System Restore Erractic

[Guest]

Have been having problems with System Retore not working. Did a purge by
turning off SR drive monitoring and rebooted. Didn't work. Read a msg on the
board by Geof? and he said he got rid of IIS and his worked. Have tried that
but still not consistent. The System/system restore tab was grayed out at
first and turning off monitoring was not available and it said set by Group
Policy. Got into the GP editor, run gpedit.msc. Found System Restore under
Administators Templets/System/System Restore. There are two options. Played
with not configured, disabled, and enabled in all configurations, booting
each time. Finally went back to not configured for both options. Got back
into System/System Restore Tab and was able to access the stop monitoring all
drives button. Rebooted and then turned this back on and actually did several
test SR points sucessfully.
That was last night and when I booted up this AM the test SR points were
there but was unable to create a SR point. SR create just quits resonding
after a couple of minutes and have to shut it down with Task Mgr. I have
studied the event log for clues and notice that the error message logged
there says that rundll32 had a hang problem - specific words: Hanging
application rundll32.exe, Version 5.1.2600.2189, hang module hungapp, version
0.0.0.0, hang address 0x00000000. IN the title box it saidthe Type: error
Event ID 1002.
Also some of the time I have been unable to even call up System or it took
up to 10 minutes before it popped up and then I did not have the System
Restore tab at all.
OH, I was not able to remove the windows component IIS Admin because some to
the dependencies could not be stopped so ISS Admin still exists but the
services module does not show it running.

I really need some serious help here because now MS downloads tries to run
System Restore as part of its installation process and that causes the
installation to fail. While it was working last night I did get two of the
recent downloads, Installer 3.1 and one of the securtity files that I had
downloaded and saved to run later. Those created restore points successfully
but now I just turned off the automatic updates until I get the SR problem
fixed.

 

[Bert Kinney]

Hi,

I would suggest reinstalling System Restore.
http://bertk.mvps.org/html/tips.html#ReinstallSR

 

[Ronnie Vernon MVP]

Have been having problems with System Retore not working. Did a purge
by turning off SR drive monitoring and rebooted. Didn't work. Read a
msg on the board by Geof? and he said he got rid of IIS and his
worked. Have tried that but still not consistent. The System/system
restore tab was grayed out at first and turning off monitoring was
not available and it said set by Group Policy. Got into the GP
editor, run gpedit.msc. Found System Restore under Administators
Templets/System/System Restore. There are two options. Played with
not configured, disabled, and enabled in all configurations, booting
each time. Finally went back to not configured for both options. Got
back into System/System Restore Tab and was able to access the stop
monitoring all drives button. Rebooted and then turned this back on
and actually did several test SR points sucessfully.
That was last night and when I booted up this AM the test SR points
were there but was unable to create a SR point. SR create just quits
resonding after a couple of minutes and have to shut it down with
Task Mgr. I have studied the event log for clues and notice that the
error message logged there says that rundll32 had a hang problem -
specific words: Hanging application rundll32.exe, Version
5.1.2600.2189, hang module hungapp, version
0.0.0.0, hang address 0x00000000. IN the title box it saidthe Type:
error Event ID 1002.
Also some of the time I have been unable to even call up System or it
took up to 10 minutes before it popped up and then I did not have the
System Restore tab at all.
OH, I was not able to remove the windows component IIS Admin because
some to the dependencies could not be stopped so ISS Admin still
exists but the services module does not show it running.

I really need some serious help here because now MS downloads tries
to run System Restore as part of its installation process and that
causes the installation to fail. While it was working last night I
did get two of the recent downloads, Installer 3.1 and one of the
securtity files that I had downloaded and saved to run later. Those
created restore points successfully but now I just turned off the
automatic updates until I get the SR problem fixed.

Try reinstalling System Restore. The following website will give you the step by step instructions as well as other information on SR.

