system restore disabled/failure

[Guest]

I a problem with a "downloader" trojan detected by AVG in the system volume
information folder. the problem is that AVG detected it but could not seem to
be able to remove it. i didn't want to lose my restore points so i tried to
access the svi folder without deactivating sr. After trying different methods
i found it and decided to move the entire folder to the shared doc's folder.
that resolved the question of not being able to access it. i then went to the
folder indicated by AVG, located the trojan and manualy deleted it. i was
happy. but not for long
later i realised that after moving the svi folder back to the root, the
system restore didn't work anymore. i messed up. now if i try to (de)activate
it i get an error message saying that "system restore has found an error
trying to activate\deactivate one or more units. reboot the computer and try
again". of course i did it but everything remains the same. i tiped
compmgmt.msc in the run dialog box and realised thar in services->system
restore services it is stopped. and if i try to start it i get the message:
"it wasn't possible to start the system restore service in local Computer.
Error 5: access denied."
i don't know what else to do. i even tryed to reinstal sr but it asks me for
the sr.sys file in windows xp sp1 cd wich i can't find.

In computer menager>system tools>system i encountered the following error
message regarding sr: "The 'System Restore' filter has encountered the
unexpected error '0xC0000034' during the '_filelst.cfg' file processing of
the 'HarddiskVolume1' volume. The filter has stoped monitoring the volume"

Note: the messages may not be exactly like they are written above because my
windows is portuguese and i am translating it as i go.

 

[Rick \Nutcase\ Rogers]

Hi,

1) Restart in Safe mode, delete all SVI folders.

2) Start/run regedit, navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

Double-click the sourcepath string and change the path to match that of the
folder housing the I386 folder on your hard drive. Usually this is under
C:\Windows, but sometimes it is on the root (C:\). Close when finished and
restart normally. Now try reinstalling System Restore.

By the way, you can't selectively delete items from the SVI folders without
corrupting the database. If a restore point is corrupted or contains a
virus, you need to delete the restore point.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Guest]

i have successfully reinstalled system restore through the xp sp1 CD. I
couln't find "sr.sys" because i should've been looking for "sr.sy_". Thanks
anyway