Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System Restore will not enable


  • Please log in to reply
11 replies to this topic

#1 geno368

geno368

  • Members
  • 255 posts
  • OFFLINE
  •  
  • Local time:02:13 PM

Posted 15 July 2009 - 10:49 AM

I am working on a desktop running XP Home and when I to to enable the system restore service, I get this error:"error 126, module can't be found" I have also gotten "ssrstr.dll" not found. How do I fix this? Thank you.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:13 PM

Posted 15 July 2009 - 11:26 AM

Worth a look, http://www.microsoft.com/communities/newsg...amp;m=1&p=1

Louis

#3 joseibarra

joseibarra

  • Members
  • 1,258 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:13 PM

Posted 15 July 2009 - 11:52 AM

...and, System Restore is a frequent target of malicious software in an attempt to prevent you from getting yourself back to a previous point before it moved in.


A few good free scans won't hurt:

Download, install, update and do a full scan with these three free malware detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/
AVG (AVG): http://free.avg.com/

What prompts you to do a System Restore?

Try the scans first and maybe your original problem will be remedied.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#4 geno368

geno368
  • Topic Starter

  • Members
  • 255 posts
  • OFFLINE
  •  
  • Local time:02:13 PM

Posted 15 July 2009 - 03:10 PM

thanks for the help.....I was trying to restore some windows games that didn't show up. I got a message to do a chkdsk and after I did that, they were there again..I have run the scans you show with no problems. I am just worried if I don't have the restore option for the future. Now when I reboot it still wants to do a chkdsk and still shows some corrupt files...what do I need to do?

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 56,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:13 PM

Posted 15 July 2009 - 03:41 PM

Start/Run...type chkdsk /r (with space between k and /) and hit Enter.

Type Y in response to screen query and hit Enter.

Reboot the system, the chkdsk will run before the system boots into XP. Once the command has finished, the system will automatically boot into XP.

Louis

#6 joseibarra

joseibarra

  • Members
  • 1,258 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:13 PM

Posted 15 July 2009 - 03:49 PM

What hamluis said.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#7 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,635 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:13 PM

Posted 16 July 2009 - 11:01 AM

Hi geno368,

Did your malware scanners find anything? In my experience, malware does not directly target System Restore frequently, but can be ultimately responsible for problems with it. Direct interference does happen, but is a relatively more recent development. More on this in a bit.

Let us know if the check disk has helped with System Restore (SR). Then let us know if you have tried the fix linked to by hamlius in Post #2. You usually get the error you posted when Windows can't find files in the location specified, which means the file isn't in that folder or your registry has been changed to point to a different location.

I'll summarize what the fix entails, even tho you have had similar instructions in your thread at PC Pitstop:
http://forums.pcpitstop.com/index.php?showtopic=170668

Navigate to your System32 folder--C:\Windows\System32. This is where major system files for windows is stored and so is normally hidden, so if you can't see it unhide those files according to this tutorial: How to see hidden files in Windows

Look for the file named ssrstr.dll. If found, rename it (hit F2)--usually it is easiest to change the three letter file extension at the end to anything you like, such as .old If you can't find it, look in your c:\windows\system32\dllcache folder and then copy it over to your System32 folder. Another thing I find interesting is that I checked for this file on my own system and I can't find it in either location and my System Restore works fine. So let us know how things are going, if you can't find it we can investigate further and try something else.

Then navigate to your C:\WINDOWS\system32\Restore folder and look for the file named rstrui.exe. Same procedure here--rename it if found then reboot and see if it's replaced by the system and if not found copy it over from the dllcache folder. Here again, I don't have a copy in dllcache--which makes sense because it isn't a dll--but do see an extra copy in C:\WINDOWS\ServicePackFiles\i386, which is probably where Windows copies it over from.

