------------------
Pro (Fulton)
       There is (or was!) a built-in gem hidden in the Microsoft Windows operating system, called 'Microsoft System Restore', that can safely recover your computer from a virus attack. I know because it rescued me (in minutes) from a virus that had completely taken over my Vista computer, and I didn't lose any data or programs. (update, This tool was gem in Vista, but incompetent Microsoft ruined it in its next operating system Windows7.)

Con  (Michael Horowitz)
        Horowitz (below) hits the nail on the head about what's wrong with System Restore. He was writing about System Restore on XP, but it is true of System Restore on Windows7.

        'The System Restore application from Microsoft is miserably designed and unreliable. This is really annoying, because it can be useful. Such a  application could only be produced by a company with no competition in the marketplace. You need to periodically check up on it because it breaks and turns itself off without telling you! And needless to say, it is not documented in any way that would be of any use to a non-technical person.' (Michael Horowitz on Cnet in 2007)
Serious bug! (1/22/11)
        Even though Microsoft says Restore points will be created automatically on a regular basis, I am finding this is simply not true. System Restore Help on my Vista portable says restore points will be automatically created daily.  System Restore Help on my Windows7 says restore points will be automatically created weekly. Neither is true. When I checked both machines (which have been in active use), the last restore point on both was over three months old! What the hell is going on?  I manually created restore points on both.
Missing restore point test (Aug 2011)
        Have been monitoring and testing Restore to see if I can figure out why it is deleting my restore points. I made this task easier by creating icons on my desktop to open Restore and to make restore points. One by one over a week I made three restore and periodically checked they were all there.

 (8/15/11) On Mon morning I find no restore points, all three have been deleted by the Windows7 operating system. What is so maddening is that the system does this behind your back (no notice)! Microsoft auto backup was scheduled to run last night (7:00pm Sun), but not sure if it did because computer was shut off around that time. (Checked, it did run). A search for deleted Restore points has turned up little of interest. Microsoft system info says: "Restore points are saved until the disk space System Restore reserves is filled up". I read one way restore points get deleted is if the disk is full, but I checked this morning and my c:\ drive has 68 Gbyte free. 'System Protection', which runs System Restore, shows:

                                Current Usage (one restore point)        285 Mbyte
                                                          (two restore points)      575 Mbyte
                                Max Usage                                                   6.4 Gybte (1%) (old)
                                                                                                    13.4 Gbyte (2%) (new)

        System protection was Off for D drive (system backup) and 2Tbyte drive, so I turned them both on. This should make no difference to c:\ drive restore points. (All drives have Restore set full on -- system and personal file backup)

(8/21/11) Mon I find the three restore points I added 8/15 ('install') still there plus a 4th point has been added automatically ('system') Sun night at 10:53 pm. This was just after I turned on my computer Sun evening, it having been off during the normal scheduled backup time of 7:00 pm. This restore point was evidently triggered by the Microsoft Backup program, which a few minutes after this restore point was made did a full backup.

(8/28/11) Sun  One hour after the regularly scheduled Sun 7:00pm backup I check and find all my previous restore points are gone! They have been replaced by a single restore point that was created just prior to the auto backup. Labelled 'Automatic Restore point', type: System, dated Sun 8/26/11, 15 sec after 7:00pm. This was a full backup. To this I manually added a restore point, so as of 8:00 pm today I have two restore points. So from this tracking its pretty likely that Microsoft Auto backup must be deleting Restore points! What is this, an undocument feature?

(9/2/11) Check of my Vista portable shows it has 20 or so restore points going back over a year! Vista is not willy nilly deleting restore points, why is Windows7? Also just installed a (freeware) video capture program (Freecorder 4 from Applian.com) and no Restore point was made by the system! An install is supposed to trigger a Restore point creation and usually does.

(9/4/11) Mon and check of System Restore shows pattern of earlier weeks repeating. Again my two restore points from last week have been deleted by the system, replaced by a single restore point that was created 8 seconds after the 7:00 pm scheduled auto backup (labelled: Automatic Restore Point, type: System). It is clear that the Microsoft auto backup program when it runs deletes (without telling me!!) all previous Restore Points (with their comments) replacing them with a single restore point.

(9/10/11) On Thur I had four restore points (two created my me and two by the system). I look two days later (Sat evening) and three are gone, only the latest created last Wed remains! This is just nuts. There have been no significant events in the last few days. System Restore on Window7 (Home) is a buggy mess. Next day Sun morning I add a 2nd restore point (did not confirm). Sun at 6:00 pm (1 hr before auto-backup) I check and only the point I created Sun morning is there, the older one from Sat is missing.

(9/19/11) Mon. Happened again, the two restore points on Sat are gone replaced by a single new restore point created at 7:00 pm sun,  the time the auto-scheduled Windows backup programs runs. At least one pattern is now clear the Windows7 auto-backup programs deletes old restore points! This is either a completely undocumented feature of Restore and Backup (!!) or, more likely, is a bug!

(9/21/11) Wed. Two days later I look and am told no restore points at all exist! This deletion I can maybe explain. My daily auto-recording of some TV shows came pretty close to filling up my c:\ drive, however, I don't think I went below 1 to 2% of the drives 737 Gbyte capacity. I have now freed up some space, will measure capacity before and after making a restore point.