How to reinstall System Restore.
http://bertk.mvps.org/html/tips.html#ReinstallSR

 

[Guest]

Ronnie, you are truely a MVP. I followed the directions on the site you
referred me to and System Restore seems to be working now. The first file
requested was found in the c:\windows\ServicePackFiles\i386 folder as the
instructions called for. The second file requested was srframe.mmf. I
searched and found that in c:windows\system32\restore which I assume is part
of the old System Restore files. I searched on the Service Pack 2 disk and if
there probaly buried in a .cab file. Struck me that I may just be corrupting
the SR process again using an old file???? Since as I said SR has been
erratic I will keep my fingers crossed that it doesn't return. Thanks again
and I did rate the response with a resounding YES!

 

[Guest]

Sorry Bert I missed your message and have to really heap the praise on you
for the fine info on your site. Thanks to all of you guys for helping us out.

 

[Bert Kinney]

Hi,

Check the two files by right clicking on them and selecting Properties.
For XP SP2 you should see this info.

rstrui.exe = Version: 5.1.2600.2180

srframe.mmf = Size: 984 bytes (984 bytes)

 

[Ronnie Vernon MVP]

Ronnie, you are truely a MVP. I followed the directions on the site
you
referred me to and System Restore seems to be working now. The first
file
requested was found in the c:\windows\ServicePackFiles\i386 folder as
the
instructions called for. The second file requested was srframe.mmf. I
searched and found that in c:windows\system32\restore which I assume
is part
of the old System Restore files. I searched on the Service Pack 2
disk and if
there probaly buried in a .cab file. Struck me that I may just be
corrupting
the SR process again using an old file???? Since as I said SR has been
erratic I will keep my fingers crossed that it doesn't return. Thanks
again
and I did rate the response with a resounding YES!

Your welcome. Bert does have an excellent website there.

 

[Guest]

Both were as you indicated, Ver. 5.1.2600.2180 and Srfrom.mmf was 984 kb and
created Jan 24 2004 and modified March 31, 2003.

I had sucessful test SR creates and restoring after reinstalling SR. When I
shut down this afternoon I had an error that read as follows

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 8/16/2005
Time: 3:39:38 PM
User: NT AUTHORITY\SYSTEM
Computer: HOME
Description:
Windows saved user HOME\Jay registry while an application or service was
still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I had checked earlier and all my services were running in local service with
the exception that 3 were on network. This is a standalone computer.

When I booted a few minutes ago I went to System/SR tab and it showed that
all drives were being monitored. Closed that and went to SR and all my test
and system generated restore points showed as being there. I did not restore
but clicked on create a restore point and it then hung and got this error
message in the event log:

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/16/2005
Time: 9:57:30 PM
User: N/A
Computer: HOME
Description:
Hanging application rstrui.exe, version 5.1.2600.2180, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 72 73 74 72 75 69 rstrui
0018: 2e 65 78 65 20 35 2e 31 .exe 5.1
0020: 2e 32 36 30 30 2e 32 31 .2600.21
0028: 38 30 20 69 6e 20 68 75 80 in hu
0030: 6e 67 61 70 70 20 30 2e ngapp 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 30 30 30 30 30 30 00000000

I just tried to access System and it took several minutes to even come up,
last night I timed this anomally for 10 minutes. When it did come up the
System Restore tab was missing.

Last night I had disabled the IIS Admin service and the two dependent
services STMP and World Wide service or something like that. I operated and
did testing in that configuration for some time with no problems. This
morning after finding SR was working OK including 3 test creates and 2
restores I decided to reenable these services. I think I did a reboot then
but can't swear to it. I had downloaded all the pending XP downloads and
sucessfully installed each one and got a restore point each time.

Do you think that IIS Admin could be the culprit as was mentioned by Geof in
another thread on one of these newsgroups. I guess it doesnt seem to hurt by
turing them off and can always turn back on. I was afraid disabling the STMP
service with mess up my email on a dial up system but I did send and receive
after I turned them off and rebooted. Do I need them on dial up or cable when
they come into my neighborhood in a few months?

I am open for some new suggestions, thanks for your time and expertise.

