Restore points/Shadow copies removed after running

[Rodj]

I am so mad, My laptop got the CTB locker. I removed it, I still had restore points and SVC's, and I was going to use ShadowExplorer to recover the files. I was going to use the tweak tool first to fix all of the problems I had on my laptop. And then when the fixing was over, I realized ALL of my Restore Points and SVC's were missing. Bye bye pictures that I took that were only on my laptop and text documents that were VERY important  . I am now going to have to REINSTALL all of my games that had textures and data encrypted and start ALL over again . Is there ANY way I can get back the restore points and/or SVC's?

[Boggin]

Removing restore points is the first defence of any infection, so they are gone.

The only sure way to counter any ransom ware is to create system images to external media and if you have pictures and important docs on any machine, it's imperative that you have external back ups as you could lose all of those anyway in the case of HDD failure.

This looks like a lesson learned the hard way.

[Rick]

I am so mad, My laptop got the CTB locker. I removed it, I still had restore points and SVC's, and I was going to use ShadowExplorer to recover the files. I was going to use the tweak tool first to fix all of the problems I had on my laptop. And then when the fixing was over, I realized ALL of my Restore Points and SVC's were missing. Bye bye pictures that I took that were only on my laptop and text documents that were VERY important  . I am now going to have to REINSTALL all of my games that had textures and data encrypted and start ALL over again . Is there ANY way I can get back the restore points and/or SVC's?

Type in the following command into the prompt:

    vssadmin list shadowstorage

what does it say?

To change the maximum size on the disk that System Restore will use, you will need to type in the following command:

    vssadmin Resize ShadowStorage /For=C: /On=C: /Maxsize=10GB

You can change the /for and /on to match the drive that System Restore is enabled on, and you can set a different size for the max size. I chose 10GB

[Rick]

I am so mad, My laptop got the CTB locker. I removed it, I still had restore points and SVC's, and I was going to use ShadowExplorer to recover the files. I was going to use the tweak tool first to fix all of the problems I had on my laptop. And then when the fixing was over, I realized ALL of my Restore Points and SVC's were missing. Bye bye pictures that I took that were only on my laptop and text documents that were VERY important  . I am now going to have to REINSTALL all of my games that had textures and data encrypted and start ALL over again . Is there ANY way I can get back the restore points and/or SVC's?

ask yourself this, could you trust them anyway with any type of infection?

[Rodj]

Removing restore points is the first defence of any infection, so they are gone.

The only sure way to counter any ransom ware is to create system images to external media and if you have pictures and important docs on any machine, it's imperative that you have external back ups as you could lose all of those anyway in the case of HDD failure.

This looks like a lesson learned the hard way.

No, I had it even after removing it, They disappeared after using the tweaking program.

[Boggin]

Did you create the back up pre-requisites before running WR and what was the purpose of running WR ?

Running the program again and using the restore on there may get them back, but you will need to wait until Monday for Shane to get back to you on this if that's a no-go.

[Rodj]

Did you create the back up pre-requisites before running WR and what was the purpose of running WR ?

Running the program again and using the restore on there may get them back, but you will need to wait until Monday for Shane to get back to you on this if that's a no-go.

I ran it because there was many problems with it before.
Some are: broken Windows Installer.
Programs fail at trying to update or run.
Both of these got fixed after running.

[Shane]

None of my repairs touch the restore points, so if the restore points where gone after the repairs then one of the MS commands must have removed them for some reason. As MS has some built in conditions that if met Windows will auto remove old restore points. But normally the restore points are always there after the repairs.

When it does though it should record it into the event viewer.

Here is a few of the possible event viewer IDs, do you see any of them in there?
http://support.microsoft.com/kb/2506576

Shane

[Rick]

Removing restore points is the first defence of any infection, so they are gone.

The only sure way to counter any ransom ware is to create system images to external media and if you have pictures and important docs on any machine, it's imperative that you have external back ups as you could lose all of those anyway in the case of HDD failure.

This looks like a lesson learned the hard way.

No, I had it even after removing it, They disappeared after using the tweaking program.

I too continue to learn hard lessons.

One, keep an offline backup
two, don't download or visit sites without thinking more carefully about what you are downloading
three, consider using an email service online that captures all mails before they get sent to you from unknown senders.
four, go back to only texting with HTML formatting in emailing programs.
five, one cmptr for games, one for work

other than that, life is just great!