                                        Free c:\ space (no restore points)          67.308 Gbytes
            (3 min later)      Free c:\ space (one restore points)        66.605 Gbytes
                                                                                        --------------------------------
                                                                    Restore Point space       0.703 Gbytes   (0.1% of disk drive capacity)

(9/22/11) Thur. There is no gainsaying it, Micrsoft's System Restore in Windows7 (Home) just does not work right! One day later, with 80 Gbyte free, and the restore point I created yesterday (and I checked was there) is gone! I have no restore points! Again! What a piece of crap this program is on Windows7.

(9/28/11) Wed. I monitored my restore points daily for the last week. There was one restore point (created by me) prior to auto-scheduled Sun 7:00 pm backup. Unlike previous weeks this Sun's backup made a new restore point, but did not delete the old one, so Mon & Tues I had two restore points. I just looked Wed evening and no restore points!! (60 Gbyte free)

(11/3/11) The pattern of restore points ramdomly disappearing has continued for last few months. They get made by weekly auto backup,  an occasional install, and occasionally by me, and they randomly disappear. With none found (restore inoperative) even with constant monitoring maybe once or twice a month.

        Today had a chance to test the disk space issue. I am using c: drive as DVR for auto auto-recording of TV shows, so it reduces disk space daily, the space recovered when I watch them, delete them and empty the Recycle Bin. This morning while recording way going on I awoke to a low Disk Space warning flashed by system. Check showed only 140 Mbyte, I checked Restore and still one point. I had not realized recording was going on, so when I checked a few minutes, Explorere showed 0 Mybte. A quick check of Restore still showed one recovery point! It was not deleted even with zero disk space. Another confirmation that disk space had nothing to do with deletion of restore points.

        And another Restore weirdness apparently, because program description says it will delete Restore points when disk space is low. Isn't 0 disk space low?  But wait, another few minutes later (delay due to writing this), I checked Restore again and now no recovery points. Rechecking c: disk space shows disk space has increased about 4 Gbyte (26 => 30 Gbyte), so apparently 0 disk space did with a delay trigger a Restore point deletion, freeing 4 Gbyte.

**        It's totally unreliable. I also have read several posters complaining that when they really needed it on a Windows7 machine, it ran but did not restore. And this was my experience too. The only conclusion that can be drawn is on a Window7 (Home) machine Microsoft System Restore is a piece of shit. Microsoft took a good program and ruined it.

I am not paranoid!
        Am I going off the deep end complaining about missing Restore points and other bugs in Microsoft Restore. Well check out below from a computer consultant on Cnet. I found his article, 'No Restore Point for You', in the reference list of the Wikipedia article on System Restore. It's from 2007 and was discussing Restore on XP, but I don't think much has changed, because in 2011 this is exactly what I am finding with Window7 Restore: it breaks, it turns itself off, and it doesn't tell you! And he had same problem I do, Restore points for no understandable reason disappear. Plenty of disk space is allocated.
        "The problem with System Restore is that it's a miserably designed application, one that could only be produced by a company with no competition in the marketplace. You need to periodically check up on it because it both breaks and turns itself off and in neither case does Windows XP tell you that anything is wrong (you can't make this stuff up)."

        "System Restore can be, and for me has been, useful. That's why it's so annoying that the application is unreliable and poorly designed. And needless to say, it is not documented in any way shape form or place that would be of any use to a non-technical person." (Michael Horowitz on Cnet in 2007)
http://news.cnet.com/8301-13554_3-9838164-33.html

Dozens of complaints
      Found a so-called Microsoft 'Answer' forum with dozens of posters complaining about Restore Points disappearing (often at boot), and they are incredulous. Typical posts from the last year or so (2010-2011):
        -- What is the problem here?  This new operating system can't do system restore in Windows Professional.  Why isn't there a fix for this problem already?

       -- Guys I am also facing the same problem with my windows 7, the restore point gets deleted after restarting the computer. I have went through all the forums and didn't find any resolution.

        -- I'm in that excellent company too, with the same problem. Perhaps if EVERYONE with the same problem posted, Microsoft would do something about it.

        -- Frankly, I think that Windows 7 has serious flaws with their system restore functionality. This seems to be echoed by ALL of the many other complaints / comments in this thread.

        -- Manually creating a restore point is okay but after rebooting it just disappears. I have had this problem the first day I installed Windows7, and I believe that it must be a bug, since System Restore works fine on my other computers running Vista and XP.

        -- I need to restore my Windows 7 and tried all that is posted here, no go, I cannot believe that Micrsoft does not know about this! Its disgusting that a major feature is not working.  Microsoft listen, I and others will continue to find this major flaw and shout out on the net till you fix this! Forget windows 8 and the cloud, fix the software you are making billions on first.

        -- It would be something if Microsoft could just admit there are some glitches with System restore, instead of outlining the usual steps on how to use System Restore which 90%+ of all the people posting here are quite familiar with and have followed. Worst of all Microsoft then label threads like this as answered, when in fact it is NOT ANSWERED!

System Restore lies to you
        I just noticed what System Restore tells me when I try and start it after Window7 computer has just deleted my two restore points. . It does not say there are no restore points or it cannot find any restore points, no it says this: "No restore points have been created on you computer's system drive." That's rich, after Window7 deletes (behind my back) all my restore points, it then turns around and tells me that no restore points have been created!

