Restore Points Vanish

[DF]

My restore points vanish. I do not have real player installed. I have
restore set to high setting (1080megs)
Within 24 hours the previous restore points just vanish.
I Just re installed xp Pro this weekend and the problem persists.
what can I do?

 

[Rich Barry]

Check at Kelly's http://www.kellys-korner-xp.com/xp_abc.htm Select
S and scroll to System Restore.

 

[Bert Kinney]

Hi DF,

The most common cause for this is low disk space on any one of the
monitored disks or partitions. If this is the case you should have
seen a message to this effect.

Use the Event Viewer to investigate System Restore service errors. To
do this, follow these steps:

* Go to Start - Run and type eventvwr.msc and press enter.
* Click the Source tab to sort by name, look for "sr" and
"srservice." Double-click each of these services, and evaluate the
event description for any indication of the cause of the problem. Make
note of the Description, EventID and Source of these Event Properties
that show an Error or Warning and post them here.

You can find more troubleshooting tips here.
http://home.earthlink.net/~mvp_bert/html/srfail.html

 

[DF]

When I got event view I see the first event" System restore suspended
because there is not enough disk space freed on system drive \\?\Volume
(9504b03a9d52-11d9-87e0-806d6172696f) System restore will resume once at
least 200 mb of disk free on system drive.
Then exactly half hour later the event viewer says' The system restore has
resumed monitoring due to space freed on system drive.
Ihave well over 3.9 Gigs free on the system drive so I don't know why it is
saying not enough space.
I have turned off restore on all drives except the C: system drive. I have
alloted 1080 mb to that drive. What is causing this?

 

[Bert Kinney]

Hi DF,

If you have not already done so, check for virus and spyware
infection.
Virus and Spyware removal and prevention.
http://home.earthlink.net/~mvp_bert/html/body_spyware.html

Can you remember if there was any new software was installed prior to
this problem?

 

[Edward W. Thompson]

Sorry to butt in Bert but this appears to be an identical problem to the one
I have and we have discussed for a time recently. What is difficult to
understand (for me at least) is why a reinstall of the OS didn't solve the
problem. I suspect the Op may not have reinstalled the OS but ran a repair
in which case if the problem is caused by a third party program, the problem
would still exist.

 

[Bert Kinney]

Hi Edward,

I am beginning to wonder if this could be caused by damaged to the
hard disk.
After backing up data, a scan of the disk with diagnostic software
from the HD manufacture may be in order.

I am also wondering if Hibernation is playing a roll in the problem...

 

[Edward W. Thompson]

Hi Bert:

I don't 'use' hibernation so that cannot give rise to the SR problem, at
least I think it can't if 'hibernation' is disabled. WRT HDD damage, that
to me seems doubtful but who am I to dispute any suggestion? . I'll do
as you suggest and try to find and run a Diagnostic utility. Both my
disks are Maxtor SATA drives and there are no indicators there are problems
(chkdsk, diskeeper, perfectdisk all run without errors). I have the Maxtor
MaxBlast CD and that may have a disk diagnostic program on it.

At present I have disabled everything except my AVP (NOD32), Firewall
(Sygate) and my OE Spam filter (Giant Spam Inspector). I am confident these
programs are not the source of the SR problem as SR use to function corectly
with these program running in the background.

 

[DF]

Interesting that you 2 think it could be 3rd party software. Immedately
after reinstalling the OP I installed my 2 usual malware programs Adaware
and Spybot. I know Spybot does "back up the registry and creates a restore
point" for rolling back. I am going to uninstall Spybot right now and will
report back to this post on Friday or Saturday. Thanks Bert and Edward for
your time and Knowledge, Doug F.

 

[DF]

Well I uninstalled Spybot, created a restore point and baboom 20 minutes
later my newly created restore point is gone!

 

[Bert Kinney]

Hi Edward,

Thanks for the feedback. The damaged HD idea is a guess. I am just
trying to come up with different situations that may cause the
deletion of restore points. In DL's case there was a low disk warning
that proceeded the deletion of the RP's. Normally this should not
delete all the RP's. So I am thinking more in the lines of what could
be triggering the low disk space warning.

You mention a spam filter for OE. Antivirus filters can interfere with
the SR filter and cause trouble. You may want to remove the spam
filter temporally to test.

You may also want to exchange information with DL on what software or
hardware you may have in common.

