Returnil

Returnil uses advanced virtualization technology to clone your computer's System Partition in memory or on disk. When Protection is ON all changes made to the System Partition will be gone with a simple reboot.

There are several differences between Returnil and similar products. The first is the fact that RVS was the first and is still the only Instant System Recovery solution to provide an option to use memory caching that is only dependent on the size of your hard disk drive.

The next difference is that RVS’s disk cloning technology does not require contiguous disk space whereas similar products use an older technology that does. By creating an on-the-fly cloning technology that uses your computer's memory rather than the actual hard drive, Returnil will not only help improve overall system performance, but also does its part in helping to extend your hard drive's life cycle when using the Protection feature.

The third difference is that Returnil is designed to clone only the System Partition whereas the others include performance hogging and complicated implementations that add the overhead of cloning additional partitions thus reducing the user’s experience.

The fourth difference is that Returnil was designed from a security rather than recovery perspective, making it the first solution in this space to work aggressively to bring virtualization into the security realm.

Returnil is there to fill the gap in traditional security strategies where malware (new and old) may not be known to your antivirus provider yet or an update to the AV is pending analysis and QA testing. This period of lag can be as short as a few hours, days, weeks, months, or even years. Returnil makes these periods less risky by providing you with a simple reboot to restore capability that will eliminate malicious content with a simple restart of your computer rather than having the content persist until such time as the AV is updated.

Another benefit is in keeping your customer and private information secure. As many in the US have discovered, Customs officials have the right to examine and/or confiscate any electronic device when someone attempts to enter the US. This includes Laptops, cell phones, PDAs, etc which could contain sensitive or proprietary information you do not want distributed or seen by unauthorized eyes. By using Returnil protection, you can visit a client while accessing your company data over a secure connection to you company servers and download or upload confidential information stored there with your client, complete your business, and then restart the computer. This has the effect of resetting your computer to a clean state before traveling or visiting your next customer or client while on the road. If the computer is examined, it will not contain any of this information and will help keep that information secure.

Taking the above you can extend this a situation where your Laptop is stolen. If you used the secure connection and company storage idea above, then all that is needed to secure your data is to turn the computer off. At this point, all the thief would have is a clean computer without worrying that he/she/they would have access to confidential information or potentially compromise client data (Think about all the Government Laptops that have been stolen over the years and you begin to see the magic of RVS...).

Further uses could be for testing software without the risk of breaking down your current setup, private internet surfing where all cookies/cache etc. is gone after the reboot and many more.

First, we want to force change and innovation in the security industry. Secondly, we want to be the catalyst for accelerating the adoption and recognition of Virtual technology for the average user. Lastly, all you have to do to see the failure of traditional security solutions is to look for HJT logs and cries for help from people who have been a victim of Malware infections. This is intolerable to us when there are solutions available that would have helped prevent this in the first place!

Simply contact our tech department and we can supply you with flexible period testing Serial Numbers for your convenience.

Everyone here came together out of a sense of frustration with current/past security industry thinking and practice. There are too many bad ideas out there and our focus is to prove that Security does not have to be complicated to be effective and relevant. We believe you deserve better from your providers!

There should be a print button option in the menu bar of the help file when opened. Regardless of this, you can download the manuals in PDF format for both the Personal and Premium Editions from their respective product pages on our website.

We do not have phone support by default due to the complexity and cost of that type of support option. We do, however, provide phone and FAX support via specific Service Level Agreement (SLA) for large and business customers per request. Please note however that this type of support comes with additional cost.

Yes. We offer free email tech support to all our Premium Edition subscribers.

Yes, we completely redesigned Returnil in version 1.62. To see what we have added, you can read the entire change history here at Majorgeeks.

Email Support  - English, Chinese

Manual - English

Yes, you should continue to use a solid antivirus (feedback that your security strategy is working), firewall or HIPS, and as mentioned in the previous reply, frequent data backup and computer imaging. Remember, security is about reducing risk and it is important that you have a means to restore your system quickly if anything unexpected happens because it will (Murphy's law: What can go wrong, will go wrong...)

All Payment Inquiries are handled by CleverBridge. Please contact Cleverbridge Support.

