Solved

Home XP   System Restore does not restore but does not say why

Posted on 2008-10-26
15
1,126 Views
Last Modified: 2013-12-06
Attempted to do an XP system restore.  No matter what checkpoint date selected, the system goes through some action, reboots the system and then says unable to restore. Does not say why, but does tell me that nothing has been changed.   I can look in the system  restore point calendar and see as far back as July (bold dates), and so far none have produced a restore.    Trying tocorrect from virus / trojan infections

I am doing  this as XP system  appears to have a serious virus / trojans.   My printer stopped working from Word, but prints from MS Works, and Excell.  Reloaded the print drivers, no joy.  Reloaded MS Office Works, no joy.  Noted that Control   (Install and Uninstall) link no longer works. Language tool does not work any more (Japanese IME)
0
Comment
Question by:Charles_Barr
  • 6
  • 3
  • 2
  • +2
15 Comments
 
LVL 12

Expert Comment

by:jazzIIIlove
Comment Utility
Hi there;

First, try to sys. res. in safe mode...If no use:

Follow these steps:

http://support.microsoft.com/?kbid=302796

If those doesn't work:

Sadly;
It is possible you have a corrupt file for restore. The only way to fix is
turn off restore, reboot and turn it back on. The result will be cleaning out
the restore file and creating a new one. To do that:

1) Right click [My Computer] [Properties] then click on System Restore tab.
2) Put a check in the box for Disable Restore on all drives.
3) Click apply, then Reboot your PC.
4) After the system reboots, navigate to the System Restore tab and turn it back on. Click apply.
5) Navigate to [System Tools] [Restore...] and choose [Create a Restore Point]
6) Provide a name for the new restore point.
7) Try and restore the new point just created. It should work properly
 
Best regards...
0
 

Author Comment

by:Charles_Barr
Comment Utility
I have started the System Restore, from SAFE MODE  I will let you know how it works
0
 

Author Comment

by:Charles_Barr
Comment Utility
Just in case I was not clear, I have tried several of the Selected save points from the available, and non worked so far.  Are you saying that the execution Restore file may be corrupted?  Other wise that would mean each of the saved date points were each corrupted??  

Well, I have tried two different dates in safe mode.  I get the response - Restoration Incomplete and then the pannel   Your computer cannot be restored to  (the date selected)   System Checkpoint

No changes have been made

So no Joy.  
0
 
LVL 12

Expert Comment

by:jazzIIIlove
Comment Utility
You have probed the MS link?
0
 

Author Comment

by:Charles_Barr
Comment Utility
Not sure if I am doing the "right" thing here, but your stuff was the right thing to do, but as you pointed out, if that failed, then I can only restart the System Restore action (I am guessing after I have killed it and deleted all the files).    I am reluctant to do that as I really do hope to restore one or more of the dates.  I just have a hard time beliving that all those date files are corrupted.  I did sent a whole bunch of the errored messages to MS in the hopes that some one will look and tell me what the heck happened.

Not sure what you mean by prob the MS Link.   I tried MS, but got a complete run around and could not fine where to go to just get an answer as to why the darn System Restore (which I was depending on big time) just fails.    And with no reason given.    I was told to stop using Norton GoBack, and I did, but man was that a mistake.
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
Charles_Barr,
Welcome to EE.
There are several versions of malware that will corruct your System Restore points and make a system restore impossible.
Before doing anything else, I suggest that you back up any critical data to any media you can.

You can click on the 'Request Attention' hyperlink in the body of your original question and ask a Moderator to add this question to the "HiJack This" Zone.

There are a couple of outstanding Experts over there who can help you read the logs and take the steps needed to get your system cleaned up.

Download HJT here: http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

Follow the instructions to run it and use the "Attach File" function to post the log.
0
 
LVL 23

Expert Comment

by:phototropic
Comment Utility
It is also possible that your Restore Points are Ok but that some system file corruption is stopping your pc from accessing them.
You can run a Registry Restore (same procedure using your pc's Restore points) from a UBCD boot disk:

http://www.ubcd4win.com/howto.htm

Download and burn the ISO to a CD. Go to Start - programs - Registry tools - Registry Restore wizard;
This is another route to accessing your restore points.

 
0
Google Storage: Standard vs. Nearline vs. Coldline

Google Cloud Storage has a number of classes to choose from. Although there are a lot in common, they vary in price and usage terms. This post explains Google Cloud Storage classes and helps to understand which  one to choose.

