System Restore

[Guest]

This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system properties to see
what was up and there was a message stating the system restore was turned off
by group policy and that to restore it would have to be done by domain
administator.

I am sure she doesnt want to lose what she has on her pc...(which prolly
isnt a bad idea) and i need a to know how to get the resotre back. She also
has lost all access to her help and support files. They just arent there any
longer. I think she may have had a virus an when virus was deleted her files
went to.

Any help will be appreciated. ty

 

[Bert Kinney]

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

 

[Bert Kinney]

Hi Icey,

Fix Windows XP Help
http://www.dougknox.com/xp/scripts_desc/fixwinxphelp.htm

 

[Guest]

Same thing happened to me. I believe it is caused by a worm picked up from
MSN messanger.
Wayne Hansen
(e-mail address removed)

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system
properties to see what was up and there was a message
stating the system restore was turned off by group policy
and that to restore it would have to be done by domain
administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to know
how to get the resotre back. She also has lost all access
to her help and support files. They just arent there any
longer. I think she may have had a virus an when virus
was deleted her files went to.

Any help will be appreciated. ty

 

[Bert Kinney]

Hi Wayne,

Yes, some viruses are created in a way that it will disables the very
tools used to remove them.

Note: You should not be using your real email address as it can lead
to SPAM.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Same thing happened to me. I believe it is caused by a
worm picked up from MSN messanger.
Wayne Hansen
(e-mail address removed)

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system
properties to see what was up and there was a message
stating the system restore was turned off by group
policy and that to restore it would have to be done by
domain administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to know
how to get the resotre back. She also has lost all
access to her help and support files. They just arent
there any longer. I think she may have had a virus an
when virus was deleted her files went to.

Any help will be appreciated. ty

 

[Onowotnow]

Hi Wayne,

Yes, some viruses are created in a way that it will disables
the very
tools used to remove them.

Note: You should not be using your real email address as it
can lead
to SPAM.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Same thing happened to me. I believe it is caused by a
worm picked up from MSN messanger.
Wayne Hansen
(e-mail address removed)

:

 >> Hi Icey,
 >>
 >> Previously posted by Ramesh, Microsoft MVP:
 >>
 >> Open Registry Editor and navigate to:
 >>
 >> HKEY LOCAL
MACHINESOFTWAREPoliciesMicrosoftWindows
 >> NTSystemRestore
 >>
 >> In the right-pane, delete the value "DisableConfig".
 >> Close Registry Editor
 >> Close and re-open the System Restore properties page.
 >>
 >> For more information on System Restore.
 >> All About System Restore in WinXP
 >> http://home.earthlink.net/~mvp_bert/
 >>
 >> --
 >> Regards,
 >> Bert Kinney [MS-MVP DTS]
 >> http://dts-l.org/
 >>
 >>
 >> Icey wrote:
  >>> This is a sorta odd thing..for me anyway.
  >>> My moms pc has lost her system restore. I went
to system
  >>> properties to see what was up and there was a
message
  >>> stating the system restore was turned off by
group
  >>> policy and that to restore it would have to be
done by
  >>> domain administator.
  >>>
  >>> I am sure she doesnt want to lose what she has
on her
  >>> pc...(which prolly isnt a bad idea) and i need
a to know
  >>> how to get the resotre back. She also has lost
all
  >>> access to her help and support files. They
just arent
  >>> there any longer. I think she may have had a
virus an
  >>> when virus was deleted her files went to.
  >>>
  >>> Any help will be appreciated. ty

OK, I’ve joined so many forums today to try and get a solution to
getting my System Restore Tab back. This is the first place that may
have the answer. Briefly (in case you’ve read this all before
elsewhere) I’ve had the Fatso.B worm which gets rid of the System
Restore Tab under My Computer/Properties on XP. According to
Trendmicro’s updated info on Fatso B which I’ve just read (I only had
the initial info to begin with) the worm "creates" two entries in
the Registry under
HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Windows
NT>SystemRestore. It creates Disable SR (set to 0) and DisableConfig
(set to 0). In the Fatso.A Solution that I printed out a few days ago
it tells you to reset these values to 1 but not to delete the Registry
entries. I did this but my System Restore Tab did not return.

