System restore problems

[Theslaz]

I posted this back on September 26 and didn't get any replies. Will try
again.

Whilst turning of system restore in order to delete the restore files; I
noticed several things. On the drives that it shows that are available
for monitoring; my "C" drive is not listed at all. It lists my "N" drive
as the system drive.

I installed a new 500 Gig drive about a year ago. I made this new drive
"C" and renamed my old C drive "N". At least I thought I did! What I did
was; I cloned the new drive to be identical to the old C drive and then
swapped them around in my drive bay. Obviously I did something wrong or
not complete. The computer is working great; but I would like system
restore to "monitor the "C" drive.

I opened partition magic and this is what it showed:
Disk 1 has one partition: F and is listed as logical
Disk 2 has 4 partitions: C is listed as primary and active
D is listed as logical
G is listed as logical
E ( Linux) is listed as logical
Disk 3 has one partition N and is listed as primary and active

Any suggestions?

 

[Ronaldo]

Check "Setting a New Disk ID" on your cloning application, it should
explain the cause of your problem.. which is that your system is on the C:\
drive but probably thinks it is on the N:\ drive (or something of the
sorts)... What you need to do is set a new disc ID on the system partition
and check the Winlogon registry data... the Userinit value should have C:\
in the data if not C but N, the two systems are still "attatched", this
depends on the way you cloned the system.. sorry I don't remember the terms
used in the different methods to clone drives but the cloning application
instructions should have all the information you need. The issues you may
now have with your cloned system is if you separate the hard drives (N:\ and
C:\), C:\ may not boot so you have to make the necessary corrections as;
Setting a new dik ID and rechecking the registry with an application like
Registry Toolkit.. you also need to check in the My Computer\right
click\Manage\Disc Manager that the C:\drive is set as the active partition.

Go to Start\Run\type "regedit" (no quotes) and hit Enter, browse to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit (reg_sz), and check that the data on
"userinit" is "C:\WINDOWS\system32\userinit.exe," and not
"N:\WINDOWS\system32\userinit.exe,".. then install "Registry Toolkit" to
re-check the registry for "N:\" to replace any data that has N istead of
C... Run Registry Toolkit and in "My Registry"/right click and next click
"Search or Replace in Registry"\Search/Replace tab\ in "Search for:" type
N:\ and in Replace with: type C:\ then click on the Replace button. If you
just want to check the registry first before replacing anything, just type
N:\ in "Search For" and click on Search.

Hope I made it clear.


Download Registry Toolkit
http://www.funduc.com/



----------------------------

 

[Theslaz]

Check "Setting a New Disk ID" on your cloning application, it should
explain the cause of your problem.. which is that your system is on the C:\
drive but probably thinks it is on the N:\ drive (or something of the
sorts)... What you need to do is set a new disc ID on the system partition
and check the Winlogon registry data... the Userinit value should have C:\
in the data if not C but N, the two systems are still "attatched", this
depends on the way you cloned the system.. sorry I don't remember the terms
used in the different methods to clone drives but the cloning application
instructions should have all the information you need. The issues you may
now have with your cloned system is if you separate the hard drives (N:\ and
C:\), C:\ may not boot so you have to make the necessary corrections as;
Setting a new dik ID and rechecking the registry with an application like
Registry Toolkit.. you also need to check in the My Computer\right
click\Manage\Disc Manager that the C:\drive is set as the active partition.

Go to Start\Run\type "regedit" (no quotes) and hit Enter, browse to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit (reg_sz), and check that the data on
"userinit" is "C:\WINDOWS\system32\userinit.exe," and not
"N:\WINDOWS\system32\userinit.exe,".. then install "Registry Toolkit" to
re-check the registry for "N:\" to replace any data that has N istead of
C... Run Registry Toolkit and in "My Registry"/right click and next click
"Search or Replace in Registry"\Search/Replace tab\ in "Search for:" type
N:\ and in Replace with: type C:\ then click on the Replace button. If you
just want to check the registry first before replacing anything, just type
N:\ in "Search For" and click on Search.

Hope I made it clear.


Download Registry Toolkit
http://www.funduc.com/

Thank you for your input. I'll try what you suggested and let you know.
Me thinks you are right on the money with this!

 

[Ronaldo]

Thank you for your input. I'll try what you suggested and let you know. Me
thinks you are right on the money with this!

I know from experience I am on the right track... but for the meantime,
just to enable System Restore monitoring on the C partition, go to Control
Panel\System\System Restore\Select the C Partition in the Available Drives
window and click on Settings\remove the check mark from "Disable System
Restore on this drive"...

Also consider disabling SR on non system partitions since it is practically
unnecessary to monitor them. I usually don't let System Restore monitor
other than the System drive/partition, this is to save disc space and
because it is not necessary... as the name says; "System" Restore only
restores the "system" to a previous state and monitoring non-system
partitions is just a waste of disc space... besides when partitions get
nearly full and the space allocated to SR goes below the default 12%, the SR
is automatically disabled so it's best to watch the system partition from
never going below the 12% and forget about the non-system partitions.