Like Windows 7 search
        System Restore is apparently like Window7 file search, a major OS tool that does not work properly. This tells you a lot about Microsoft, and I'm sure reflects very badly worldwide on the USA technology reputation!

Create Restore Point utility
        To make creating manual restore points easier I downloaded a free utility ('CreateRestorePoint.vsb' from howtogeek.com). Now my just hitting an icon on my desktop I create a restore point. The program works fine. It is a VBScript script file, a type of file about which I know nothing. It has a suffix '.vbs' and clicking on it runs it. Error messages show it may run under something called the 'Window script host'.

How to recover using 'System Restore'
        Here is how to find and use Window's 'System Restore' to safely recover from a disabling virus attack. Microsoft 'System Restore' is a system utility included with all XP, Vista and Window 7 operating systems, but it is little known, and on my Compaq computer it really is hidden and navigating to it at boot is difficult. Note 'System Restore' is a completely separate program from the similarly named (Microsoft) 'System Recovery'. Do not run 'System Recovery' unless you are desperate, because (unlike 'System Restore') 'System Recovery' wipes out all your programs and data!

                 1) At boot press the function key to get into the 'recovery' system. In my HP computers it's F11 at boot to enter 'System Recovery'

        Alternately, if your computer boots, you an access 'System Restore' like any program. It's under Accessories/System Tools.  (Start/All Programs/Accessories/System Tools/System Restore) or (in Start box type 'Restore' and select 'Open System Restore')
                 2) Navigate through a couple layers of menus to the list of recovery programs. My HP computers have 4 or 5 choices. (ignore text on these screens, which oversimplify) Look for the option called 'Microsoft System Restore' (it will tell you your data is safe). Be very careful not to select the similar sounding 'System Recovery' (it will tell you it will reset your computer to factory condition).

                3) Run 'Microsoft System Restore'.  It will bring up a list of dated available 'restore points'. Choose the one just prior to the virus attack, and hit OK.

        That's it. 'Microsoft System Restore' using data stored on the recovery portion of the hard drive will take a few minutes to update all system files and the registry to be as they were at the time the restore point was created. The virus code may still exist somewhere in a file, but it is no longer linked into the operating system, it's been neutralized, rendered harmless. When the computer next boots, it should be OK, Your operating system will have been rolled back in time, but not your data files. They should be totally unaffected. Any programs or drivers installed after the restore point time will need to be reinstalled.
------------------------------------------------------------------------------------------------------------------
Intro
        I wrote this essay right after 'Microsoft System Restore' rescued me from a virus that captured my Compaq Vista portable. In my HP/Compaq computers F11 at boot (confusingly labeled 'System Recovery') provides access to several recovery tools, one of which is System Restore.

My recent virus story
        I am on a vacation trip with my portable, browsing online and thinking about how to reply to an important email, when all of a sudden my browsers are down, all of them. Clicking on any browser (Opera, IE, Firefox) just brings up what I know is a spurious Microsoft Security alert. Since I am away from home and have access to no other computer, I have suddenly lost email and internet access. What a nightmare. My only option is to play with boot options to see if I can figure out how to roll back to an earlier time. (At this point I know next to nothing about system restore or even if I have any recovery points.)

        In the past with a lot of work (file date searching, looking at running processes, etc) I was sometimes able to manually recover from a virus, but in recent years manual virus removal rarely works. New viruses are very clever at hiding. Ctrl-Alt-Del interrupt can be disabled, and one virus I caught was even specifically designed to hide from the general removal tool HiJackThis. (HiJackThis didn't show any new or unusual programs running this time.) Sometimes, assuming you have access to another computer, you can find posters recommending a (free) removal tool that works on your particular virus.

        My recent good experience removing this most recent virus from my Compaq Vista computer has led me to believe that best virus removal tool is 'Microsoft System Restore'. I might have lucked out, because I had really never paid any attention to System Restore, but I found it had a lot of recent restore points, even one only about 12 hours before the attack (I selected that one). It assured me it would not disturb my personal data, so I took the risk and in 2 or 3 minutes my computer was back to normal and (as far as I can tell) it is now virus free. (Well it's effectively virus free. Virus code fragments may still exist on my computer, but since they are no longer hooked into the operating system, the virus has been rendered harmless.)

System Restore to roll back to an earlier time
        I started writing this essay the day after my recovery from a virus on my Compaq Vista to document the process. I now think it will work on my new HP Windows 7 machine too.  Initially I don't know if 'System Restore' was part of the Microsoft Vista OS or was a bios enhancement added by Compaq. I now believe that 'Microsoft System Restore' is (very likely) part of the Microsoft's Vista and Windows 7 OS's and that Compaq/HP just provides access to it (along with a few other recovery programs) via F11 at boot (labeled 'System Recovery').

        In an emergency using System Restore (via F11, System Recovery) is far from being easy (or risk free). I view it as programmers doing things their way with little concern for the general computer uses. As long as the process is functional, they seem to care little about making it user friendly. For example, at one point a blank blue screen comes up and just sits there a long time. No progress bar, no circulating little arrow, just a blank screen. You have no way of knowing if the recovery process is continuing, if it's hung, or how long it will take. Totally user unfriendly. Since I was desperate, I waited, even though I was beginning to suspect it had hung, it was running and in a minute or so the blank screen cleared.