There is i no problem with ordering from our website without credit card. Please follow the instructions below:

- go to our online store
- at the bottom of the first page you'll find "payment options", please select your desired payment type

Please visit our Partners page for more information. If you decide you'd like to partner with us, please include as much information about your company or business as possible to help us evaluate your application faster.

If you have a multi-boot configuration you can install RVS in each OS on the same computer as this is required for it to work properly in each separate OS. However, please note that our license agreement strictly prohibits to install RVS on more than one computer.

We appreciate your feedback in order to improve our products, so if you are serious about uninstalling, please take a few minutes to tell us why [link to form] you decided so. To uninstall, please follow the steps below

Click Start > All Programs > Returnil and then:

Win XP: Click the uninstall menu item, select the "Remove" option, and then restart your computer when requested.

Win Vista: Right click the Uninstall menu item, select "Run as Administrator" from the right click menu, click allow when challenged by the Vista UAC feature, select the "Remove" option, and then restart your computer when requested.

If for any reason your preferences file become damaged, it may not be possible to turn protection off while in normal Windows. If this ever happens, simply restart your computer in Safe Mode and then perform the same steps above per OS version, and then restart your computer in normal Windws - RVS should then be uninstalled.

We send out notices to our customer who are current at that time with a download link and new Serial Number if applicable.

After the license period the following will happen:

1) RVS protection will be unavailable after the subscription period (12 months for Premium). This only happens however, after you have restarted your computer. EX: Your registration period ends after today and you have not obtained a new Serial Number (Premium Edition) or a new installation file to reinstall (Personal Edition) but turn the System Protection or Session Lock feature on and then leave the computer running overnight. The Protection will still be active when you wake your computer and remain so until/unless you restart so you are not left unprotected should this happen.

2) The Virtual Partition will continue to work and be available to the user after the subscription period or registration period depending on your version of the software.

Returnil licensing is by default a yearly subscription with custom licensing available per request. Your Serial Number is valid for the 2.00 series and the 2.01 Beta series, so you can update to the current builds at any time you would like to do so. Just copy your current Serial Number and then apply it to a fresh download of the trial version or the trial Beta version and you should be set. We also offer free licensing for Beta testers who send us consistent feedback on the software, so there are opportunities for extending your registration longer than the default 12 months...

Returnil does not yet include incremental program updates/upgrades, but will in future generations. For now, the procedure is to uninstall your current version before installing the Beta or upgraded version.

Do not panic, we can help you. First, you need to determine if you actually configured a password or simply activated the access restriction feature. As the default password is a blank field, simply click the enter key on your keyboard when challenged by RVS to open the program interface and change your preferences and/or protection mode.

If you did configure a password, send an email to support-tech (at) returnil (DOT) com with a copy of your current RVSYSTEM.dat file and our development team can open the file and extract the password for you.

To locate the dat file, activate the "show hidden files and folders" option in Windows Explorer and then navigate to the hidden RVS root folder at C:\Returnil. Then drag and drop the dat file into your email and make the subject "Help, I forgot my password! DAT file attached". Our support team will reply with your password as quickly as possible.

*Important Note: Once the development team has extracted your password it will be known to someone other than yourself. We strongly recommend that once you have completed your changes you should configure a new password.

We are working to add x64 support in a future version of Returnil Virtual System. Please stay tuned.

The first thing to try is to boot the computer into safe mode. On most computers this would be accomplished by clicking the F2 or F8 keys on your keyboard while the system starts to open the boot menu. Once at this screen, select Safe Mode and then deactivate Returnil protction or uninstall Returnil at this point. Next, restart your computer in normal Windows mode. If this does not solve the issue, please contact us via [the support form] and describe what happened when with a description of your computer so we can investigate further. Please include the exact text of any error messages you recieve.

The issues with Vista which were reported to us were related to two potential bugs corrected in beta releases 2.0.1.8509 and 2.0.1.8510. Please, feel free to download the newest 2.0.1 release. Please uninstall your current RVS version and download the appropriate new version. If you still continue to experience problems on your Vista system, please do not hesitate to contact our technical support.

