System Restore, a useful tools to recover from attack

No system restore does not occur by fetching back your files from microsoft servers. In fact, it doesn't even need you to be online. It keeps system snapshots regularly, so it can revert the changes done since that time should any problem occur. By the way, it is not only used for recovering after an attack. Troublesome installations, computer cluttering and files corruptions can be prevented by reverting back the changes done to have those occur. Have a nice day and take care always!

System restore does NOT sends any data to Micro$oft for any reason (that is plain and simple espionage on you and a clear invasion of your privacy if that really happens). System restore stores a set of backups in your local hard drive and then restores them from there (notice that you don't request an internet connection at any time). Every time a "restore point" is created it looks at the changes from the previous point and stores the differences (new files, deleted files, modified configurations and the like). A restore point is created automatically when some software is installed or at regular time intervals or manually at user request. All the data is internally stored in a system, hidden folder called "System Volume Information" in the root of your C drive, and is from there that the restore is performed. I have to accept that it's a real life saver when something breaks the normal operation of the OS, as it can prevent and undo most failures if the system is not so badly damaged. The problem is that it undoes almost everything: not only removes the viruses that entered, but also undo the changes to your personal data and documents and everything that lies within your HD. Only the "Documents and settings" folder is left untouched, everything else is reverted. It's sort of a double edged axe, it saves preventing a lot of work in a full re-installation, but it also may incur in some data loss if you don't take restore point frequently.

Microsoft do not save your settings or anything else online. It is all saved to your computer and is sometimes done automatically when changes have been made (for example, when you receive updates to Windows from Microsoft). You should certainly be using an Antivirus product (but see my response to your discussion on Norton). Your computer is NOT safe to expose to the Internet without one!

I'm not really sure how the system restore actually works. I have used it several times though to restore my computer so it would work right again.

System Restore is like a back-up within your computer.Whenever you install programs or updates it will create a file in your computer called restore point which you can use should problem arise after program installation or update.Your computer will then be restored to it's previous state prior to program installation.I think System Restore can't really fix virus problems.If you want to fix virus issues you really need an antivirus program.I also read an article, that once your computer is infected with a virus it will never be the same again.Viruses can corrupt your files and components.It happened to me before,when I had already removed the virus, I can never run windows update.My only resort is to do a clean-up installation.

One thing for sure is that neither Microsoft nor Windows backs up your local data onto their servers...all the data that is restored after System Restore comes up from your local drives only. Windows has built in support for this regular backup of system information, configuration and settings that includes drivers and other important files that help your system to revert back to a working state.