So, are you saying that I should delete the entry, i.e. the whole line
on the RHS of the Registry? And should I also delete the whole line
of the DisableSR entry as well? Should either of them be there?

I - and the other people infected by this worm - will be very grateful
if you can clarify this for us and if it does the trick!!!

 

[Bert Kinney]

Hi,

Yes, DisableSR and DisableConfig can be deleted or the value set to 0
not 1 at the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

If the above doesn’t fix the issue, there’s a registry edit at Kelly’s
Korner.
Look on line 278 left side.
http://www.kellys-korner-xp.com/xp_tweaks.htm

 

[Onowotnow]

Hi,

Yes, DisableSR and DisableConfig can be deleted or the value
set to 0
not 1 at the following key:
HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows
NTSystemRestore

If the above doesn’t fix the issue, there’s a registry edit at
Kelly’s
Korner.
Look on line 278 left side.
http://www.kellys-korner-xp.com/xp_tweaks.htm

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

OK, I’ve joined so many forums today to try and get a
solution to getting my System Restore Tab back. This is
the first place that may have the answer. Briefly (in
case you’ve read this all before elsewhere) I’ve had the
Fatso.B worm which gets rid of the System Restore Tab
under My Computer/Properties on XP. According to
Trendmicro’s updated info on Fatso B which I’ve just read
(I only had the initial info to begin with) the worm
"creates" two entries in
the Registry under

HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Win
dows
 >> SystemRestore. It creates Disable SR (set to 0) and
 >> DisableConfig

(set to 0). In the Fatso.A Solution that I printed out a
few days ago it tells you to reset these values to 1 but
not to delete the Registry entries. I did this but my
System Restore Tab did not return.

So, are you saying that I should delete the entry, i.e.
the whole line on the RHS of the Registry? And should I
also delete the whole line of the DisableSR entry as
well? Should either of them be there?

I - and the other people infected by this worm - will be
very grateful if you can clarify this for us and if it
does the trick!!!

YES YES YES - I have deleted both entries and my System Restore Tab
has magically reappeared! Excuse me while I do a little dance for
joy!!! I think that deserves a large font and a big smile, don’t you?
Thank you so much - you have made my week!

 

[Bert Kinney]

You're welcome, and thanks for the feedback.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Hi,

Yes, DisableSR and DisableConfig can be deleted or the
value set to 0
not 1 at the following key:
HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows
NTSystemRestore

If the above doesn’t fix the issue, there’s a registry
edit at Kelly’s
Korner.
Look on line 278 left side.
http://www.kellys-korner-xp.com/xp_tweaks.htm

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

OK, I’ve joined so many forums today to try and get a
solution to getting my System Restore Tab back. This is
the first place that may have the answer. Briefly (in
case you’ve read this all before elsewhere) I’ve had the
Fatso.B worm which gets rid of the System Restore Tab
under My Computer/Properties on XP. According to
Trendmicro’s updated info on Fatso B which I’ve just
read (I only had the initial info to begin with) the
worm "creates" two entries in
the Registry under

HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Win
dows
 >> SystemRestore. It creates Disable SR (set to
0) and  >> DisableConfig

(set to 0). In the Fatso.A Solution that I printed out
a few days ago it tells you to reset these values to 1
but not to delete the Registry entries. I did this but
my System Restore Tab did not return.

So, are you saying that I should delete the entry, i.e.
the whole line on the RHS of the Registry? And should I
also delete the whole line of the DisableSR entry as
well? Should either of them be there?

I - and the other people infected by this worm - will be
very grateful if you can clarify this for us and if it
does the trick!!!

YES YES YES - I have deleted both entries and my System
Restore Tab has magically reappeared! Excuse me while I
do a little dance for joy!!! I think that deserves a
large font and a big smile, don’t you? Thank you so much
- you have made my week!