The most likely cause is that you made the VP too small. To resolve this simply make a new Virtual Partition that is at least 512 MB in size. The error message means that your Virtual Partition is too small. Please do the following to correct this:
1) Click Start > All Programs > Returnil
2a) For Win XP simply click the Uninstall link and then select "Repair" as your option.
2b) For Win Vista right click the Uninstall link, select "Run as Administrator", and then select "Repair" as your option.
3) When you arrive at the screen that allows you to configure your Virtual Partition, select a size greater than or equal to at least 512 MB. For most modern systems I would suggest using the optional size presented.

First, do not panic. The reason for this is due to damaged preferences or some form of incompatibility with other software on your computer which also uses Kernel Mode driver(s). If you have this issue, please send a detailed report to our support department so we can update the development team as quickly as possible. Please include the following information about your computer:
(OS, RAM, CPU, Hardisk sizes and types, and file system used - NTFS? FAT32?)
Also include a description of Security, filtering, backup/recovery software you may have installed, and the version of Returnil your are using.

To uninstall Returnil please do the following:

1) Backup any data or documents you have saved within your Returnil Virtual Partition. If you created a VP, it's default letter is "Z" and can be found listed within the My Computer or Computer section of your start menu depending on your version of Windows. You can keep the Virtual Partition if you intend to reinstall Returnil at the end of this procedure by checking the appropriate option in the uninstall screen.

2) Restart your computer in Safe Mode. For assistance in doing this, please refer to your Windows Help and support feature and search for Knowledge base articles for "Safe Mode".

3) Click - Start > All Programs > Returnil

4a) For Windows XP, click the "Uninstall" option from the menu and then select "Remove" to begin the uninstall
4b) For Windows Vista, right click the "Uninstall" link, select "Run as Administrator", click "allow" when challenged by the Vista UAC feature, and then select "Remove" to begin the uninstall

5) Restart your computer in normal Windows

Returnil should now be uninstalled and you can use your computer normally. For those wishing to reinstall at this point, download a fresh copy of the software from the links at our website
- Premium Edition
- Personal Edition
and then double click the new installer to begin the process.

This sounds like you may have an undetected infection, or are faced with a user who is causing the computer to become reinfected frequently. The first thing you must do is to ensure (as best as you can) that your computer is clean before installing or using Returnil. The reason for this is that RVS does not detect, block, or filter content, rather it simply ensures that any changes to your system partition are lost at restart of your computer when protection is on.
The second thing you should do is to make sure the computer is defragmented prior to installing Returnil. RVS works most efficiently when you do this.
You should visit a clean up forum to get assistance from qualified help personnel at your favorite on-line forum. If you are not a member of an on-line community with these capabilities, we can suggest some for your convenience:

Broadband Reports (DSLR dot com): http://www.dslreports.com/forum/cleanup

Spyware Warrior forums: http://www.spywarewarrior.com/viewforum.php?f=5&sid=52e634e39fa8686598d3436d660099b1

Before proceeding there, be sure to read this thread for instructions:  http://www.spywarewarrior.com/viewtopic.php?t=25477&sid=9ebb2644cad1d14b17ec2c40dbe020bd

SpywareHammer forums (Core staff are veteran helpers from the Castle Cops site): http://spywarehammer.com/simplemachinesforum/index.php?PHPSESSID=f4kn8misdvqqv510vshubkdo26&board=10.0

Before proceeding there, be sure to read this thread for instructions: http://spywarehammer.com/simplemachinesforum/index.php?topic=87.0

Landzdown forums (Many veteran helpers with extensive experience): http://www.landzdown.com/index.php?PHPSESSID=7d10e9a439f895585f6f96e866907cb9&board=26.0

Before proceeding there, be sure to read this thread for instructions: http://www.landzdown.com/index.php?PHPSESSID=7d10e9a439f895585f6f96e866907cb9&topic=423.0

We strongly recommend that the user consider creating an alternate data partition on their HDD. This is a widely accepted and recommended security configuration - never install programs in default directories, save your data on a non-system partition, etc.

RETURNIL does not require or use any form of network communications. It will not call home and has absolutely no reason to do so. Returnil is client side software and will work regardless of whether you have an internet connection or not.

