drive backup before new install etc.

[graham_mca]

Reading about the problems with the new SpyBot has led me to wonder...

If I visit a client's or friends PC and decide to download say 'AdAware and SpyBot' to scan through for malware there is potential for things to go badly wrong. The chances are that the owner would not have any software installed to provide a full backup of the C drive already so what would be your recommendations for a course of action?

Bearing in mind that I would probably need to stand the cost as it would be for my protection in case things go wrong so I would not want to buy and install Drivespace 2002 or similar every time.

Any suggestions of a simple utility to maybe backup the entire drive to a new partition maybe? Or some other way to quickly recover to 'before the problem'!

An alternative though is can AdAware and SpyBot or similar be run from a CD without installation?

Graham

[deddard]

Not sure about how things stand with running adaware etc from a standalone cd, but if anything, BARTS Pre-build would be the likely choice.
I'm looking into this (amongst a million other things) at the minute, - search for my thread in applicaitons and security regarding antivirus scanning on NTFS systems - there should be a link in there.
The good news (hopefully) with AV is that there is a plug in for NOD32.
I'm going to be giving NOD32 a try on my system in the next couple of weeks - Norton is as slow as a 3 legged dog with a hernia.

[Steve]

I run Spybot from a cd. Works good. I haven't tried Ad-Aware yet.

I like to download those programs to the customers machine because that's where they belong. If the customer doesn't want them, that's OK. You'll make some more money when they get infected again. ;)

In XP you can (and should) create a restore point before installing any new programs. If it doesn't go well you can return it to it's preinstallation state.

If an install goes bad on a 9x machine, you can use scanreg /restore to fix things up.

[Sylvander]

The trouble with scanreg /restore and probably a WinXP restore point too is that they only restore the cofiguration files [or am I wrong about XP?].
If new programs have been installed since those restored configuration files were backed up, then the configuration will no longer match the file system.
These backups can only be used if the files remain unchanged.
If the files have been changed, then all the program files and Windows files [all files having settings in the registry or configuration files] would need to be restored also.
And even that only applies if those backed-up files match the hardware.

So there must be a match between:
1. The hardware connected.
2. The files referred to in the registry/configuration files.
3. The registry/configuration files.

There have been a few threads on bootable CD's that include utilities :
a) [b]Win98
1. http://www.pcguide.com/vb/showthread.php?s=&threadid=22167&highlight=EBCD

b) WinXP
1. Burn a bootable XP disc w/ integrations
http://www.pcguide.com/vb/showthread.php?s=&threadid=27391&highlight=Bootable+CD
2. Bootable AV with UptoDate definitions
http://www.pcguide.com/vb/showthread.php?s=&threadid=29122&highlight=Bootable+CD
3. Bart PE
http://www.pcguide.com/vb/showthread.php?s=&threadid=29316&highlight=Bootable+CD

I gather the idea is that you boot a Windows OS from the CD and have utilities that can be used to fix the HDD and its software.

[Steve]

Actually, I've recovered from a bad program install in W98 using scanreg /restore several times and system restore in XP once. Seems to work fine.

It's true that any programs installed since the last good bootup (in 9x) will be lost but you can reboot before you install a program and there you have it.

In XP you can create a restore point just before installing a program and return the computer to that moment pretty easily.

If I'm not mistaken, that's pretty much what those features are for.

[Sylvander]

STEVE
"any programs installed since the last good bootup (in 9x) will be lost"
I believe that in reality, the files are still there in the same locations on the HDD, but the settings installed in the registry to make them work are no longer there, so they no longer work and appear to have gone. If you used a utility to search for orphaned files, they would be listed.

That wouldn't cause any practical problems, but there exists the potential for other problems to be introduced.
Any time you cannot guarantee that the configuration files match the system files, beware! Who know what linkages have been broken.

GRAHAM
Vic 970 has been using a system that has its simplicity to recommend it.
He uses a drive copying utility on a floppy [supplied free by the HDD manufacturer] to copy the contents of the master HDD to the slave.
[You could fit a HDD you supply temporarily]
If he wants to restore, he just copies the slave back to the master.
[Or else he re-jumpers the slave as master and the master as slave.]