 

Author Comment

by:Charles_Barr
Comment Utility
Dear Phototropic

I am going to see what your are talking about.  If I am understanding, you mean that I should click on your link and then get the UBCD Boot disk, then do the action that you  show in your last sentence

"Go to Start - Programs - Registry Tools - Registery Restore wizard,"


If that is true, then I will try that next.

0
 
LVL 23

Expert Comment

by:phototropic
Comment Utility
OK.  The ISO download is here:

http://www.ubcd4win.com/downloads.htm

Full instructions on how to burn the disc are here:

http://www.ubcd4win.com/howto.htm

You will need your Windows XP SP2 installation CD, a blank CD, and some CD burning software such as Nero or Roxio.
When the disc is built, boot from it.  It will load to a different desktop to the one you are used to seeing.
The Registry Restore wizard can be found under Registry Tools.

Good luck!!!
0
 
LVL 12

Expert Comment

by:jazzIIIlove
Comment Utility
Well...well...I was very busy at work...I cannot deal with this question very well...

Now, first try:
RUN\scanregw /fix

If faiils, then:
If the sys. restore still not working, try ONE by ONE of these steps (Not all of them at the same time!):

1.  Ensure the System Restore service is running.  verify that System Restore services are running from Control Panel:

1.a. Click Start, Control Panel -> Performance and Maintenance ->
1.b. Click Administrative Tools -> Computer Management -> Services andApplications.
1.c. Click Services
1.d. Click System Restore Services.
1.e. Ensure the service is set to Automatic and the status is Started.

Or:  To verify that System Restore services are running using the command prompt: Click Start ->Run -> then type CMD in the control box Press Enter, then type Net Start at the command prompt

2.  Verify that you have enough free space on all your drives as required by System Restore. If the free space on any partition system restore is monitoring falls below 50 MB, System Restore will suspend
and purge out all restore points to free up disk space. It will automatically reactivate when 200 MB+ free space is available.
 
3.  Examine event logs for any system restore-related errors that could help you identify the problem.
http://computercops.biz/postt101018.html

4. http://support.microsoft.com/default.as...S;q302796&

5. http://www.microsoft.com/technet/prodte...srwxp.mspx

 6. http://support.microsoft.com/?kbid=304449

7. How to do xp repair install
http://michaelstevenstech.com/XPrepairinstall.htm

8.  I like kellys-korner!
http://www.kellys-korner-xp.com/xp_restore.htm

9. Check the event logs to investigate System Restore service errors (May not be applicable to your case):
9.1. Click Start, click Control Panel, and then click "Performance and Maintenance".
9.2. Click Administrative Tools, click Computer Management, double-click Event Viewer, and then click System.
9.3. Click the Source tab to sort by name, and then look for "sr" or "srservice." Double-click each of these services, and then evaluate the event description for any indication of the cause of the problem.

10. Moreover, did you plug some usb device while taking a restore point?

11. As specified above, by younghv, a hijackthis log will be helpful, because a virus may corrupt your sys. res. points.

Best regards...
0
 

Author Comment

by:Charles_Barr
Comment Utility
Tried to attach the HIJACK THIS log file, but I apparently reported this too soon and the system will not let me add the log file for the report, so I guess I send it with this comment.


hijackthis.log
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
@Charles_Barr - I am going to ask a Moderator to add this question to the HiJackThis Zone so that you can get a better evaluation.

@jazzIIIlove - When you cut and paste solutions from another source on the Internet, you need to identify the source. Otherwise it is plagarism.

(http://answers.google.com/answers/threadview?id=479185)

You will also find that on EE the Experts try to identify the actual problem before we start listing a whole bunch suggestions that may or may not have anything to do with resolution.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Charles:

My first suggestion would be to uninstall "MyWebSearch" and "FunWebProducts" from Control Panel > Add/Remove Programs, and then run a cleanup along the lines of that described here (including the Hijack This "fix" once done):
http://www.pchell.com/support/mywebsearch.shtml

They aren't "nasty" in terms of most other spyware, but are a nuisance and can confuse the issue when trying to clean up a system.

I can't immediately see any nasty entries in your HiJack This log.  You do have too many Windows startup programs, but that's just my opinion and the way I like it.  You can run  MSCONFIG  from your Start Menu's "Run" field, disable startups by unchecking them under the "startup" tab, "Apply" the change, and reboot when prompted as you cloce msconfig.