NO, as the System Partition is not "frozen", you can do anything you want and there is no loss of experience while using RETURNIL. System Protection is cloning the System Partition in memory and this is why all changes are lost after system reboot.

It is important to understand that there is no limitation on what you can do, create, or save.

The limit comes where "PERMANENT" change is concerned. Changes occur continuously to the cloned copy of your System Partition in memory, so you will see and experience exactly what you expect to see and experience. RETURNIL will allow you to have a full computing experience without worrying that harmful changes are made to your real System Partition while using the protection feature.

The Returnil 2x series and above is compatible with Raid 0 And RAID 1 arrays.

Yes, before installing Returnil make sure your system is clean of any infections and/or unwanted programs. Next, perform a full disk de-fragmentation. If you use Returnil System Protection on a system that is already infected, you will most likely experience a "bouncing ball" situation where you try to uninstall the target content, but it will reappear at the next reboot. Further, having a defragged hard drive will improve system performance and make the Returnil cloning process most efficient.

This is not required to use Returnil, but it is highly recommended as part of your overall strategy. You should use frequent backup (data replication) and imaging (restoration snapshots of your entire system) to provide for emergency situations that cannot be predicted (EX's: your daughter spills her sippy drink on your laptop, Fire, theft, accidental damage, etc) Returnil is desiged to provide immediate recovery from unwanted, malicious, or potentially unwise changes during your current boot session but does not yet provide a means to restore from a deeper time in history (Ex: Multi-state or multi-time restores).

There are two distinct ways RETURNIL will help you in testing software:

A) Virtual leaks - when using products like VMWare or similar there is a chance, no matter how small, that content can "leak" into your real system. RETURNIL provides that last line of defense that will keep these leaks from making unintended changes to your real system partition. We have seen this happen in a Malware research lab and it is not pretty when a researcher looses valuable time recovering their system rather than testing the object of interest...

B) With just RETURNIL alone, there are limitations to testing software. This is only that if the program requires a reboot to complete its installation that installation will fail because the changes were lost after reboot while the protection is ON. For those applications or components you wish to test that do NOT require a system reboot, then you can install and observe the system for issues before you decide to make a permanent installation without the need for using .ISO images or more advanced testing environments. For the researcher we believe that "A" has merit and value by adding a layer of protection against "accidents". For the consumer/end-user that does not use or require an advanced testing environment, "B" has merit and value.

NO, a common way to use Returnil is to activate the Session Lock rather than change the default System Protection Mode. You can think of this like the shield space ships use in Science Fiction: When in doubt or about to enter a potentially hostile place, turn ON your Session Lock!

No, as this is not what it is designed to do. Session Lock is a temporary implementation of the System Protection feature in Returnil. If you anticipate needing long term protection that is in effect across restarts of your computer (protection remains on after restart), you should turn the System Protection on. Think of Session Lock as a type of panic button that you can invoke without needing to restart your computer and turning on the System Protection as locking the door to your house before you leave on holiday.

There is absolutely no reason to save the entire contents of the System Partition outside of a normal system backup or recovery image. As Returnil does not allow changes to the real System Partition with Protection ON, there is no need to carry the extra baggage of an image except as noted above or in a full-blown testing environment which lab testing software handles quite well.

No, but you will require a reboot to turn protection OFF. To turn ON protection without a reboot, simply use the Session Lock feature available from the Main Interface, the Tray Icon menu, or the Toolbar. The second issue here, "Turn off System Protection without reboot", is not a trivial thing to solve due to the design of Windows itself. We are exploring several ideas to address this, but remember there is a reason why even Microsoft itself must require a system reboot when installing some critical updates and patches.

The main mission of the Virtual Partition is to allow a convenient means for the user to save their data while using the protection feature. You should also explore saving data in alternate partitions - part of the design concept of RETURNIL was to force awareness that you do not have to save your data in default locations, especially the System Partition.

NO, Mounting/dismounting and use of the Virtual Partition is not affected by the System Protection mode or change of mode.

To create or edit the properties of your Virtual Partition please do the following:

Windows XP: Click Start > All Programs > Returnil > Uninstall. When the uninstaller opens, select the repair option, make the appropriate changes, and then restart your computer to complete the process.