        Another serious complication with restoring your computer to an earlier time is that 'Microsoft System Restore' (the data safe system roll back program) is lumped in with other confusingly named programs like 'System Recovery' and file backup and restore. Even worse in my Compaq Vista I had to click 'Advanced Recovery' just to navigate my way to 'Microsoft System Restore' program.

'System Recovery' trap
        'System Recovery' program is the name of one of the recovery tools access by F11 at boot (under the label 'System Recovery'). Unfortunately its name is very similar to '(Microsoft) System Restore', and both are listed on the boot recovery screens. But 'System Recovery' is to be avoided at all costs, because it is a destructive clean reinstall of the OS. It should be used only as a last resort, because you then have days to weeks of work ahead of you reinstalling and setting up all your programs, not to mentions lost data. Over the years I have had to use this option only once to clear a virus.
----------------------------------------------------------------------------------------------------------------------
Compaq Vista portable
recovery process

System Restore details
        Here is the process in detail for my Compaq Vista portable. The first problem I ran into was figuring out how to get started, how to get into System Recovery. On the boot screen six boot options were shown but they flashed so briefly (1 sec) I couldn't read them. I must have done this a dozen times. I looked at the bios to see if there was a way to extend the time, but no luck. By staring intently I eventually figured out it was F11. (I later found out that in my case I could have accessed 'System Restore' like any program since my computer was booting. However, it was not an option because a) I didn't know what to look for, b) what it might be called, or c) where to look, so I think boot access (via F11 or eq) is by far the best way to begin a virus recovery.)

        *   F11  ' System Recovery' (at boot)

        F11 brings up progress bar(s) 'Loading files', then  blank blue screen. After 10 sec or so, a warning tells you to switch to external power to continue. Up comes the 'Compaq Recovery Manager' screen. This screen is extremely misleading, because it the center it says only "Use this program to recover your computer to its original factory condition." In other words a clean reboot wiping out everything you have (although it doesn't here tell you this!) At the bottom is an "Advanced Options" button, and this (I now know!) is what you want.

        *  'Compaq Recovery Manager' screen.  Choose (at bottom) 'Advanced Options'
                        Ignore "Use this program to recover your computer to its original factory condition."

        'Advanced Options' brings up four choices: 'Computer checkup', 'Microsoft System Restore', 'File Backup program' and 'System Recovery'. Clicking on them (one at a time) brings up some info on what they do. From the names it's not clear if we want option 2 (Microsoft System Restore) or 4 (System Recovery), but the text makes it clear we want option 2 ('Microsoft System Restore', restore to an earlier date) and not option 4 (restore to original factory condition).

        *  Option 2, 'Microsoft System Restore' (restore to an earlier date) screen

        Clicking option 2 it says you are leaving (Compaq) Recovery Manager, so apparently F11 boot enters a Compaq Recovery program that hands off to Microsoft for restore to an earlier time. A kludegy indirect way to get to an important virus recovery function! This then brings up the long, sustained blue screen I talked about above (very unfriendly, because using this for the first time you are given no clue how long this will take or even if it is running).

        In about a minute up comes a screen that just says 'System Restore'. There is no indication on this screen that this is from Microsoft. The screen subtitle is 'Restore system files and settings', and text says it can 'help fix problems that might make your computer run slowly or stop responding'. More misdirection. The Compaq screen that directed us here said the purpose was to recover to an earlier time, but this screen says nothing about recovering to an earlier time. However, it does give assurance that 'System Restore' will not affect your documents, pictures, or data. When you click for more info on 'How does System Restore work' you get bubkas ('Help not available' in this running mode) Well that's sure friendly, so no choice but to click next:

        *  'System Restore' screen (next) => 'Choose a Restore Point' screen

        My expanded Restore points list (earlier than five days) shows about 30 recovery points going back about 12 months. They are labeled as triggered (prior to) a program install (program is given) or 'System: scheduled checkpoint'. I choose a recent check point (before the infection, of course) and in a few minutes the files load, the process runs, the rollback is done and the virus is gone!

Is there a recent system restore point?
        There are three things needed to make this an effective virus recovery process. The first is navigating around the dangerous 'System Recover' program (a trap) and into the safe 'System Restore' program with its list of dated available 'restore points'. The second is that there actually be Restore Points, which means 'System Restore' had to be enabled before the virus (it's enabled by default). Third you want a restore point that (ideally) is fairly recent, because too old a restore point may wipe out recently installed programs and drivers. (I found a restore point less then 24 hours old.)

Scheduled daily restore points
       When later I went into the Vista Control Panel to see how restore points are set, it said they were automatically set every day. This is a good thing, this is what you want (assuming you have the disk space). I don't remember ever setting this up on this machine, so I assume it must be the Vista default. (It is.) It said it can take up to 15% of the hard disk space for the saves that and when filled new restore points replace old restore points. I go for periods of time not using my portable, so there were lots of gaps (I had about 30 restore points going back about 12 months) with one stretch of three consecutive daily scheduled restore points.