Could you generate another system restore Cab file? It's best to do so
just after the restore points where deleted. I will ask DL to do the
same and take a look at them. I will also try to get some higher ups
to take a look. Send the cab file to (e-mail address removed) (remove the NS)

Click Start, then Run

Type or paste: %windir%\system32\restore\srdiag.exe and click OK

A command window will open while the Srdiag.exe runs. The command
session will automatically close when complete, and the .cab file will
be created in the
Windows\system32\restore folder. This can take several minutes.

 

[Bert Kinney]

Hi Doug,

Is Service Pack 1 or 2 installed yet? There were System Restore issues
that were resolved in SP1.

There's a tool in WinXP called Srdiag.exe that captures System Restore
files and puts them into a text format so that we can view the
contents of the files to try to diagnose problems occurring with
System Restore. Please send them to me at (e-mail address removed) (remove the
NS)

To use the Srdiag.exe tool click Start, then Run

Type or paste: %windir%\system32\restore\srdiag.exe and click OK

A command window will open while the Srdiag.exe runs. The command
session will automatically close when complete, and the .cab file will
be created in the
Windows\system32\restore folder. This can take several minutes.

--
Regards,
Bert Kinney MS-MVP Shell/User
http://dts-l.org/

Interesting that you 2 think it could be 3rd party
software. Immedately after reinstalling the OP I
installed my 2 usual malware programs Adaware and Spybot.
I know Spybot does "back up the registry and creates a
restore point" for rolling back. I am going to uninstall
Spybot right now and will report back to this post on
Friday or Saturday. Thanks Bert and Edward for your time
and Knowledge, Doug F.

"Bert Kinney" wrote

 

[Edward W. Thompson]

Hi Bert:

Thanks for your responses and help. Re the suggestion that there may be a
HDD problem, I have run Maxtor MaxPower (Maxtor disk diagnostic utility) on
both disks and it reports the disks are healthy.

Am down to NOD32, Sygate and the OE spam Filter running in the background
but am still having problems. I next intend to remove NOD32, the AVP, as I
am becoming somewhat suspicious that may be the cause.

Re Srdiag, I will create a fresh file, as you suggest but am unsure what you
mean by "It's best to do so just after the restore points where deleted.".
The reason for my lack of understanding is normally there is a window of 64
mins between when the system automatically deletes the previous SR and
writes the "disk" full message (Event ID 107) to the Event Viewer and the
follow up message (Event ID 108) stating disk space has been freed when a
fresh SR point is created. If you mean to create the srdiag cab file within
that 64 min, that is when no SR points exist, that may be difficult but I'll
try.

As a recap: I can make any number of SR points manually but directly the
system 'automatic' creation of a SR point kicks in all SR points are deleted
and the Event ID 107 (insufficient space) is created. This occurs if there
are one or 21 SR points (21 is an exaggeration of course) but I have had as
many as 4 SR points automatically and manually created in any one day when
programs are updated. It is only when the 'daily' SR point creation kicks
in that the previous created points are deleted. Very strange!

Again thanks for your help

 

[Bert Kinney]

Hi Bert:

Thanks for your responses and help. Re the suggestion
that there may be a HDD problem, I have run Maxtor
MaxPower (Maxtor disk diagnostic utility) on both disks
and it reports the disks are healthy.

Am down to NOD32, Sygate and the OE spam Filter running
in the background but am still having problems. I next
intend to remove NOD32, the AVP, as I am becoming
somewhat suspicious that may be the cause.

Yes, do this.

Re Srdiag, I will create a fresh file, as you suggest but
am unsure what you mean by "It's best to do so just after
the restore points where deleted.". The reason for my
lack of understanding is normally there is a window of 64
mins between when the system automatically deletes the
previous SR and writes the "disk" full message (Event ID
107) to the Event Viewer and the follow up message (Event ID 108)
stating disk space has been freed when a
fresh SR point is created. If you mean to create the
srdiag cab file within that 64 min, that is when no SR
points exist, that may be difficult but I'll try.

After the automatic restore point is created and the restore points
are deleted would be the best time. But if the there deleted every day
then it is not critical.

As a recap: I can make any number of SR points manually
but directly the system 'automatic' creation of a SR
point kicks in all SR points are deleted and the Event ID
107 (insufficient space) is created. This occurs if
there are one or 21 SR points (21 is an exaggeration of
course) but I have had as many as 4 SR points
automatically and manually created in any one day when
programs are updated. It is only when the 'daily' SR
point creation kicks in that the previous created points
are deleted. Very strange!

Thanks for the recap, and yes this is strange.

Again thanks for your help