Windows Vista: Click Start > All Programs > Returnil > RIGHT click the uninstall link and select "Run as Administrator" > Click "Allow" when challenged by the Vista UAC feature > When the uninstaller opens, select the repair option, make the appropriate changes, and then restart your computer to complete the process.

The System Protection feature will clone a copy of your computer's System Partition in memory. The Virtual Partition is a feature that employs a file to simulate an actual partition on your hard disk drive so you can save data while the Protection is ON.

The current generation of RVS does not support custom installation paths for the disk cache as it does for the Virtual Partition (2.01 series). We are in the planning stages for adding this capability in the 3x generation which is scheduled to begin shortly following the final release of 2.01.

What you will have with RETURNIL on a system with a single partition:

A) System Partition [C:] = Windows + Returnil + Applications

B) Data Partition [Returnil Z:] = Personal files, downloaded files, bookmarks, e-mails, address book, etc. The only difference here is that if you set the VIRTUAL PARTITION as a default save location for your applications, you must ensure that the VIRTUAL PARTITION is mounted. This is not a great sacrifice in time or effort, just change the appropriate data save location in the application you are using.

The Virtual Partition is a convenience for those who may not have access to alternate partitions to store documents, save pictures, or even save data changes when using the System Protection/Session Lock feature in RVS. It is not required for the protection feature to work properly and is nothing more than a very large file with special properties that makes Windows believe it is a real hard drive partition when mounted. When dismounted, it is a large, inaccesible (to anything other than Returnil) file on your System partition (2.00 series and older) or alternate partition/drive (2.01 and above). When dismounted, the contents you have saved within it cannot be seen, altered, or moved and remains hidden from unauthorized eyes. It can also be transported if you have media large enough to copy or move it to and can be opened/used on another computer with Returnil installed.

Returnil only protects the System Partition. On most computers this is the C:\ Drive. When using the Personal Edition, you cannot save content to this drive but can save to other areas like the data drive mentioned above, a USB stick or storage drive, optical disk (CD/DVD), firewire drive, etc. With the Premium Edition however you have the following options that allow saving of files and folders on your System Partition (C:\ drive):
1) Through the File Manager - simply add the files and/or folders you want to save or save changes to within the list, select the items you want to commit to disk, and then click the "Update Selected" link at the bottom of the list window. For automated saving of items on the list you can use a combination of the Windows Task Scheduler and the supported command line:
C:\Program Files\Returnil\Returnil.exe /FILEUPDATE
This will force RVS to commit those items that are selected in your File Manager list per the schedule set in the Task Manager.
2) Right click commit to disk - The Premium Edition includes shell integration that can be turned on or off in the preferences tabs.
3) Drag and drop to the Tool Bar - simply drag an drop your target file or folder onto the RVS tool bar and the content will be saved to the real disk.
4) Save the content on a non-system partition or drive. Remember that Returnil only effects the System Partition unless you use the File Protection feature
and then only those selected, non-system files, folders, partitions, and drives would be inaccessible when the feature is active. 5) Through the RVS Real System Explorer - you can move files from the Virtual System to the Real System and Visa-Versa

Returnil will not interfere with downloading content from the internet or moving files or folders from things like your USB stick, CD/DVD Rom, etc. What it will do is to remove the change to your system partition that is related to your attempting to save the file like you would with Returnil's protection off. For example, if you like to download files and save them in the "My Documents", "My Pictures", "Downloads", etc folders, the file will download as expected and you can do anything you want to it just like when RVS protection is off. The only difference is that the file, folder, or change you made to an existing document would be lost at restart of your computer unless you save that content on a non-system partition (EX: data drive D:\)

It really doesn't matter as changes to the restore points you already have and new restore points would be lost at restart of your computer. You should howevber take time to create at least one current restore point with Returnil's protection off just in case.

The file Manager is a feature that allows you to commit changes to files and/or folders on the Real System that change frequently and is only available in the Premium Edition. This feature however is inclusive rather than exclusive as designed by our competitors. In other products, files and folders are excluded from protection so the user can make changes to them. In RVS, we think it is more secure to protect this content at all times except at the moment the file or change is commited to disk (saved). This approach requires deliberate action on the part of the authorized user and cannot be exploited by malware as it can in competitor's solutions.