Vista Control Panel
        Searching for 'restore points' (or 'create') in Control Panel brings up screen:

        * System Properties, System Protection (tab)

        This screen allows a restore point to be manually created. I did (took about ten seconds), but what we want is to be sure they are created automatically, and this screen is no help. I click 'System Restore' button (only other choice) which does nothing (tells me the 'system wizard' is already running. What?)  Can't figure out how to see (or set) automatic restore points, then in Restore FAQ under 'How often are restore points created?' I find this:

        -- "Restore points are automatically created every day, and just before significant events like installation of a program or device driver. You can also create restore points manually."
        So from FAQ it looks like (in Vista) the interval between automatically generated restore points is fixed and that it's daily, but look at how wonderfully well this info is hidden! No wonder I didn't know this. In Google searches I later find that time interval between auto generated restore points is set by a registry setting called 'RPGlobalInterval' (see below).

Vista  Control panel: System/System Protection
        I looked for a more direct way to get to the system properties screen. I found it in the Control Panel under 'System' icon, then select 'Advanced system settings',  System Protection tab. (Shortcut: System/System Protection) Surprisingly the 'Security' icon in the Control Panel does not appear to link to the System Restore function.
--------------------------------------------------------------------------------------------------------------------

HP Windows 7 desktop
recovery process

Windows 7 Summary
        'Microsoft System Restore' in Windows 7 works pretty much the same as in Vista. In both my Compaq Vista portable and HP Windows 7 desktop F11 at boot (labeled 'System Recovery') is the way to navigate to System Restore. The only significant difference I found was that Vista by default generates restore points daily, whereas (supposedly) Windows 7 generates them weekly. (I tweaked the Windows 7 registry to up the rate to daily. This is done by adding the Vista variable (RPGlobalInterval) to the registry and setting it for the number of seconds in 24 hours.)

How about Windows 7?
        The System Protection screen in Windows 7 is accessed the same way as in Vista: Control Panel, System/System Protection. I found in my Windows 7 machine that System Restore was on for c:\ disk, but off for d:\ disk (and off for external USB drives). Since it was on for both c:\ & d:\ in my Vista portable, I turned d:\ on too. I manually created a couple of System Restore points from this screen, which was quick.

Control Panel: Recovery
        The Windows 7 control panel has a 'Recovery' icon and this directly accesses System Restore, the system roll back feature. (There is no 'Recovery' icon in the Vista Control Panel.)

Restore point issues
        When I looked at the list of restore points on my new Windows 7 machine, all I see are the two I created manually a few minutes ago and a few from a couple from a few days ago when a program was installed. Two things bother me:

        The first is that, unlike Vista, restore points do not look like they are being created automatically on a schedule. (Later I read they supposedly are, but the rate is weekly. I didn't see this because for some reason my restore points only went back three days.) I can see that they are being created by system events like installing or uninstalling programs. I don't see anyway to begin automatic scheduled restore points. (Later I find this is correct. There is no way to set or adjust automatic Restore Points through the graphical interface. It must be done via registry tweaks. Well, that's consumer friendly.) There was no way to change in it in Vista either, but at least in Vista I could see that scheduled restore points were being made.

        Another issue is that I have installed a lot of programs in the last few weeks, so why aren't there a lot of restore points? My Vista had 30, here there are 6 (2 of which I just manually created) going back only three days. Is the allocated restore disk space too small, so they are being deleted too frequently? Didn't seem so, it was set at 10 Gb and I was told restore space currently was 1.3 Gb (2 Gb after I set another restore point). For good measure I increased the maximum disk space for System Restore Points from 10 Gb to 50 Gb (7% of total space, still less than Vista, which is 15% of total space). Later I show 12 Gb allocated for 8 restore points, so it looks like it is about 1.5 Gb/restore point).

Google 'Restore Points' search
        --  I see a poster complaining that his Vista is not creating restore points daily (as it should). I see the same odd pattern: a few daily points and then big gaps (but since my portable is my backup machine, I could not draw any conclusion from this.)

        -- One poster (no date, no OS) says automatic restore point interval is set in the registry at location below.

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore
        (variable) RPGlobalInterval             normally set to 86,400 seconds (24 hours)

        My Vista does indeed have RPGlobalInterval variable set to 86,400 (decimal) at the location listed. Windows 7 has a SystemRestore registry area at the same address as above, but the interval variable, RPGlobalInterval, is missing! Will adding it start daily automatic restore points? (Supposedly yes)

Every seven days is default in Windows 7?
        One poster reports he had been told that scheduled restore points are made every seven day in Windows 7 (if not created by a system event).  But neither he (or anyone else I read) seems to know where or how the weekly rate is set. He was able to add the RPGlobalInterval variable to the System Restore section of the registry.

 My comment
        Why is automatic restore point info not available in the Control Panel? Frequent restore points are essential for virus recovery to work well. Why are they virtually not mentioned or documented? The way Microsoft does things is absurd.
Another poster replied, the Windows 7 restore points are located here:  (I looked, it exists, but I see little info here)

                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\STORAGE\
                VolumeSnapshot\HarddiskVolumeSnapshot1

How to set up daily scheduled restore points in Windows 7

** Here is the key info (from post below, Jan 2009)
        http://windows7forums.com/windows-7-support/35141-system-protection-settings.html

        In the Right hand pane of the registry Editor you should see a DWORD called RPGlobalInterval. If this DWORD doesn't exist (it is not there), then create one by right-clicking on the System Restore option and selecting New then DWORD from the drop down menu
        The RPGlobalInterval default setting should be 86,400 (sec, decimal (24 Hours)). To reduce this restore rate to say, every 12 hours, Right-click on the RPGlobalInterval Option and, from the drop down menu, select Modify. In the Modify dialog box first change the Base to Decimal and then type 43200 (sec) or whatever period of time you want the restore point to be created in the Value Data box. Next click OK.
Daily System Restore Points are now working in Windows 7?
       **  I have added the RPGlobalInterval (variable) as a DWord (it was DWord in Vista too) to System Restore area of registry (location shown above) and set its (decimal) value to 86,400 (sec). Will need to check in a few days to see if restore points are being created and how much disk space they are using.

