What type of malware can reside in windows restore?

Question

I was reading aking1012's comment on How to create Windows Vista/Windows 7 Startup disk or Rescue disk or system restore points on a CD? .

He says that:

The first thing I usually do is disable system restore. Some REALLY nasty malware hides in there and is very difficult to delete. As far as rescue media, I make a full backup image. It doesn't directly address the question so it's a comment not an answer, but I thought it was worth noting

What type of malware can hide there, and how is that possible as the restore info must be stored with a checksome to make sure it's not modified, right?

Answer 1

The paragraph you read about "really nasty malware" and hiding and "very difficult to delete" is kind of correct, but is non-technical and silly. Any malware could be in a system restore. nasty or not so nasty. Just like any software could be put in there though if it was put in there and not as part of the creation of the restore point, then it probably would be malicious ! And system restore is not difficult to delete, it gets deleted as soon as you disable system restore.. it gets cleared when you disable and enable it. It is difficult with say rmdir or windows explorer, but it's easy to delete when you know how.

Also, your objection regarding the checksum, doesn't work even in theory..

suppose malware gets into system restore.. Say it's some malicious program files that will get returned in dangerous places by a system restore, along with registry changes causing them to start. If there was a file with a checksum, well it could rewrite that too. So tada it matches!

what malware does in practice tends to be display adverts, send data out about your browsing habits.. stealing bank details if you use online banking.. and in theory anything software can do.

and if you speak about checksums then you really should know they don't stop something being modified. they just let you test it afterwards.