The file most likely to cause this message is RVSYSTEM.sys and is where changes are tracked by Returnil when using the Disk Caching mode (the file does not exist in Memory Caching mode). The file is locked by Returnil and is similar to what Windows does with the pagefile.sys (Windows Page file) and hiberfil.sys (Windows Hibernation) files. The most important reason (among others) why the file is locked is to harden the cache from being exploited. The warnings can be ignored.

Microsoft security updates come once a month, are announced well in advance of release, and can be installed at any time you choose. Therefore, it is not a large hurdle to deactivate RETURNIL protection to allow the download and installation of these updates at the time convenient for you. What is more interesting here is that even if you mistimed this and did not get the update, your system is protected against unwanted changes that might exploit what these updates were developed to address.

To ensure compatibility with your Antivirus updates, change the default download/save/load path for the product's signature file to a non-system partition. A good example would be to change this to your data partition or the Returnil Virtual Partition. The only caution we would add in reference to saving data in the Virtual Partition is that you must have Returnil installed to mount this partition or access it.

No, when protection is ON, all changes made to the System Partition will be lost with a reboot. If you save the content within the Virtual Partition or on an alternate drive, then the data saved in the VIRTUAL PARTITION remains following a reboot.

Either you save data within your Virtual Partition or you do not (no exclusion or inclusion list required). Unless you are an UBER system tweaker, developer, program tester, or researcher there is no overriding need to exclude anything from protection on the System Partition; break your default Windows save directory addiction!

Please keep in mind that Returnil is not an imaging or multi-state restore solution so is not able (yet) to create restore images of your system. RVS tracks changes made while the Session Lock or System protection feature is turned on and can only do the following:
a) Drop all changes - this means drop all tracked changes made and restart your computer as it was at the moment you turned the protection feature on
b) Save all changes - this means saving all changes made in the Virtual System to the Real System at computer shutdown
c) Save some changes - this means using the File Manager or manually saving content through the drag & drop or right click commit options.

Yes, Returnil is hardened against Low level disk access. MBR (disk sectors 0-62) protection is now an integrated component of the System Protection/Session Lock feature. We also include tools that are designed to protect against specific, anti-ISR (ISR = Instant System Recovery) malware such as the Robodog (AKA Sonydog) trojans coming mainly from China. The tools included are Anti-Execute and Real System Autoruns plugins. These tools can be accessed through the tools folder in the Returnil Start Menu folder.

WARNING: the following information is not recommended for inexperienced users! If you do not completely understand the potential consequences involved with moving system folders, DO NOT DO THIS! NOTE: This utility is currently designed for those who want to make the move permanent as part of their use of RVS System Protection

As part of our development process, we create a number of concept and testing programs that are designed to explore solutions internally without making changes to the main program. In this specific case, we created a utility that would allow the user to move some System Folders to an alternate partition including the Virtual Partition called RVSMOVER and is included in the Returnil Premium Edition installation. The utility is located in the (default) "C:\Program Files\Returnil" directory. This utility will allow an option for experienced users who want to move their Desktop, IE Favorites, and IE Cookie system folders to an alternate drive.

We strongly caution the user that this is not a trivial thing to just experiment with, again, if in doubt, stay clear... We also recommend that if you are an experienced user who is familiar with this type of configuration that you should choose an alternate partition on your existing HDD to minimize any potential issues you might experience. When moving system folders it is essential that the target directory/partition be one that will boot with Windows!

The protection scheduler is a convenience to allow some automation while performing tasks that might require frequent changes to your real hard drive. The 0 - 23 represent the hours in a 24 hour day (0 = 12am and 23 = 11PM)

At the moment, we have achieved the first level with Session Lock that allows you to enter protected mode without a restart. We are working to add a new feature set that will allow exiting protected mode without a restart, but please keep in mind that there are reasons why even Microsoft must restart your computer when installing some security updates and we are limited in the same way due to the structure of Windows. One of the things we will be exploring in the 3x generation this year will be this and the further ability to save/drop changes across restarts; meaning that you would be able to keep a protected session "alive" after a restart and either accept the changes or "roll back" those changes at a later time.