Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Last known vs restore point?


  • Please log in to reply
12 replies to this topic

#1 markg2

markg2

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 08 March 2011 - 08:29 AM

When you opt for the 'Last Known' option at boot, is that option simply restoring the most recent restore point?

Mark

BC AdBot (Login to Remove)

 


#2 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 08 March 2011 - 08:40 AM

No. It restores information in HKLM\System\CurrentControlSet but does not restore any other registry changes made by the user.

#3 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 08 March 2011 - 09:15 AM

Okay, then I need to explain further.

This is a new XP machine with RAID1 mirrored drives. Yesterday, after installing Office 10 and then the balance of 'critical' updates, I checked to see 'ALL' updates. There were 2 hardware updates and a few software updates. One hardware update was for the monitor and not needed since we're buying a new one. The second appeared to be for the hard drive. I installed that update along with .net 4.

Upon reboot the computer made a very weird noise coming through the speakers and shortly after the desktop loaded was the BSOD. Another soft boot resulted in the same. A hard boot gave me a bit more time and I tried to get to Add/Remove to try to remove the last updates but got a BSOD before getting that far.

On the next boot I landed (without my interference) on the boot screen showing 'Last Known'. The machine was okay for the balance of the day and night.

I'm uncomfortable with the situation. Given what I've described, apart from not downloading and installing that hardware update, is there anything I could or should do proactively at this point?

Mark

#4 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 08 March 2011 - 09:21 AM

1) NEVER download hardware or driver updates from Windows Update. Those should ONLY and ALWAYS be obtained from the OEM websites. Moreover, you should only update drivers if there is a specific need to do so.

2) When you restored "Last Known Good" you did indeed revert to the previous device driver(s). However, if you want to be certain everything is back to the way it was, use system restore and then re-download and install the updates you want.

3) In the future, you might want to consider using disc imaging software on a regular basis.

#5 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 08 March 2011 - 10:34 AM

You are now preaching to the choir regarding device drivers.

When you use System Restore does it JUST remove any OS updates received after the date of the restore point and nothing more or less?

I am meticulous about imaging our home computers. The computer in question, as mentioned, is not mine but my wife has responsibility for it. The mirrored drives are single partition 500GB so there's tons of room. I would have to create a new partition for the image but given that it is a RAID setup, it's above my pay grade.

The tech person is coming out for a training session for the some of the folks in a week or two. I will speak to him in advance about creating the partition and installing Acronis or the like.

Thanks for help--

Mark

#6 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 08 March 2011 - 10:37 AM

System restore replaces the entire registry with the one from the restore date, as opposed to Last Known Good which restores just the one key I mentioned.

#7 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 08 March 2011 - 07:26 PM

2 further questions in this regard--

Despite clicking the various links within the text of help on this subject I cannot find how to open the sys restore box that lists the restored dates. I find the box that turns restore on/off but not the one to invoke a restore?

Is there a way to 'freeze' a restore date? I know I have a good restore date Saturday or Sunday afternoon. Soon, absent freezing that restore date, that restore date will be overwritten as newer dates are added by the system.

Mark

#8 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 09 March 2011 - 07:55 AM

http://support.microsoft.com/kb/306084

And to answer your second question, no, that's one of System Restore's many shorcomings. But there are several alternative options:

1) Click on START - RUN and type: Regedit (press ENTER). On the menu bar click on file, then export, choose where you want to save it, then enter a name for it in the box titled: File Name. At bottom put a tick in "All", then click on save. If you ever want to restore the saved version, just IMPORT it.

2) The best method to backup the registry, in my opinion, is to download and run ERUNT. It's the best registry backup utility available - and it's free!!!

3) And the best of all possible options is to use Disc Imaging software on a regular basis (create images to a second hd).

#9 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 09 March 2011 - 07:36 PM

Thanks for all the help--it's been very helpful.

The restore instructions were good. Another BSOD today. I ran WhoCrashed on the computer which pointed to the Intel graphics accelerator. I visited the video driver under system, attempted to Rollback but was told nothing to roll back to. I booted to Last Known just in case the BSOD driver problem was something else--more of a Hail Mary. In the morning I'll confirm with support that http://www.opendrivers.com/driver/296267/intel-g41-g43-g45-graphics-media-accelerator-driver-14.41.0.5160-windows-xp-free-download.html is the correct driver and see if installing same works. Since the problem appears to the hardware I suspect that moving the system to a restore date of Sunday or Monday will not help.

Mark

#10 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 11 March 2011 - 06:44 PM

The problem was the newer Intel graphics driver as downloaded through MS update. I downloaded and installed a new (older) driver from the computer vendor's site Thursday morning. I ran a video loop for ~6 hours Thursday and today and all is well.

I'd like to give a shout out to the guy on this site who turned me on to WhoCrashed last year.

Mark

#11 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 12 March 2011 - 08:10 AM

For future reference, NEVER download drivers from Windows Update - always obtain them from the OEM website.

#12 markg2

markg2
  • Topic Starter

  • Members
  • 37 posts
  • OFFLINE
  •  
  • Local time:08:05 AM

Posted 12 March 2011 - 08:48 AM

I've clearly learned the lesson about Windows update. But I disagree on the OEM site. Intel had the same newest video driver as did Windows update. It was the computer maker's site that maintained the preferred older version that was compatible.

#13 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 AM

Posted 12 March 2011 - 03:09 PM

Disagree to your heart's content. Desktop drivers should be obtained from the oem website. If you need an older driver for some reason that's fine, but that makes your situation the exception, not the rule ;)

Regardless, happy to hear you're back in business :)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users