 

[Onowotnow]

You're welcome, and thanks for the feedback.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

"Bert Kinney" wrote:

 >> Hi,
 >>
 >> Yes, DisableSR and DisableConfig can be deleted or
the
 >> value set to 0
 >> not 1 at the following key:
 >> HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows
 >> NTSystemRestore
 >>
 >> If the above doesn’t fix the issue, there’s a
registry
 >> edit at Kelly’s
 >> Korner.
 >> Look on line 278 left side.
 >> http://www.kellys-korner-xp.com/xp_tweaks.htm
 >>
 >> --
 >> Regards,
 >> Bert Kinney [MS-MVP DTS]
 >> http://dts-l.org/
 >>
 >> Onowotnow wrote:
  >>> OK, I’ve joined so many forums today to try
and get a
  >>> solution to getting my System Restore Tab
back. This is
  >>> the first place that may have the answer.
Briefly (in
  >>> case you’ve read this all before elsewhere)
I’ve had the
  >>> Fatso.B worm which gets rid of the System
Restore Tab
  >>> under My Computer/Properties on XP. According
to
  >>> Trendmicro’s updated info on Fatso B which
I’ve just
  >>> read (I only had the initial info to begin
with) the
  >>> worm "creates" two entries in
  >>> the Registry under
  >>>
 >>
HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Win
 >> dows
 >>  >> SystemRestore. It creates Disable SR
(set to
 >> 0) and  >> DisableConfig
  >>> (set to 0). In the Fatso.A Solution that I
printed out
  >>> a few days ago it tells you to reset these
values to 1
  >>> but not to delete the Registry entries. I did
this but
  >>> my System Restore Tab did not return.
  >>>
  >>> So, are you saying that I should delete the
entry, i.e.
  >>> the whole line on the RHS of the Registry?
And should I
  >>> also delete the whole line of the DisableSR
entry as
  >>> well? Should either of them be there?
  >>>
  >>> I - and the other people infected by this worm
- will be
  >>> very grateful if you can clarify this for us
and if it
  >>> does the trick!!!

YES YES YES - I have deleted both entries and my System
Restore Tab has magically reappeared! Excuse me while I
do a little dance for joy!!! I think that deserves a
large font and a big smile, don’t you? Thank you so much
- you have made my week!

Just wanted to add that the two entries were "created" by the worm
and set to "0" in the first place, so setting them to "0" wouldn’t
work. And neither did setting them to "1" as instructed in
trendmicro’s Solution for Fatso.A (aka Serflog.A). The only solution
was to delete both of them, since they shouldn’t have been there in
the first place, it seems.

 

[Guest]

Hi Bigwhitesnow
Did you manage to resolve this restore problem as I think my kids have the
same worrm from MSN and I am not sure what to do

Same thing happened to me. I believe it is caused by a worm picked up from
MSN messanger.
Wayne Hansen
(e-mail address removed)

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system
properties to see what was up and there was a message
stating the system restore was turned off by group policy
and that to restore it would have to be done by domain
administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to know
how to get the resotre back. She also has lost all access
to her help and support files. They just arent there any
longer. I think she may have had a virus an when virus
was deleted her files went to.

Any help will be appreciated. ty

 

[Guest]

Hi Bert,

I was the guy that used CAPS earlier today, I have been through all the anti
virus programs I can fing. the two registries were set to value 0 but still
no Restore Tab
Do you have any other suggestions

Kind Regards

Stewart

Hi Wayne,

Yes, some viruses are created in a way that it will disables the very
tools used to remove them.

Note: You should not be using your real email address as it can lead
to SPAM.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Same thing happened to me. I believe it is caused by a
worm picked up from MSN messanger.
Wayne Hansen
(e-mail address removed)

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/


Icey wrote:
This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system
properties to see what was up and there was a message
stating the system restore was turned off by group
policy and that to restore it would have to be done by
domain administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to know
how to get the resotre back. She also has lost all
access to her help and support files. They just arent
there any longer. I think she may have had a virus an
when virus was deleted her files went to.

Any help will be appreciated. ty

 

[Bert Kinney]

Yes, rather than change the value, delete these two value keys from
the registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right pane, right click on each of these Value Keys and select
delete.
"DisableSR"
"DisableConfig"

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Hi Bert,

I was the guy that used CAPS earlier today, I have been
through all the anti virus programs I can fing. the two
registries were set to value 0 but still no Restore Tab
Do you have any other suggestions

Kind Regards

Stewart

Hi Wayne,

Yes, some viruses are created in a way that it will
disables the very tools used to remove them.