When you are finished, reboot your system and test System Restore. On re-reading:

when I to to enable the system restore service

Do I understand correctly that you are attempting to start the SR service from the services.msc console? If so, what was the state when you first looked; was it not set on Automatic? Obviously you will have to have this service running to be able to test SR. You also won't have any restore points--but the easiest way to test is to create a restore point, reboot, then try to restore to that restore point.

If the service has been running and System Restore has been enabled, the most common problem with SR is corruption of the SR cache. This often happens because malware can be backed up by SR and some malware scanners will remove infected Restore Points. This causes inconsistency in an SR log and results in SR failure to go back to Restore Points that do exist. The fix for this is to purge your old restore points so the log is updated--either by turning System Restore off then on again or using Disk Cleanup to delete all but the most recent restore point after you have created one on a good running system.

A few good free scans won't hurt:

Download, install, update and do a full scan with these three free malware detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/
AVG (AVG): http://free.avg.com/

Emphasis by me.

I do not agree with this advice at all--to install and run AVG.

First, it assumes that there is no antivirus already installed or that the person has enough common sense to not run more than one antivirus with real time protection. Geno probably does have enough sense not to, but I can't tell you how many times I have helped people who have two or more AV's running where the resulting conflicts had them convinced they were infected with malware--or they were infected and didn't know they shouldn't install multiple AV's to remove it.

Second, why AVG and not some other AV? Or a cleanup tool by an antivirus vendor that will scan and clean but not install real time/on access scanners, such as Trend Micro's SysClean, McAfee's Stinger and Kaspersky's removal tool?

Thirdly, and to the point of this thread, AVG is one of the worst at corrupting System Restore cache by removing what it thinks are infected Restore points. I know this from personal experience. They aren't the only ones to do this--AntiVir, that I use, will also, but at least with it you can set it to ignore the Systemvolumeinformation folder where with AVG free you can't. Unfortunately, this has become a bandwagon type thing. Several other antimalware scanners remove Restore Points and CCleaner now has a System Restore Manager--as does a commercial junk cleaner software that I looked at recently. All one has to do to get rid of infected restore points is to purge system restore after cleanup when the system is running well.

Anyway, let us know how it goes Geno.

The thing about people

is they change

when they walk away.--Mipso


#8 MystaShyft

MystaShyft

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Location:Toronto Ontario
  • Local time:03:13 PM

Posted 18 July 2009 - 07:09 AM

Hi geno368,

AntiVir, that I use, will also, but at least with it you can set it to ignore the Systemvolumeinformation folder where with AVG free you can't.

Anyway, let us know how it goes Geno.


How do I do this? I found where the exception box is.

I cannot see Systemvolumeinformation folder anywhere.

i was using AVG before and after reading some posts,I now know how my restore points vanished.

Any help would be appreciated.
GA-MA790FXT-UD5P/Phenom II x4 965 BE/4x2GB DDR31333 G-Skill /2x Sapphire HD4870 1gb /Seagate Barracuda 640/500GB Sata 2 HDD's 3.0/ Corsair 850 TX PSU/BenQ 24" lcd/Windows 7 Pro/ /Antec DF-85 gamer case

#9 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:01:13 PM

Posted 18 July 2009 - 07:30 AM

You probably cannot see it because you have do not have hidden folders set to be viewable. Here are the directions for making them viewable...

Close all programs so that you are at your desktop.
Double-click on the My Computer icon.
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and shutdown My Computer.
Now your computer is configured to show all hidden files.

Edited by Stang777, 18 July 2009 - 07:30 AM.


#10 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,635 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:13 PM

Posted 18 July 2009 - 10:00 AM

How do I do this? I found where the exception box is.

I cannot see Systemvolumeinformation folder anywhere.


