The other day I wrote here about why I think that System Restore isn’t a service in Windows that should be disabled regardless of the number of tweaking sites that recommend you do so. I want to add a bit of a caveat to that post in light of a post over at The H Security blog about a trojan that can hide in your System Recovery files.

I have seen this in the past when working on client’s machines where malware scans have shown viruses and trojans hiding out in both System Restore and the $Recycle Bin folders. Even from there as Chun Feng, a Microsoft virus specialist, speaking at the Virus Bulletin conference in Geneva pointed out the known trojan Dogrobot can survive and re-infect your machine.

So while I am an advocate of using System Restore I also suggest that you clean out your system restore on a regular basis using the following steps

1. Before you clean out your system restore cache make sure that you first clean out your Recycle Bin. The reason for this is if there is any malware you might have hiding in there it will get deleted but remember these files will also be a part of your System Restore cache as well. By deleting these files you remove the surface threat of them still being able to re-infect your machine.

2. Once you have done that it is time to delete all the System Restore files you have collected. This is a pretty simple procedure which you can start by clicking on the Start button and the right click on the Computer menu item

That will bring up your System Information dialog where you select System Protection

This will display the System Properties dialog with the System Protection tab selected. There you will see a list of drives that have System Restore enabled on them.

Select the drive your want to turn System Restore off on (you should actually do it for all drives where it is enabled) and then select the Configure button which will display the following dialog window

Select the Turn off protection option and then click Okay on the confirmation dialog that will pop up.

3. Once you have done that for all the drives re-boot your machine. This will clear out all the files in the System Restore cache.

4. After rebooting repeat the process above and re-enable System Restore on your drives and then create a fresh restore point.

This process will always make sure that any baddies that might be hiding in places you would think are safe are actually gone for good.