Jay

 

[Bert Kinney]

Both were as you indicated, Ver. 5.1.2600.2180 and
Srfrom.mmf was 984 kb and created Jan 24 2004 and
modified March 31, 2003.

I had sucessful test SR creates and restoring after
reinstalling SR. When I shut down this afternoon I had an
error that read as follows

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 8/16/2005
Time: 3:39:38 PM
User: NT AUTHORITY\SYSTEM
Computer: HOME
Description:
Windows saved user HOME\Jay registry while an application
or service was still using the registry during log off.
The memory used by the user's registry has not been
freed. The registry will be unloaded when it is no longer
in use.

This is often caused by services running as a user
account, try configuring the services to run in either
the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I had checked earlier and all my services were running in
local service with the exception that 3 were on network.
This is a standalone computer.

When I booted a few minutes ago I went to System/SR tab
and it showed that all drives were being monitored.
Closed that and went to SR and all my test and system
generated restore points showed as being there. I did not
restore but clicked on create a restore point and it then
hung and got this error message in the event log:

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/16/2005
Time: 9:57:30 PM
User: N/A
Computer: HOME
Description:
Hanging application rstrui.exe, version 5.1.2600.2180,
hang module hungapp, version 0.0.0.0, hang address
0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 72 73 74 72 75 69 rstrui
0018: 2e 65 78 65 20 35 2e 31 .exe 5.1
0020: 2e 32 36 30 30 2e 32 31 .2600.21
0028: 38 30 20 69 6e 20 68 75 80 in hu
0030: 6e 67 61 70 70 20 30 2e ngapp 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 30 30 30 30 30 30 00000000

I just tried to access System and it took several minutes
to even come up, last night I timed this anomally for 10
minutes. When it did come up the System Restore tab was
missing.

Last night I had disabled the IIS Admin service and the
two dependent services STMP and World Wide service or
something like that. I operated and did testing in that
configuration for some time with no problems. This
morning after finding SR was working OK including 3 test
creates and 2 restores I decided to reenable these
services. I think I did a reboot then but can't swear to
it. I had downloaded all the pending XP downloads and
sucessfully installed each one and got a restore point each time.

Do you think that IIS Admin could be the culprit as was
mentioned by Geof in another thread on one of these newsgroups.

Yes I think is it is possible. Geof stated that uninstalled and then reinstalled IIS fixed
the problem. This can be done via add/remove programs - add/remove Windows Components.

What was happening was the IIS service was not started (hung), and causing other services
to hang. Go to Start - Run and type Services.msc and press enter. In the Status column
he found services that where "Starting" rather than Started. If you are not using IIS,
which I think is the case, I would leave it uninstalled.

I guess it doesnt seem to hurt by turing them off and can always turn back on.

Are you "turning them off" in Services?

I was afraid disabling
the STMP service with mess up my email on a dial up
system but I did send and receive after I turned them off
and rebooted. Do I need them on dial up or cable when
they come into my neighborhood in a few months?

If STMP service is starting correctly, I would leave it alone.

 

[Guest]

When I enter the control bench, the spot chooses the formula, which must
operate, my computer system always told me to be short the
c:\windows\rundll32.exe files part. And hoped I assign the correct way...
What means has to be allowed to solve?

 

[Guest]

It looks like it is not the IIS Admin but a service that is dependent on it.
I had disabled IIS Admin and SMTP and WWP. WWP had been showing that it was
starting but never completed to started. Because SMTP was shut down I was
unable to send email, I'm on a dial up ISP. I just reenabled IIS Admin and
STMP and trying that.

I tried to delete the "IIS Admin" via the ADD/Remove Windows Components but
was not sucessful. THe check box is grayed out which means all of the
component can't be added/removed. There was a lot of drive activity and it
asked for the Windows disk which sounds more like an install than removal.
After running the windows component removal IIS Admin is still there so I
must be doing something wrong there or windows is prohibiting the removal.
Therefore I can't get a clean reinstall. If you can help me on that I would
appreciate it.

I think I will use this configuration since it seems to have resolved the
System Restore problem for now. Thanks for your time and effort.