How to access System Restore at boot?
        My power up Compaq Vista boot screen text shows F11 'System Recovery', and it leads to 'Microsoft System Restore'. I went looking for how to get into System Restore from the boot screen of my new HP Windows 7 machine. Yikes! There are now no onscreen messages during a normal boot! There used to be. I know there was a splash screen with boot options, but it's gone. I am still having occasional boot problems, so I had changed the bios to make boot more verbose. Now I find that this has removed the splash screen with the boot option 'crib notes' text. This is bad design.

        This is ridiculous. If boot messages are gone, how do you every get back into bios to turn off the verbose boot mode? (I happen to remember F10 accesses bios, but only because I used it a few days ago. And sure enough when I used F10 to turn off the verbose boot mode, the initial blue screen with bios messages came back.)

        Well when I get into System Restore in Windows 7 I find out it is pretty much the same as in Vista. The Compaq/HP screen are different, and less friendly than Vista. There are now five options under 'System Restore' vs four in Vista. In Vista you can click on each option and some text tells you about what it does. In Windows 7 you now must click each (for real) entering a new screen to figure out what they do. This is of course more risky because if your unfamiliar with these screens there no guarantee you can get back (you can). But still this is not an 'upgrade', it's a downgrade. The new Windows 7 option here is Microsoft Startup Repair Tool.

Microsoft Startup Repair Tool
       So checking out the options, for fun I click the Start up Repair tool, and it just starts! Yikes. Not only that but when I click Cancel (only button not grayed out), it tells me you cannot cancel this program. It says it takes minutes to run, and it does! Your machine is locked up. Another monumental example of bad design. (And to quibble, if Cancel is not active, why isn't it grayed out?) Gees...

        The screen of this tool says it will automatically repair any start problems found, but it provides zero info on what it is doing (if anything!!) while it runs. Of course the repair tool finds nothing, and when I click on the Details button, there is almost nothing there. Another poorly designed boot interface dressed up to be 'easy to use'.
-------------------------------------------------------------------------------------------------------------------

Related topics

Idiot names
        I think there is something weird about programmers. Why can't they take off their expert hats and look at their creations from the perspective of a non-expert? A classic case (I would argue) of idiot naming is

System Recovery    vs    System Restore

        These generally show up on the same menu when a user is trying to fix his computer, and he must choose which to run. Look at how close these names are. The first irreversibly wipes out all your stuff and the second is quite benign and reversible.

        'Recovery' and 'Restore' are not only visually similar, but their meaning are very close too. When I was writing this essay, I would repeatedly write one, when I meant the other. I contend that even if you know one of these programs is a reinstallation of the operating system and the other a rollback from the names alone you can't make a reliable guess as to which is which. In fact I think 'Recovery' seems like it ought to be the rollback and 'Restore' the reinstall.

        Why aren't the name changed so they are clear? (Or if for historical or continuity reasons that is a problem, then add a secondary name.) I would suggest this

System Recovery    =>    System ReInstall
System Restore       =>    System RollBack

But apparently this is just to difficult for the boys in Redmond Washington.
---------------------------------------------------------------------------------------------------------------
History of System Restore
        I did a little Googling and found that 'System Restore' was added to the Microsoft OS with XP and in pretty much the same form is in Vista and Windows 7. too. I see technical writers like it and consider it stable and reliable. It's reversible too. After a Restore, I read a menu option asks if you want to undo the Restore, and it then puts back what it took out.

What it does?
        The (apparently) oversimplified description is that it restores the operating system files and the registry to as they were at an earlier time. I read that it works by file types. It changes program file types like: .exe, .dll, but not document file types like .doc, .jpg, or .html. (This is the basis for them saying 'it will not affect your data'.) I found a long list of file types it changes.

        What I do not see is that the changes it makes are limited to specific directories, for example, directories used by the operating system like 'Windows'. So are .exe and .dll files of your applications also changed? Or suppose you are a programmer and are compiling files to make .exe files in a directory you have created. (Even I used to do this in Dos days writing an editor in Turbo Pascal.) Is the .exe file you generate going to be changed in a Restore?

        Calls for a little 'Restore' test: make a restore point, make a new .exe file in a local directory, then do a restore and see if it is still there!

Restore for virus recovery?
        The first purpose usually mentioned for 'System Restore' is recovering from driver problem. One writer says he makes a restore point before he installs an old program that his thinks might make the system unstable. So it seems like a general recovery tool.

        But when I googled 'Microsoft System Restore' and 'virus' I find very little. I doesn't appear to be widely used as a virus recovery tool. Why? I did see one technical writer who said it was useful for virus recovery. Another writer said it should absolutely not be used for virus recovery. He argument was a virus may write a file and since Restore doesn't affect any data files it will still be there. The virus has not been cleansed.

