Unscheduled System Restore at Every Boot - how to stop

[Guest]

This XP SP2 OS on an HP Pavilion notebook (zd8123ea) has taken to performing
a System Restore at every startup... but no changes have been apparent -
event log says "A restoration to "(unknown)" restore point occurred
successfully." (all restore points having disappeared)

Big question: How do I stop this?

Smaller question: What has gone wrong?

Thanks,

Julian
[More stuff if interested follows...]

Disabling System Restore via the System control panel - did not work;
another restore occurred after restarting [so system restore was re-enabled]

FYI The event log also shows an error that occurred before the first restart

The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file 'Britannica' on the volume 'LxrJD31mE'. It has
stopped monitoring the volume.

This is a folder on a removable USB memory stick (which was correctly
removed with the "Safely Remove Hardware" utility).

Even when a USB drive is plugged in (Drive E System Restore in the System
Control panel only says C: is being monitored. Why was the volume E being
monitored? Did that error cause the system restore points to disappear?

 

[neil]

Have you tried disabling system restore and reboot. Then turn it back on
again and see what happens.

Don't know why it would start doing that on its own though. But check
msconfig and see if there are any setting there to enable a restore at
start-up.

Neil

 

[Guest]

Thanks Neil,

I dont know why either! Yeah - I tried turning it off and restarting - it
still did a "restore" (which, since turning it off probably cleared all
restore points, may be responsible for the "successful" restoration of
"(unknown)"!)

Nothing obvious via MSConfig...

System Restore might set a RunOnce in the registry: I have RegRun (spyware,
virus, rootkit protection - highly recommended! - see is www.greatis.com)
which shows in All Users Run Once the following
"C:\WINDOWS\system32\restore\rstrui.exe -c" - I am asking whether that should
be there even if no restore has been requested!

Ta,

Julian

Have you tried disabling system restore and reboot. Then turn it back on
again and see what happens.

Don't know why it would start doing that on its own though. But check
msconfig and see if there are any setting there to enable a restore at
start-up.

Neil

This XP SP2 OS on an HP Pavilion notebook (zd8123ea) has taken to
performing
a System Restore at every startup... but no changes have been apparent -
event log says "A restoration to "(unknown)" restore point occurred
successfully." (all restore points having disappeared)

Big question: How do I stop this?

Smaller question: What has gone wrong?

Thanks,

Julian
[More stuff if interested follows...]

Disabling System Restore via the System control panel - did not work;
another restore occurred after restarting [so system restore was
re-enabled]

FYI The event log also shows an error that occurred before the first
restart

The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file 'Britannica' on the volume 'LxrJD31mE'. It has
stopped monitoring the volume.

This is a folder on a removable USB memory stick (which was correctly
removed with the "Safely Remove Hardware" utility).

Even when a USB drive is plugged in (Drive E System Restore in the
System
Control panel only says C: is being monitored. Why was the volume E being
monitored? Did that error cause the system restore points to disappear?

 

[neil]

Nothing like that in my registry. I think I would backup that entry in the
registry an remove it and see what happens.
Neil

Thanks Neil,

I dont know why either! Yeah - I tried turning it off and restarting - it
still did a "restore" (which, since turning it off probably cleared all
restore points, may be responsible for the "successful" restoration of
"(unknown)"!)

Nothing obvious via MSConfig...

System Restore might set a RunOnce in the registry: I have RegRun
(spyware,
virus, rootkit protection - highly recommended! - see is www.greatis.com)
which shows in All Users Run Once the following
"C:\WINDOWS\system32\restore\rstrui.exe -c" - I am asking whether that
should
be there even if no restore has been requested!

Ta,

Julian

Have you tried disabling system restore and reboot. Then turn it back on
again and see what happens.

Don't know why it would start doing that on its own though. But check
msconfig and see if there are any setting there to enable a restore at
start-up.

Neil

This XP SP2 OS on an HP Pavilion notebook (zd8123ea) has taken to
performing
a System Restore at every startup... but no changes have been
apparent -
event log says "A restoration to "(unknown)" restore point occurred
successfully." (all restore points having disappeared)

Big question: How do I stop this?

Smaller question: What has gone wrong?

Thanks,

Julian
[More stuff if interested follows...]

Disabling System Restore via the System control panel - did not work;
another restore occurred after restarting [so system restore was
re-enabled]

FYI The event log also shows an error that occurred before the first
restart

The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file 'Britannica' on the volume 'LxrJD31mE'. It
has
stopped monitoring the volume.

This is a folder on a removable USB memory stick (which was correctly
removed with the "Safely Remove Hardware" utility).

Even when a USB drive is plugged in (Drive E System Restore in the
System
Control panel only says C: is being monitored. Why was the volume E
being
monitored? Did that error cause the system restore points to disappear?

 

[Sharon Franks]

Do you have Windows Defender installed?

--

Sharon Franks
MCC group
Microsoft Certified Solutions Developer (MCSD)
Microsoft Certified Trainer (MCT).

 

[Guest]

Unscheduled System Restore at Every Boot - how to stop - Resolved:

Deleting the reg key All Users Run Once "*restore" that called rstrui.exe
failed - it's one of those in-use/undeletable keys...

Restarted in safe mode (with the intention of repeating the reg key delete)
and got the notification that a system restore had occurred (but restore
points not erased, so their previous disappearance was not an effect of the
abnormal restore) - checked the registry and the key had gone and thereafter
no problem.

Don't have Windows Defender but I am pretty well protected - LINUX based
firewall between me and the next, Norton Anti-virus, Steganos Security Suite,
RegRun Platinum... the most likely explanation is that the issue was probably
a side effect of using CCleaner while trying to eradicate Nokia PC Suite
(valid application but bloated with files, registry keys (1000+?) that screws
itself up and won't uninstall...

Now, if anyone knows how to blast PC Suite into nothingness...!

Thanks for the support and interest folks... hope this helps someone else!

Julian