Good luck!

 

[Theslaz]

I know from experience I am on the right track... but for the meantime,
just to enable System Restore monitoring on the C partition, go to Control
Panel\System\System Restore\Select the C Partition in the Available Drives
window and click on Settings\remove the check mark from "Disable System
Restore on this drive"...

Also consider disabling SR on non system partitions since it is practically
unnecessary to monitor them. I usually don't let System Restore monitor
other than the System drive/partition, this is to save disc space and
because it is not necessary... as the name says; "System" Restore only
restores the "system" to a previous state and monitoring non-system
partitions is just a waste of disc space... besides when partitions get
nearly full and the space allocated to SR goes below the default 12%, the SR
is automatically disabled so it's best to watch the system partition from
never going below the 12% and forget about the non-system partitions.

Good luck!

My "C" drive does not show as an available drive to monitor.

 

[Daave]

I posted this back on September 26 and didn't get any replies. Will try
again.

Whilst turning of system restore in order to delete the restore files;
I noticed several things. On the drives that it shows that are
available for monitoring; my "C" drive is not listed at all. It lists
my "N" drive as the system drive.

I installed a new 500 Gig drive about a year ago. I made this new
drive "C" and renamed my old C drive "N". At least I thought I did!
What I did was; I cloned the new drive to be identical to the old C
drive and then swapped them around in my drive bay. Obviously I did
something wrong or not complete. The computer is working great; but I
would like system restore to "monitor the "C" drive.

I opened partition magic and this is what it showed:
Disk 1 has one partition: F and is listed as logical
Disk 2 has 4 partitions: C is listed as primary and active
D is listed as logical
G is listed as logical
E ( Linux) is listed as logical
Disk 3 has one partition N and is listed as primary and active

Any suggestions?

Might be an antivirus program (like Norton) interfering. See:

http://bertk.mvps.org/html/srfail.html

Did you have this problem prior to the hard drive swap?

 

[Theslaz]

Might be an antivirus program (like Norton) interfering. See:

http://bertk.mvps.org/html/srfail.html

Did you have this problem prior to the hard drive swap?

Read the article that you linked to and it was very informative and did
give me some ideas on what I should do and shouldn't do!

Don't think that my anti virus program is the culprit. Using Trend
Micro. Got rid of Norton a long time ago.

It's been over a year since I did the swap of drives. Really didn't
notice anything unusual about system restore until I went to turn system
restore of in order to delete some virus infected points. Why it won't
list my "C" drive as available for monitoring is a mystery.

 

[Daave]

Read the article that you linked to and it was very informative and
did give me some ideas on what I should do and shouldn't do!

Don't think that my anti virus program is the culprit. Using Trend
Micro. Got rid of Norton a long time ago.

It's been over a year since I did the swap of drives. Really didn't
notice anything unusual about system restore until I went to turn
system restore of in order to delete some virus infected points. Why
it won't list my "C" drive as available for monitoring is a mystery.

Perhaps the virus wasn't removed completely.

Perhaps Norton wasn't removed completely.

Configure a clean boot using the method outlined here:

http://support.microsoft.com/kb/310353

Reboot the PC. Right-click My Computer and select Properties. Select the
System Restore Tab. What do you see?

Regarding malware, this page is full of very helpful information:

http://www.elephantboycomputers.com/page2.html#Viruses_Malware

It's possible you need to reinstall System Restore:

http://bertk.mvps.org/html/reinstall.html

 

[Ronaldo]

Can you see the C drive in My Computer/Windows Explorer or the Disc
Manager?... I would disable System Restore and delete the restore points
according to the instructions on the link using the Disk Cleanup utility,
restart the system and check if the C drive is now available for SR
monitoring, and if available, enable SR on that partition only. Also scan
the C partition for viruses and malware.

http://www.bleepingcomputer.com/tutorials/tutorial56.html

Use this app for the malware scan.
http://www.malwarebytes.org/mbam.php


-------------------------------------

 

[Ronaldo]

You can safely assume the culprit was the virus infection. If you've already
got rid of the virus also scan the C drive for trojans and malware but
disable the System Restore on all the drives before scanning.

If you are not sure the virus was deleted, configure the System Volume
Information (SR) folder security before scanning it again for virus
infection... you may need to add the Administrators group to the folder
Security for the antivirus to access the hidden system folder and delete the
virus.


HOW TO: Set, View, Change, or Remove File and Folder Permissions
http://support.microsoft.com/?kbid=308418

File and Folder Management in Windows XP
http://labmice.techtarget.com/windowsxp/FileMgmt/default.htm

Windows XP Home folder permissions
http://www.2000trainers.com/home-ne...ome-systems-with-xp-professional-permissions/



---------------------------------

 

[Theslaz]

Perhaps the virus wasn't removed completely.