        No   ---  http://ph.answers.yahoo.com/question/index?qid=20100623195253AAKGZ6o
        Yes  ---  http://www.ehow.com/how_6566104_restore-computer-rid-virus.html

        But my response is, so what? The virus I got must have linked into the system's internet access routines because when I ran any browser it blocked internet access and threw up phony Microsoft security graphic. That graphic is probably still on my machine, but so what? Seems to me if the virus hooks into the operating system are removed, what's the difference if chucks of virus code remain? (I can see it might theoretically make it easier to reactivate the virus, but I can't get too concerned about this.) What I know for a fact is that Microsoft System Restore nicely neutralized my virus, and my machine appears to be totally back to normal.

        Here's an endorsement. Anti-virus software uses system rollback! (from a review of Kaspersky Lab  Anti-Virus program. Kaspersky is probably just calling Microsoft System Restore!)

        -- "For those not using Microsoft’s 'System Restore', Kaspersky Anti-Virus can safely roll back any changes made to the system by any viruses or malware."
        In the user guide that came with my HP computer I find
        -- "If you have a problem that might be due to software that has been installed on your computer, use System Restore to return the computer to a previous restore point."
        Not an explicit endorsement by HP to use System Restore for virus recovery, but a virus or worm can be looked at as software 'installed' on your computer, but without your permission.
---------------------------------------------------------------------------------------------------------------
Not Fat32
      FAQ points out a (big) limitation of System Restore. It only works with NTFS file system and will not work with Fat32 disks. (Vista and Windows 7 c:\ drives are NTFS, but some of my external USB drives are Fat32.)
--------------------------------------------------------------------------------------------------------------
(Update 1/15/11)

Missing Restore Points!
        Maybe I did luck out recovering from a virus last summer on my Vista portable. There I had found 30 recovery points (all created automatically), one only 12 hours old.

        I just checked by six month old Windows7 desktop computer and find only two restore points, and they are both over three months old! The help for System Restore says this:

        -- "(Restore points are) also created automatically once every seven days if no other restore points were created in the previous seven days, but you can create restore points manually at any time."
        Yikes! This is clearly not happening even though months ago I took steps to see that restore points would be made automatically including changing the registry as I detailed above. Help says the system will automatically make restore point if "System Protection" is turned on. I just checked and "System Protection" is on for all my drives including the c: and d: drives!

        On top of this when System Restore is started I can find no link to make a restore point. Why not, this is ridiculous. I know they can be made manually, but where is the link hiding. A search of Control Panel brings it up. It is hiding under 'System Properties' of the computer in a tab called 'System Protection'.

        Yikes, yikes when I request that a restore point be created manually I get a message that the restore point could not be created because "the disk structure is corrupted and unreadable" (Please try again). Another nitwit error message from Microsoft. Firstly, this is news to me that I have a corrupted unreadable drive, and 2nd, it doesn't tell me which drive is unreadable. I have system protection turned on for four drives (local  c:& d: and external USB drives f: & j:), so I am making four restore points. Microsoft can't be bothered to tell me which of my hard drives it considers unreadable!

        I turn off System Protection for the two USB drives (both show restore points taking up 10% or so of allocated space.  When I turn off the System Protection, it deletes the restore points for these drives, setting the used space to zero. I then again select create a restore point manually and this time it says success. I check the System Restore program and it now show my just created restore point along with the two old points. So the problem is in one of the USB drives. I verified that both drives are NTFS, because System protection only works on NTFS drives.

        I go into disk drive properties. There's a button to check the disk (it runs ChkDsk). It checks the 160 Gb f: drive in a couple of minutes and reports no problems found. Errors were found and corrected on the 320 Gb j: drive. I turn System protection back on for f: and j: and again select create restore point. This time it is successful for all four drives.

The remaining big problem is --
            Why are store points not being created automatically?

        Did my registry setting I added interfere them being set?  Or did the (fixable) disk drive errors I found on one of my external USB drives prevent the important c: and d: restore points from being set (With no error message!)?

Microsoft reply
        Found a posting in a Forum where poster said his Vista used to created restore points daily, but it has stopped, and he wants to fix this. Here is Microsft's reply (first she claims Vista should create restore points weekly, but this is not what Vista help says)

This issue can occur due to the following causes:
1. The Automatic System Restore point depends upon Task Scheduler service, though Scheduled Tasks will not show System Restore as a job. System Restore Checkpoints may not be created if Task Scheduler service is Stopped.
2. System Restore requires the machine to be in an idle state to create system check points. This is by design so that System Restore never intrudes when the user is using the machine by taking processing power to create a system checkpoint. Hence, if system restore never sees any idle time on the machine, it will not be able to create System Checkpoints. This usually occurs if an virus scan is running and the anti-virus software is running.
To troubleshoot the issue, please click start, type services.msc and press Enter, double click on both system restore service and Task Scheduler service to make sure the startup type is set to Automatic.
(Another Microsoft type says Volume shadow copy needs to be running)
        OK, tried this. I typed 'services.msc' and Task Scheduler is set to Automatic. There is no 'system restore service' that I can find. I did a control panel search for 'system restore service' and it comes up blank. Typical Microsoft.  My Volume shadow copy is set to Manual.
================================================================
Windows Backup --- Useful Windows backup program (7/11)

(update 12/20/12)
Over two years continues to be a useful utility in Windows 7
       This Microsoft auto backup has continued to work reliably and unobtrusively for the last couple of years on my Windows 7 machine. Every Sun at 7:00 pm it writes an unencrypted copy of files that changed in the previous week (monitoring directories that I specify) leaving a trail of dated backup files on a large capacity USB drive. Over two years and three system crashes this weekly backup has limited my work loss to no more than a few days. It does that a little time to dig out what you want from the archive, but it's there.
----------------------------

        My experience over the years with Microsoft backup programs has been uniformly bad. I never really tried to master them, but on casual use they never seemed remotely useful. The backup files they made seemed to be large single encrypted files that I could never figure out how to use, how to extract a file I might want.