Note: You should not be using your real email address as
it can lead to SPAM.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Same thing happened to me. I believe it is caused by a
worm picked up from MSN messanger.
Wayne Hansen
(e-mail address removed)

:

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/


Icey wrote:
This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to
system properties to see what was up and there was a
message stating the system restore was turned off by
group policy and that to restore it would have to be
done by domain administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to
know how to get the resotre back. She also has lost
all access to her help and support files. They just
arent there any longer. I think she may have had a
virus an when virus was deleted her files went to.

Any help will be appreciated. ty

 

[Onowotnow]

Yes, rather than change the value, delete these two value keys
from
the registry.

HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows
NTSystemRestore

In the right pane, right click on each of these Value Keys and
select
delete.
"DisableSR"
"DisableConfig"

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Hi Bert,

I was the guy that used CAPS earlier today, I have been
through all the anti virus programs I can fing. the two
registries were set to value 0 but still no Restore Tab
Do you have any other suggestions

Kind Regards

Stewart

:

 >> Hi Wayne,
 >>
 >> Yes, some viruses are created in a way that it will
 >> disables the very tools used to remove them.
 >>
 >> Note: You should not be using your real email address
as
 >> it can lead to SPAM.
 >>
 >> --
 >> Regards,
 >> Bert Kinney [MS-MVP DTS]
 >> http://dts-l.org/
 >>
 >> BigWhiteSnow wrote:
  >>> Same thing happened to me. I believe it is
caused by a
  >>> worm picked up from MSN messanger.
  >>> Wayne Hansen
  >>> (e-mail address removed)
  >>>
  >>> "Bert Kinney" wrote:
  >>>
  >>>> Hi Icey,
  >>>>
  >>>> Previously posted by Ramesh, Microsoft MVP:
  >>>>
  >>>> Open Registry Editor and navigate to:
  >>>>
  >>>> HKEY LOCAL
MACHINESOFTWAREPoliciesMicrosoftWindows
  >>>> NTSystemRestore
  >>>>
  >>>> In the right-pane, delete the value
"DisableConfig".
  >>>> Close Registry Editor
  >>>> Close and re-open the System Restore
properties page.
  >>>>
  >>>> For more information on System Restore.
  >>>> All About System Restore in WinXP
  >>>> http://home.earthlink.net/~mvp_bert/
  >>>>
  >>>> --
  >>>> Regards,
  >>>> Bert Kinney [MS-MVP DTS]
  >>>> http://dts-l.org/
  >>>>
  >>>>
  >>>> Icey wrote:
  >>>>> This is a sorta odd thing..for me anyway.
  >>>>> My moms pc has lost her system restore. I
went to
  >>>>> system properties to see what was up and
there was a
  >>>>> message stating the system restore was
turned off by
  >>>>> group policy and that to restore it would
have to be
  >>>>> done by domain administator.
  >>>>>
  >>>>> I am sure she doesnt want to lose what she
has on her
  >>>>> pc...(which prolly isnt a bad idea) and i
need a to
  >>>>> know how to get the resotre back. She also
has lost
  >>>>> all access to her help and support files.
They just
  >>>>> arent there any longer. I think she may have
had a
  >>>>> virus an when virus was deleted her files
went to.
  >>>>>
  >>>>> Any help will be appreciated. ty

Click Start, Run, type REGEDIT, click OK to get into the Registry
Editor.

In the left panel double-click the following:
HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Windows
NT>SystemRestore

To get your System Restore Tab back you need to DELETE the two entries
in the Registry Editor which appear on the RHS of the panel:

DisableSR
DisableConfig

www.trendmicro says that if you have Fatso.A you should change the
values from "0" to "1" (see below), but this doesn’t work for
Fatso.B worm and if you’ve tried modifying the entries and your Tab
hasn’t returned then you need to delete them completely, since they
were added by the worm in the first place and shouldn’t be there. To
delete them select the entry, right-click on it and click Delete.

For full instructions (copied from trendmicro) on how to manually
remove the Fatso.A worm see

http://forums.techguy.org/showthread.php?p=2443999

or go to www.techguy.org/forums and type "System restore" into the
Search and look for posts by Onowotnow. There are two posts with
manual removal instructions, the later one specifically for XP.

