bandana

You could try WINROLLBACK. I have used it myself, and it does work - you can even surf without an AV, as everything is restored to what it was when you reboot. You can make changes if you want to by removing the protection temporarily, and you need to know the password to do this, so you have complete control (it says here). Read more here: http://www.datapol-technologies.com/dpe/prod/winrollback/index.html