        Well, after reinstalling Windows7 after my April 2011 crash, without much hope I activated a weekly automatic backup built into the Windows7 operating system. Now after three months I can see what it is doing, and SURPRISE I find I can recover individual files without any hassle. It actually looks useful!

        Microsoft being Microsoft the backup files generated are well hidden. Looking at the top directory for a recent date doesn't work. The USB drive where I put them is nearly empty, otherwise I may not have found them. As far as I can tell Microsoft does not tell you the filename (automatically generated) that it will use. Here is a capture of the explorer view on my computer showing the backup file structure.


weekly incremental backup
(two .zip files, 1-2 Mbyte size)

        Once you find them the backup files are reasonable named, but they hide under a totally non-descript Windows generated directory that on my HP machine is named 'Window7-HP'. Well that's clear! The weekly list of backup directories is clearly shown here, all listed under a directory called 'Backup Set...', which shows the date I started the backups. The program runs automatically at 7:00 PM on Sunday, which is reflected in the dates of the backup files.

Overview
        I apparently set up the backup program to only backup a few directories where I keep my personal files: Spfiles, home_pg, and upload.  (When I checked, I found I selected c:\speed to be backed up, so the subdirectories that show above are those with files that changed during the week.) What the program appears to have done is make a general backup the first time it ran and in subsequent weeks it is doing incremental backup, backing up only files that have changed. This makes the weekly backup files small, typically about 2 Mb. However, I cannot seem to locate the general backup with all the text files!

Structure of the files
        I expanded one of the incremental weekly backup directories above to show its structure. It is very curious. The files are in two '.zip' files named Backup files 1 and 2. The 'upload' directory has mostly 'htm' files and various graphic files. When I open 'backup files 1.zip' directory I find the changed .htm files (listed individually), but they are compressed (about 50%). In  'backup files 2.zip' I find the various new graphics files added that week (listed individually). These are not compressed and have their normal '.jpg' ,'.png', etc file suffixes.

        The uncompressed graphics files, of course, can easily be accessed. They are normal files. Surprisingly the compresses .htm files seem just about as easy to access. Not sure why this is. As you can see above, they have their normal suffix, 'htm', but their size shows they are compressed. Not sure if an extraction tool is automatically running or they self extract, but bottom line is if I click on them they appear to open normally.

        In one of the backup file2.zip I found a music file. My guess is that the backup program divides the files it finds into those it can compress (text files, htm files, etc) and those it cannot compress (pictures, music, etc), and it saves the two types of files in separate directories. All the weekly incremental backups have this same two subdirectory structure. The result, of course, is only a tiny amount of disk space saving because text files are typically quite small compared to graphic and music programs even before compression.

Windows Backup program
        The windows7 backup program is found by opening the Control Panel and in the search box entering 'backup'. The screen that comes up has info on 'Backup' and below this 'Restore'.  The program is simply called 'Windows Backup'. Under Backup there is a 'Restore all User files'. This is the kind of thing I would never choose because (knowing Microsoft) it's likely to be totally destructive!

        Bottom line --- What I like about Windows7 backup program is that

                    a) Runs automatically (if computer is on) once a week backing up only directories/files
                                    you want backed up
                    b) Weekly backups are (small) incremental backups
                    c) Backup files (even though marked .zip) contain normal (or near normal) files
                                   that can be individually accessed (most important feature)

Structure of files --- full and incremental backups mixed (8/21/11)
        With nearly four months of weekly backup files I have come to understand better what the program is doing. Below is a screen capture showing the properties of the weekly backup that run last night (Sun). Notice the size of last night's backup is 539 Mbyte and it consists of four .zip files, whereas most of the weekly backup are only 1-2 Mybytes and two .zip files. A look at the four zip files shows that for some (unknown) reason the program last night did a full backup of my selected directories!


auto (occasional) full backup in week 8/21/2011
(four .zip files, 500 Mbyte size)

        When I check the other weekly files, I find the first one (5/1/11) is also a full backup, all the others are incremental backup, so this is the first full backup the program has done in nearly four months! Only two full backups in nearly four months are confirmed by the size of the top level directory of about 1 Gbyte. Microsoft, of course being Microsoft, gives no hint in the directory file structure which of the weekly files are full backups and which are incremental. Only by checking the file size, or expanding them to see if there are four .zip files, can you tell which are full backups. The individual files of the full backup have the same (compressed, but easily uncompressed) structure as the incremental backups.

        What triggered this full backup I have no idea. The weekly backup is normally scheduled to run at 7:00 pm on Sun, but I was out Sun night and the computer was off. What it the backup program did was run when I returned and turned the computer on. I find it also made a 'system' restore point at 10:53 pm just prior to the backup. The file times of 10:56 pm and 10:57 pm indicate the whole backup + restore point only took 3-4 minutes.