MYRP = IRP.createrestorepoint ("My Restore Point", 0, 100)
Save the file as MyRestorePoint.vbs . You can now easily create recovery points by double-clicking on the script icon you just created. Soon, System Restore will run in the background without displaying the interface and creating a restore point called My Restore Point.
8, Steps to avoid restoring the Virus
If you know that your system is infected, you should temporarily turn off System Restore. Otherwise, the virus will be stored along with the system files in a restore point and then returned in the recovery process.
To turn off System Restore, press the Windows + Break key combination. When the System Properties dialog box appears, select the System Restore tab, check the Turn Off System Restore check box, and click OK . Soon you will get a dialog box warning that turning off System Restore will cause all restore points to be deleted. Click Yes to continue.
At this point, you can use antivirus programs to wipe the system. When the virus has finished, re-enter the System Restore tab, uncheck Turn Off System Restore and click OK to start System Restore.
9, Disable System Restore for data storage drive
If you have several hard drives connected to your computer, System Restore will automatically add them to the list of monitored drives. If these additional hard drives are only used for data storage or backup, System Restore does not need to monitor them.
To disable System Restore for data storage, press the Windows + Break key combination. The System Properties dialog box appears, select the System Restore tab. Then select your hard drive from the Available Drive list and click the Settings button. When the Drive Settings dialog box appears, check Turn Off System Restore On This Drive and then click OK . You will get a dialog box warning that turning off System Restore on this drive will prevent you from tracking harmful changes on it. Click Yes to continue. Finally click OK to close the System Properties dialog box.
10, Determine the actual hard drive capacity System Restore is using
It's easy to determine how much System Restore you can use to use the hard drive. However, in fact, what is System Restore using hard drive capacity? If you are running Windows XP Professional and an NTFS hard drive, you can answer the above question.
You'll start by making a few changes from the Administrator account to allow you to investigate a hidden and protected folder - called System Volume Information - located on the root of the hard drive. Note that making any changes in the System Volume Information folder will also damage System Restore's performance.
From Windows Explorer, select Tools - Folder Options to open the Folder Options dialog box. Select the View tab, check Show Hidden Files And Folders , uncheck Hide Protected Operating System Files and click Yes on the warning dialog. (If the system is in a workgroup workgroup, you need to uncheck Use Simple File Sharing .) Click OK to close the Folder Options dialog box.
Now go to the root folder on the hard drive, right-click on the System Volume Information folder, select Properties , go to the Security tab. Then, click the Add button, enter your user account name in the Select Users Or Groups dialog box and click OK twice to close both dialog boxes.
At this point, you can open the System Volume Information folder, right-click the _restore folder, select Properties . Check the Size On Disk value for the exact capacity that System Restore is using to store recovery points. To ensure the security of recovery point files, you should delete your user account from the System Volume Information folder after completing the investigation.