If you have Fatso.B worm you need to be looking for the following in
your Registry to delete:

Random Value: AvSer, DsmSer, rollbk
Random Data: dsm.exe, msmpatch.exe. svosm.exe, sysup.exe

Look also in: HKEY_CURRENT_USER>Microsoft>Windows>CurrentVersion>Run
as this location is listed in trendmicro’s solution for Fatso.B but
not in Fatso.A.

Hope this helps!

 

[Onowotnow]

Click Start, Run, type REGEDIT, click OK to get into the
Registry Editor.

In the left panel double-click the following:
HKEY_LOCAL_MACHINE>Software>Policies>Microsoft>Windows
NT>SystemRestore

To get your System Restore Tab back you need to DELETE the two
entries in the Registry Editor which appear on the RHS of the
panel:

DisableSR
DisableConfig

www.trendmicro says that if you have Fatso.A you should change
the values from "0" to "1" (see below), but this doesn't work
for Fatso.B worm and if you've tried modifying the entries and
your Tab hasn't returned then you need to delete them
completely, since they were added by the worm in the first
place and shouldn't be there. To delete them select the
entry, right-click on it and click Delete.

For full instructions (copied from trendmicro) on how to
manually remove the Fatso.A worm see

http://forums.techguy.org/showthread.php?p=2443999

or go to www.techguy.org/forums and type "System restore" into
the Search and look for posts by Onowotnow. There are two
posts with manual removal instructions, the later one
specifically for XP.

If you have Fatso.B worm you need to be looking for the
following in your Registry to delete:

Random Value: AvSer, DsmSer, rollbk
Random Data: dsm.exe, msmpatch.exe. svosm.exe, sysup.exe

Look also in:
HKEY_CURRENT_USER>Microsoft>Windows>CurrentVersion>Run
as this location is listed in trendmicro's solution for
Fatso.B but not in Fatso.A.

Hope this helps!

Bert, a Frenchman wants to thank you...

http://forums.techguy.org/showthread.php?p=2445774#post2445774

 

[Bert Kinney]

You're very welcome.

 

[Onowotnow]

Bert, a Frenchman wants to thank you...

http://forums.techguy.org/showthread.php?p=2445774#post2445774

That extra registry entry I mentioned in trendmicro’s solution for
Fatso.B is a typing error. I’m pretty sure it should read:
HKCU>Software>Microsoft>Windows>CurrentVersion>Run
Symantec’s information for Serflog.B has the correct entries.

As someone else has pointed out elsewhere if you’re trying to fix the
Serflog/Fatso/Crog worms the Hijackthis program will tell you which
entries in the Registry are infected and delete them for you when you
check those boxes and click on "Fix....". You just need to know the
names you’re looking for. AvSer, DsmSer, rollbk, dsm.exe,
msmpatch.exe, svosm.exe, sysup.exe - you’ve got Fatso.B/serflog.B. If
you see Itwob,serpe,Avnort, msmbw.exe, serbw.exe, formatsys.exe -
you’ve Fatso.A/Serflog.A.

 

[Guest]

Yes, I went through all of the worm cleaning suggestions and the Registry
Edit suggestions but still no System Restore capability. Finally what worked
was basicly reinstalling the System restore from my original XP home version
CD:


Go to the hidden folder Windows\Inf (set to see hidden items in My
Computer Tools - Folder Options - View)

Look for sr.inf, right click on it, choose "Install" (it will probably ask
for the CD) I said "yes" when asked to overwrite the "newer" files with the
"older" files found on the CD. I suspect the worm corrupted the System
Restore files.

Regards Bigwhitesnow

Hi Bigwhitesnow
Did you manage to resolve this restore problem as I think my kids have the
same worrm from MSN and I am not sure what to do

Same thing happened to me. I believe it is caused by a worm picked up from
MSN messanger.
Wayne Hansen

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/


Icey wrote:
This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to system
properties to see what was up and there was a message
stating the system restore was turned off by group policy
and that to restore it would have to be done by domain
administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to know
how to get the resotre back. She also has lost all access
to her help and support files. They just arent there any
longer. I think she may have had a virus an when virus
was deleted her files went to.

