Situation:
You want to know about the Windows System Restore Utility and how Norton AntiVirus works with it.

Solution:
What is System Restore?
System Restore is part of Windows Me and XP.

If system information is damaged, Windows can have problems. System Restore makes copies of your system information and saves the information. If the system information that Windows is using is damaged, you can use System Restore to go back to an earlier copy. (For more about System Restore, see your Windows Help and Support. Also see the Technical Information section.)


Why does Norton AntiVirus not scan the System Restore folders?
If Norton AntiVirus finds an infected file, then it tries to fix the file. The files in the Windows System Restore folders are protected and cannot be changed. Because the files cannot be changed, Norton AntiVirus will continue to try to fix the file and will continue to fail.

Any viruses in the files in System Restore cannot infect the computer. (See "Is my computer safe from viruses in System Restore?" for details.) Rather than showing you constant alerts that would mean nothing, Norton AntiVirus is set up not to scan the System Restore folder. (For information on what folders are excluded, read the section "What folders are excluded?" in the Technical Information field at the end of this page.)

In past versions of Norton AntiVirus, the folder was not excluded and customers would see many alerts on that folder. (Read Cannot repair, quarantine, or delete a virus found in the _RESTORE or System volume information folder for more information.)


Is my computer safe from viruses in System Restore?
If Norton AntiVirus is set not to scan files in System Restore, is my computer safe? Yes. There are other protections against infection. Here is how they work:

• If there is an infection in a file in System Restore, the file cannot infect your computer. Windows protects the System Restore folder and will not allow the file to be touched.
• Any infections in files in System Restore only become active after they are restored. When the files are restored, Norton AntiVirus provides other protection.
• After you use System Restore, you can run a manual virus scan to find any viruses.
• Any viruses will be found by Norton AntiVirus Auto-Protect the next time that the file is opened, moved or changed in any way.

What should I do after running System Restore?
Run LiveUpdate right away to make sure that you have the newest virus definitions.


What if I see Norton AntiVirus error messages after running System Restore?
System Restore can change the registry entries so they no longer match the Norton AntiVirus files on the hard drive. Any time that you use System Restore, run LiveUpdate right away. This will make sure that you have the newest virus definitions.

After running LiveUpdate, if you see error messages when you start the computer or the program shows an error message on the System Status screen, then go to your version of Norton AntiVirus in the following table. Click the link to the page that describes the situation or error.

Norton AntiVirus 2004 error messages	Norton AntiVirus 2003 error messages
Error: "Unable to initialize virus scanning engine. . ." after running Windows System Restore or installing Norton AntiVirus 2003/2004	Error: "Unable to initialize virus scanning engine. . ." after running Windows System Restore or installing Norton AntiVirus 2003/2004 "Error" is displayed in the Virus Definitions entry of the Norton AntiVirus 2003 System Status screen

Technical Information:
More about System Restore
Windows Me keeps restore information in the _RESTORE folder. Windows XP keeps this information in the System volume information folder. These folders are updated when the computer restarts. Both the _RESTORE folder and the System volume information folder are marked with the hidden attribute, and, by default, Windows is set to not display such files or folders. The files and settings that are saved in these folders cannot be accessed or opened unless the System Restore utility restores them.


Should you use System Restore to fix problems that happen after installing a software program?
When software does not install correctly, it leaves files and registry entries. System Restore cannot take these out. So, if you have a problem with your computer after installing software, uninstall the problem software first. If that does not fix the problem, then run System Restore.


What happens if I use System Restore to restore my computer to a time before Norton AntiVirus was installed?
If you run System Restore and go back to a time before Norton AntiVirus was installed, then you must reinstall Norton AntiVirus.


What folders are excluded?
When you keep the original (default) settings in Norton AntiVirus, the System Restore folder will not be scanned. For Windows Me, the folder C:\_Restore is part of the "Exclusions list," and it will not be scanned. For Windows XP, the folder C:\System volume information is part of the "Exclusions list," and it will not be scanned.



References:
For more information read the page that applies to your version of Windows:

• How to use the system restore utility in Windows Millennium Edition
• Description of the System Restore Utility in Windows Millennium Edition, Article 267951
• How to: Restore Windows XP to a Previous State, Article 306084