I'm not convinced that the symptoms you described:
("I am doing  this as XP system  appears to have a serious virus / trojans.....") necessarily point to Virus or Trojan activity.  Of course, you are correct in being cautious, but have you tried updating your AntiVirus program and running a full scan of the system?

You said:
"Noted that Control   (Install and Uninstall) link no longer works."
Do you mean that you cannot access Add/Remove Programs from the normal Control Panel window?
If so, try entering this command into your Start Menu's "Run" field and pressing Enter:

control appwiz.cpl

If that doesn't work, then try the following full command:

rundll32.exe shell32.dll,Control_RunDLL C:\Windows\System32\appwiz.cpl

Failure in this function is symptomatic of a messed up file association in your registry, ie. the command line set against files of certain types, and could either be the result of malware or a number of other things.

Some of the first things that malware will disable are:

1. Anti-Virus application.  Does yours work?  If not, then you can usually run an online scan:
http://www.kaspersky.com/virusscanner
http://housecall.trendmicro.com/
http://support.f-secure.com/enu/home/ols.shtml
http://www.bitdefender.com/scan8/ie.html

2. Access to REGEDIT.EXE through which experienced users may need to remove rogue settings.  You can usually bypass this by using the Task manager (Ctrl + Alt + Del) > File menu > "New Task (Run...)".
Where you have file association problems affecting the most basic troubleshooting functions, there are a number of fixes that can be written to the registry from script files for which I will provide a link, but let's first see if you can run Start menu > Run > REGEDIT > click OK, and access Add/Remove Programs as suggested.  Don't hang around in Regedit.  Just close it if it opens OK for you, and let us know.

3. System Restore.
Malware can disable or screw around with the means through which you run a System Restore, but there are ways to circumvent this by running scripts that bypass the normal user interface.  In your case you can see and select system restore points, so that part isn't screwed up, but somewhere at shutdown or reboot things are going astray.  Your best bet is just as phototropic has suggested, ie. trying to run it from a CD that boots into its own environment where Windows issues aren't going to interfere with anything.

I also believe that it would be a very good idea to run a Hard Drive Diagnostics Test using the utility designed for your make and model numberof hard drive.  These are downloaded as programs that create a floppy disk to which you then reboot the system, or as an *.ISO file (or a program that extracts such a file) that can be loaded into CD Burning software to burn a bootable CD that does the same thing as a floppy.  An *.iso file is just an "image" of a disc wrapped into one file, and most CD Burning software allows you to choose this as an option - usually New > Project > choose "From Image File".

I'm not sure how up to date the links are, but the Hard Drive Diagnostics (or fitness") Tests can be found here for each manufacturer:
http://www.tacktech.com/display.cfm?ttid=287

If you have problems, I'm sure we can get a live link if you can tell us the Make and series of your hard drive.

The reason I am leaning towards the possibility of hard drive problems is that you have various other issues that are not normally the type of thing deliberately caused by malware.

Do you have the means to back up essential and irreplaceable data such as emails, documents and images, etc?  It might be a good idea to consider this avenue now, and if you need advice I'm sure we can give it.

Now try the couple of things to check out as I mentioned earlier, let us know the results, then create and run the Ultimate Boot CD as suggested by phototropic.

I hope this helps
0
 

Accepted Solution

by:
Charles_Barr earned 0 total points
Comment Utility
So many answers that might have worked, if the XP system had not been so messed up.  Unfortunately for me, the only thing that worked was a complete and total wipe and then a reload of the XP system. I had done a  data save to an external hard drive, so kept my documents and pictures and tax files.   I have lost the rest.  So much of what I was offered, depended upon many other items working correctly, which they did not.  Several of the run this or run that suggestions did not work (that is they did not run, so I can not tell if they would have worked or not).   So How to fairly give points?   I do not know how that should be handled.

 It was not that folks did not try. It was that either I totolly did not understand  or that it simply did not apply to XP Home or was an unreachable web site, that just took me to other places than I believe the suggester intended.   I might try your service again, but only for pretty simple problems, as they usually have simple answers.  So please close this question with the idea that the suggestions and references did not make it (other than the SAD but true - a total wipe and reload got me back to square zero).

 
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now