Any help will be appreciated. ty

 

[Onowotnow]

Yes, I went through all of the worm cleaning suggestions and
the Registry
Edit suggestions but still no System Restore capability.
Finally what worked
was basicly reinstalling the System restore from my original
XP home version
CD:


Go to the hidden folder WindowsInf (set to see hidden items
in My
Computer Tools - Folder Options - View)

Look for sr.inf, right click on it, choose "Install" (it will
probably ask
for the CD) I said "yes" when asked to overwrite the "newer"
files with the
"older" files found on the CD. I suspect the worm corrupted
the System
Restore files.

Regards Bigwhitesnow

Hi Bigwhitesnow
Did you manage to resolve this restore problem as I think my kids have the
same worrm from MSN and I am not sure what to do

:

 > > Same thing happened to me. I believe it is caused
by a worm picked up from
 > > MSN messanger.
 > > Wayne Hansen
 > >
 > > "Bert Kinney" wrote:
 > >
  > > > Hi Icey,
  > > >
  > > > Previously posted by Ramesh, Microsoft MVP:
  > > >
  > > > Open Registry Editor and navigate to:
  > > >
  > > > HKEY LOCAL
MACHINESOFTWAREPoliciesMicrosoftWindows
  > > > NTSystemRestore
  > > >
  > > > In the right-pane, delete the value
"DisableConfig".
  > > > Close Registry Editor
  > > > Close and re-open the System Restore
properties page.
  > > >
  > > > For more information on System Restore.
  > > > All About System Restore in WinXP
  > > > http://home.earthlink.net/~mvp_bert/
  > > >
  > > > --
  > > > Regards,
  > > > Bert Kinney [MS-MVP DTS]
  > > > http://dts-l.org/
  > > >
  > > >
  > > > Icey wrote:
  > > > > This is a sorta odd thing..for me anyway.
  > > > > My moms pc has lost her system restore. I
went to system
  > > > > properties to see what was up and there
was a message
  > > > > stating the system restore was turned off
by group policy
  > > > > and that to restore it would have to be
done by domain
  > > > > administator.
  > > > >
  > > > > I am sure she doesnt want to lose what she
has on her
  > > > > pc...(which prolly isnt a bad idea) and i
need a to know
  > > > > how to get the resotre back. She also has
lost all access
  > > > > to her help and support files. They just
arent there any
  > > > > longer. I think she may have had a virus
an when virus
  > > > > was deleted her files went to.
  > > > >
  > > > > Any help will be appreciated. ty
  > > >
  > > >
  > > >

Did you delete both DisableSR and DisableConfig entries from the
Register, BWS? I deleted BOTH entries and got my Tab back.

 

[Guest]

Hi Bert

Just a mail to say a big thank you. The Kenny Korner(think that was the site)
line 278 worked a treat

Once again thanks

Stewart

Yes, rather than change the value, delete these two value keys from
the registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right pane, right click on each of these Value Keys and select
delete.
"DisableSR"
"DisableConfig"

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

Hi Bert,

I was the guy that used CAPS earlier today, I have been
through all the anti virus programs I can fing. the two
registries were set to value 0 but still no Restore Tab
Do you have any other suggestions

Kind Regards

Stewart

Hi Wayne,

Yes, some viruses are created in a way that it will
disables the very tools used to remove them.

Note: You should not be using your real email address as
it can lead to SPAM.

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/

BigWhiteSnow wrote:
Same thing happened to me. I believe it is caused by a
worm picked up from MSN messanger.
Wayne Hansen
(e-mail address removed)

:

Hi Icey,

Previously posted by Ramesh, Microsoft MVP:

Open Registry Editor and navigate to:

HKEY LOCAL MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\SystemRestore

In the right-pane, delete the value "DisableConfig".
Close Registry Editor
Close and re-open the System Restore properties page.

For more information on System Restore.
All About System Restore in WinXP
http://home.earthlink.net/~mvp_bert/

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/


Icey wrote:
This is a sorta odd thing..for me anyway.
My moms pc has lost her system restore. I went to
system properties to see what was up and there was a
message stating the system restore was turned off by
group policy and that to restore it would have to be
done by domain administator.

I am sure she doesnt want to lose what she has on her
pc...(which prolly isnt a bad idea) and i need a to
know how to get the resotre back. She also has lost
all access to her help and support files. They just
arent there any longer. I think she may have had a
virus an when virus was deleted her files went to.

Any help will be appreciated. ty