Hi MystaShyft
This should probably be in a topic of its own, but in any event it may also be my fault that you can't find that folder because I didn't spell it correctly. The name of the folder is System Volume Information and it is located in the root of the drive that Windows is installed on, which for most people is C, so the path would be C:\Sytem Volume Information Even tho it isn't necessary to see the folder to have it excluded in AntiVir, it is a good idea to check that it actually exists. So after you have followed Stang777's instructions (or followed those in the tutorial I linked to in my post above), check to make sure it's there. It will look a little faded, as will any file/folder that is normally hidden, and do not be concerned if you can't open the folder--access is normally restricted by Windows and there is little reason to do so as you could easily corrupt your cache.

Full instructions for adding System Restore to AntiVir's exceptions:


1. Open AntiVir.

2. Click the Extras menu (top) and choose Configuration.

3. Click in the box next to Expert mode to put a checkmark there--this is important since the Exclusion option won't show up unless Expert mode is checked.

4. If there is a plus sign to the left of Scanner, click it to expand and if one is next to Scan do the same.

5. Click Exception.

6. Copy the complete filepath that I've marked in bold below and paste it into the text field to the left of the Add>> button (you could also use the browse button--that small one with the ellipses/three periods--to browse to the folder, but the SVI is a hidden folder so copy and paste is easier):

C:\System Volume Information

7. Click the Add>> button. The filepath should now appear in the text field to the right of the Add>> button. Then OK and exit configuration.

i was using AVG before and after reading some posts,I now know how my restore points vanished.


OK, I just want to make sure you and everyone else understands a few things. One is that just running AVG won't corrupt the SR cache. It only happens under certain conditions:

1. You must have a file on your system that AVG detects as a threat.
2. That file must be backed up by SR (this is indicated when the file is located in the SVI folder), and
3. The file must be removed from the SVI folder.

It's been a while now since I've run AVG--even tho you can't excluded folders from being scanned I think there is a configuration option to quarantine detected files, but leave a copy in the original location--but the default is to remove files from the original location.

Another minor point is that this behavior by AVG only began with version 8.0, when AVG Anitspyware program (that had previously been known as ewido) was integrated with AVG antivirus. Previous versions of AVG didn't have this problem. But the point is, if you don't get infected, just running AVG won't affect SR.

My experience was this: I had some malicious files onboard for testing purposes, which is normal for those of us who do malware removal (HJT Team). Some of those files were backed up by System Restore. When I ran a scan with AVG 8.0, those files were removed from the System Volume Information folder, and System Restore was broken. It happened twice--once I fixed SR by turning off System Restore and then re-enabling it. The second time, I left SR broken and tested a few days later. To my surprise SR worked correctly, so apparently SR can fix itself--I suppose by updating its log.

In any event there could be several reasons why a person has no restore points or SR doesn't work correctly. If you turn SR off, then you won't have restore points--they get deleted. And as mentioned, besides malware interference--that does occur nowdays--several other programs are capable of messing around in the SVI folder, which could result in SR corruption, not just AVG. Unfortunately MBAM, which is often recommended here, is, I believe, one of those.

The thing about people

is they change

when they walk away.--Mipso


#11 MystaShyft

MystaShyft

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Location:Toronto Ontario
  • Local time:03:13 PM

Posted 24 July 2009 - 07:13 AM

I ran Windows One Care for another problem,and as a side bonus my System restore is working again. :thumbsup:
It must have been virus/spyware related. I'll stick with AVG.
GA-MA790FXT-UD5P/Phenom II x4 965 BE/4x2GB DDR31333 G-Skill /2x Sapphire HD4870 1gb /Seagate Barracuda 640/500GB Sata 2 HDD's 3.0/ Corsair 850 TX PSU/BenQ 24" lcd/Windows 7 Pro/ /Antec DF-85 gamer case

#12 joseibarra

joseibarra

  • Members
  • 1,258 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:13 PM

Posted 24 July 2009 - 07:31 AM

Good job!

I offered up AVG because it found an unrelated problem for me once when MBAM and SAS did not, but only once.

I will just stick with MBAM and SAS as a general purpose cleaner for now.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users