Perhaps Norton wasn't removed completely.

Configure a clean boot using the method outlined here:

http://support.microsoft.com/kb/310353

Reboot the PC. Right-click My Computer and select Properties. Select the
System Restore Tab. What do you see?

Regarding malware, this page is full of very helpful information:

http://www.elephantboycomputers.com/page2.html#Viruses_Malware

It's possible you need to reinstall System Restore:

http://bertk.mvps.org/html/reinstall.html

Did a complete virus scan with Trend Micro and Malwarebytes Anti
Malware. Negative results.

Turned of System restore in order to get rid of the restore points; got
the usual warning; said yes and rebooted. Went back to system restore
and it was back turned on and all the restore points were still there.

Me thinks that maybe System Restore needs to be reinstalled and will try
that.

 

[Ronaldo]

Configure the Security settings in the "System Volume Information" folder
(hidden system folder) so the security applications will have access and a
better chance of finding malware, and the System Cleanup utility will have
complete access to delete the restore points. This is because you are
supposed to lose all the restore points after you disable the System Restore
and restart the system... if they are still there, "something" is keeping
them intact... or you didn't actually disable it... If you

<"Went back to system restore and it was back turned on and
< all the restore points were still there"

It may be System Restore was not in fact disabled...


------------------------------------

 

[Randem]

To delete the system restore points I will boot from Bart PE and delete the
contents of that folder.

--
Randem Systems
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
http://www.rndem.com/installerproblems.html
http://www.randem.com/vistainstalls.html
http://www.financialtrainingservices.org

 

[Theslaz]

To delete the system restore points I will boot from Bart PE and delete the
contents of that folder.

Thanks for all the input. What I did and it was successful; I
reinstalled The "System Restore". The "C" drive is now listed and
monitoring. I was successful in deleting all the system restore points
and have created one new one. I'm a happy camper.

Thanks to everyone!

P.S.: Didn't know that I could reinstall system restore. Learn something
new every day!

 

[Daave]

Thanks for all the input. What I did and it was successful; I
reinstalled The "System Restore". The "C" drive is now listed and
monitoring. I was successful in deleting all the system restore points
and have created one new one. I'm a happy camper.

Thanks to everyone!

P.S.: Didn't know that I could reinstall system restore. Learn
something new every day!

Glad to hear all is well now.

 

[robimars]

HAS ANYONE COME ACROSS THIS PROBLEM: SYSTEM RESTORE WILL NOT ALLOW YOU TO GO
FURTHER BACK THAN THE BEGINNING OF THE MONTH? HOW DO I GET BACK TO SEPTEMBER
OR EARLIER, WHEN PROBLEMS BEGAN TO EMERGE?
robimars

 

[DDW]

HAS ANYONE COME ACROSS THIS PROBLEM: SYSTEM RESTORE WILL NOT ALLOW YOU TO GO
FURTHER BACK THAN THE BEGINNING OF THE MONTH? HOW DO I GET BACK TO SEPTEMBER
OR EARLIER, WHEN PROBLEMS BEGAN TO EMERGE?

You can only go back as far as your oldest restore point. If you
can't go beyond the first of the month, there are no restore points
further back than that.


DDW

 

[Roy Smith]

HAS ANYONE COME ACROSS THIS PROBLEM: SYSTEM RESTORE WILL NOT ALLOW YOU TO
GO
FURTHER BACK THAN THE BEGINNING OF THE MONTH? HOW DO I GET BACK TO
SEPTEMBER
OR EARLIER, WHEN PROBLEMS BEGAN TO EMERGE?

The calendar in System Restore will only go back as far as your oldest
restore point. The number of restore point you can save depends on 2
things, the size of your hard drive (or partition), and the amount of space
you've allocated for system restore. To see how much space is allocated for
System Restore, right click on the My Computer icon and select Properties.
Next click on the System Restore tab, then click on the Settings button.
The slider will show you how much space is reserved for your restore points
as both a percentage and the actual size in MB. Once that area is full,
each new restore point that is created will delete the oldest restore point.

 

[Ken Blake, MVP]

HAS ANYONE COME ACROSS THIS PROBLEM: SYSTEM RESTORE WILL NOT ALLOW YOU TO GO
FURTHER BACK THAN THE BEGINNING OF THE MONTH? HOW DO I GET BACK TO SEPTEMBER
OR EARLIER, WHEN PROBLEMS BEGAN TO EMERGE?

Please don't yell at us. We can hear you if type normally, in mixed
case.

How far back you can go in System Restore is limited by how many
restore points you have saved, and how many restore points you have
saved is limited by the amount of space you dedicate to System
Restore, up to a maximum of 90 days.

Moreover, if you go back too far, you tend to get the registry out of
synch with other files on the drive, so 80 days worth of restore
points aren't really useful.

What kind of problems are you having? System Restore is not the answer
to all problems.