[Steve]

I believe that in reality, the files are still there in the same locations on the HDD

I do believe your right. And if the reboot (in 9x) or creation of a restore point (in XP) is done moments before you work on the computer, I think you'd be alright.

Backing up to a HDD is definatly an effective method. I'm not sure that opening up the customers box and attaching a slave drive would be ideal, though. Maybe an external drive would work.

[graham_mca]

Hello and thanks for the ideas so far.
Deddard.... (wasn't he a dog?) I am not familiar with NOD32 so I am looking into that.

Steve... yes you are right about the freeware, it should be downloaded to the customer's machine, that is where my concern about a bad download (or version change problems like SpyBot seems to be having) began. I admit I have not used scanreg /restore before... I see scanreg on my pc and openning it it asks me if I would like to backup again...that's fine, but what is the procedure for the '/restore' function?

Sylvander... thanks for the tip re. Vic 970, the problem there would be as Steve suggested being inside a customer's machine on site with spare drive in hand... but an external would work. That would certainly give peace of mind but time may be a factor if the drive were full of images for instance.

>>That wouldn't cause any practical problems, but there exists the potential for other problems to be introduced.
Any time you cannot guarantee that the configuration files match the system files, beware! Who know what linkages have been broken.<<

Not quite sure what you are saying there Sylvander, do you mean that the orphan files could interfere with some future installation... maybe of a new version of some application whose older orphan files are still there?

Graham

[Steve]

what is the procedure for the '/restore' function?

Restart the computer to MS DOS Mode. At the C:\WINDOWS> prompt type scanreg /restore and hit enter. W98 save a copy of the registry for the last 5 successful bootups. Pick one that predates any problems.

[Sylvander]

Graham
What I was thinking:
There only exists one way for the software to work flawlessly.
That is if the configuration files are a perfect match for the system files, and both of those are perfectly matched to the hardware.
If there is introduced a mismatch; say between the configuration and the system files, then who knows what nasties will result.
When chaos creeps into the system it can only have bad effects.

[Steve]

Here (http://www.microsoft.com/windowsxp/pro/using/howto/gethelp/systemrestore.asp) is some info on system restore from MS.

A little more info Here (http://www.bcentral.co.uk/technology/Windows/tips/P20970.asp?MSID=bc001b14866a4fb48b877445d96f43f2) .

Some info on scanreg /restore (http://www.windows-help.net/windows98/start-145.shtml) .

And a little more info (http://www.windows-help.net/windows98/start-145.htm) .

Both programs have been used with success to recover from a botched program install. That's what they're for...;)

[graham_mca]

Thankyou for clearing my mind there Sylvander. It seems that as far as the effectiveness of scanreg/ restore is concerned, we are talking about a matter of 'timing'. The closer the restore point is to the new install the better, and certainly not to make more than one install between restore points, yes?

Thanks for the links Steve and the previous explanation, all info printed and filed. Every day I earn some more here with such excellent help, thankyou.

Graham

[Sylvander]

Steve's 2nd link includes:
"System Restore records your computer's settings at regular intervals"
I'd like to know EXACTLY what is backed up to create these restore points. This makes it seem that only the configuration settings are backed up.
The blessing [and possibly the limitation] of Scanreg is that it makes an automatic backup at the 1st successful boot of each day of bootup.
So if after that successful boot some change is made to the configuration that causes a problem, then it is possible to undo it.

The problem arises when a change is made to the file system that causes a mismatch with that restored configuration.

GRAHAM
"The closer the restore point is to the new install the better, and certainly not to make more than one install between restore points, yes?"
Lets say you made a restore point and then installed a program and then jumped back to that restore point.
All the settings put in the registry by the install would disappear.
The restored registry would be set up to work with the files as they previously existed.
So all the new files installed would be just so much useless trash.
But what if some files had been deleted and were needed?
This is a most undesirable situation.
So if that's the way restore points work, be aware of the limitations.
To fix it you could re-install and then un-install the program.
But it would have been MUCH better to have restored both the configuration AND the files so there's no possibility of a mismatch.