Removing Malware Hidden Inside Windows Restore Points

System Restore remains one of the most reliable recovery features built into Windows, giving Australian households a safety net when an update misbehaves or a driver goes rogue. Unfortunately, the same snapshot mechanism that protects honest users also gives cybercriminals a quiet storage locker. Threat actors deliberately bury payloads inside the System Volume Information folder so that a quick "restore my PC" action ends up reinstalling their malware weeks later.

Reports compiled by the Australian Cyber Security Centre have repeatedly flagged restore-point tampering as a tactic used by ransomware crews and banking trojans that target local institutions. Understanding how the trick works is the first step toward stopping it, especially for anyone in Sydney, Melbourne, or regional Queensland who relies on the default Windows recovery tools rather than third-party imaging software.

Why Attackers Bury Payloads Inside System Restore

System Restore creates shadow copies using the Volume Shadow Copy Service, storing them as compressed, read-only snapshots in a protected directory. Windows hides that folder from File Explorer, which leads many users to assume it is invulnerable. In reality, the protection is only a permissions lock, not encryption, and administrative malware can write to the shadow just as easily as it writes to the desktop.

Sophisticated families use this space for two reasons. First, the snapshot survives a factory reset on some machines when users choose the "keep my files" option, because the reset routine restores from the most recent known-good point. Second, restore points persist through many antivirus scans that exclude the System Volume Information folder by default for performance reasons, letting dormant code sit untouched for months.

Warning Signs Your Recovery Snapshots Are Compromised

A single restore point growing past several gigabytes without a recent driver change is a strong indicator of tampering. Some families embed DLLs or scripts directly into the snapshot, and a manual inspection with vssadmin list shadows often reveals entries dated long after the last legitimate change.

Banking trojans that impersonate ANZ, CommBank, and Westpac login portals are a recurring nuisance across Australian suburbs, and several variants now use restore points as a fallback channel when their primary foothold is purged. Sluggish boot times, unexpected prompts to "restore your system," and inexplicable files reappearing after deletion are all classic giveaways. If Task Manager shows unfamiliar processes spawning shortly after a restore, treat the snapshot as hostile.

Building a Clean Removal Workspace

Disconnect from the network before doing anything else. Unplug the Ethernet cable from the NBN box or disable Wi-Fi on the laptop, then reboot into Safe Mode with Networking disabled so that the payload cannot phone home or pull secondary modules.

A common reason cleanup attempts fail is that the threat keeps relaunching from another running process. Readers dealing with that pattern will find detailed guidance in this what to do when malware uses DLL injection to infect running programs walkthrough, which complements the restore-point removal steps below. While in Safe Mode, open an elevated Command Prompt and run vssadmin delete shadows /for=c: /oldest /quiet to clear stale snapshots, followed by vssadmin resize shadowstorage /for=c: /on=c: /maxsize=10% to tighten future growth.

Wiping Snapshots and Restoring a Trusted State

After clearing the old shadows, run a full scan with a reputable on-demand tool such as Malwarebytes, Emsisoft, or the Microsoft Malicious Software Removal Tool downloaded from an uninfected device. Reboot normally, then create a fresh restore point manually so the system has a clean baseline.

Windows users juggling Apple hardware in the same household often ask whether the same trick applies to Macs. The short answer is no, but the discipline of wiping recovery artefacts is just as important, and this step-by-step guide to removing malware from macOS recovery mode covers the equivalent procedure. On the Windows side, finish by re-enabling System Restore, installing the latest cumulative updates, and rotating any passwords that may have leaked through keylogger activity.

Reinforcing Defences Against Future Tampering

A few configuration changes make restore points a far less attractive hiding place. Disable System Restore only if you rely on alternative backups; otherwise, set a strict maximum size, schedule weekly scans of the System Volume Information folder, and pair Windows Defender with a second-opinion scanner that explicitly checks shadow copies.

Method	Removes Hidden Snapshot Malware	Requires Reboot	Protects Future Restore Points
vssadmin delete shadows	Yes	No	No
Safe Mode plus full AV scan	Partial	Yes	No
Disable System Restore entirely	Yes	No	No
Third-party imaging plus cloud backup	Yes	Yes	Yes

Backing up to an external drive stored in a drawer, or to an Australian-hosted cloud provider, ensures recovery never depends on a single compromised snapshot. Keep that drive disconnected when not in use, schedule automatic monthly images, and revisit the strategy after every major Windows feature update to stay ahead of attackers who treat your safety net as their own.