Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: why do my Restore Points keep disappearing?

18 May 2014   #31
sassofalco

Windows 7 Home Premium x64 - SP1
 
 

Quote   Quote: Originally Posted by andrew129260 View Post
You are doing fine, no need to be embarrassed. When you finish with the other items, report back and let me know how it went. Post new logs after everything is cleared out so I can verify the infections are gone.

When you are up for it, here is another thing I would like you to do. Take your time when doing steps and do not feel rushed. If you have questions ask. Take one step at a time.


1.) Do a disk check using option 1:

Disk Check

2.) Please Run sfc /scan now using option 2 in this tutorial: SFC /SCANNOW Command - System File Checker

Please post back the results.
Results of herdProtect and AdwCleaner are here.

herdProtect # 3 Scan_2014-5-19-2-28.txt

AdwCleaner[S0].txt

It's now 2:47am here, and time for me to get some sleep but I will be back in the morning to continue with running the Junkware Removal Tool.

It took two scans of herdProtect to get rid of the Candy malware, but in the meantime, the Laptop is noticibly faster at the reboot - or is it just my imagination?

Thanks for all the help so far Andrew - I'd be lost without it, or your guidance




My System SpecsSystem Spec
.
18 May 2014   #32
andrew129260

Windows 10 Pro
 
 

Quote   Quote: Originally Posted by sassofalco View Post
Quote   Quote: Originally Posted by andrew129260 View Post
You are doing fine, no need to be embarrassed. When you finish with the other items, report back and let me know how it went. Post new logs after everything is cleared out so I can verify the infections are gone.

When you are up for it, here is another thing I would like you to do. Take your time when doing steps and do not feel rushed. If you have questions ask. Take one step at a time.


1.) Do a disk check using option 1:

Disk Check

2.) Please Run sfc /scan now using option 2 in this tutorial: SFC /SCANNOW Command - System File Checker

Please post back the results.
Results of herdProtect and AdwCleaner are here.

Attachment 318342

Attachment 318343

It's now 2:47am here, and time for me to get some sleep but I will be back in the morning to continue with running the Junkware Removal Tool.

It took two scans of herdProtect to get rid of the Candy malware, but in the meantime, the Laptop is noticibly faster at the reboot - or is it just my imagination?

Thanks for all the help so far Andrew - I'd be lost without it, or your guidance
1.) I doubt its your imagination, multiple things were removed. I am not surprised performance is noticeably better.

2.) You did good. Herdprotect and adwcleaner logs show you are all good now.

3.) If the junkware removal tool fails for any reason or you cannot get it to work, let me know.

4.) Once that is done, continue with the disk check and the sfc scan. I should have mentioned the disk check could have ran overnight.

5.) What antivirus software do you use? I can give you some tips depending on your answer. We want to help you avoid this stuff in the future.

When that disk check and sfc scan completes, we will move on to a couple more things, and then we should be good to go to test the restore points. But again, do not enable system protection until I say so. Thank you.
My System SpecsSystem Spec
18 May 2014   #33
sassofalco

Windows 7 Home Premium x64 - SP1
 
 

Quote   Quote: Originally Posted by andrew129260 View Post
You have got quite some nasties there. Conduit came for a visit. None of the items I have found so far are known to mess with restore points though. But lets get you cleaned up first and move on then from there.


3.) Please download Junkware Removal Tool to your desktop.


  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus
Junkware Removal Tool - Results Log;

JRT.txt

...and so on to CHKDSK


My System SpecsSystem Spec
.

18 May 2014   #34
andrew129260

Windows 10 Pro
 
 

Great job. keep going. jrt log looks good.
My System SpecsSystem Spec
18 May 2014   #35
Layback Bear

Windows 7 Pro. 64/SP-1
 
 

Damn what a JRT log.

You two are gaining on this troubled computer.
My System SpecsSystem Spec
18 May 2014   #36
sassofalco

Windows 7 Home Premium x64 - SP1
 
 
The trouble is with the person sitting in front of the Laptop

Quote   Quote: Originally Posted by andrew129260 View Post
Great job. keep going. jrt log looks good.
Quote   Quote: Originally Posted by Layback Bear View Post
Damn what a JRT log.

You two are gaining on this troubled computer.
At Option Two - I did SFC/SCANNOW, which gave me a CBS.log too large to upload here . Is there another way to link to the file to allow reading by a third party?

The message on the Manage Attachments window, is;

CBS.log:
Your file of 4.72 MB bytes exceeds the forum's limit of 2.00 MB for this filetype.

...further, the last line on Shawns Tutorial concerns me. This Laptop Windows 7 is an OEM setup - I do not have either an installation, or rescue disk for it.

The fact that I can't upload the CBS.log is a real hurdle. I do have a set of three (x3) DVD-R disks created on prompt when I first set-up the Laptop on 9 May 2011. But from my understanding, these are to be used as Recovery Disks to reset the Laptop to Acer Factory Default Settings. Does that make sense? From here on in, I'm lost in virtual space.
My System SpecsSystem Spec
18 May 2014   #37
andrew129260

Windows 10 Pro
 
 

So I want to confirm something, it did find integrity violations?

And don't worry about not having an install disk. You will be surprised how easy getting that is.
My System SpecsSystem Spec
18 May 2014   #38
sassofalco

Windows 7 Home Premium x64 - SP1
 
 

I'm presuming that I scroll through the CBS.log and look for all the 'FAILED' or 'CORRUPT' entries?

I can do a series of Snip.jpg files for those if you want.

'Integrity' violations?
My System SpecsSystem Spec
18 May 2014   #39
andrew129260

Windows 10 Pro
 
 

Ok, so you did the following:

You clicked then typed cmd. You then right clicked on command prompt and ran it as administrator. You then typed sfc /scannow and hit enter. When it completed you either get one of 3 things:

Windows resource protection found no integrity violations.
It found corrupt files and successfully repaired them.
It was unable to fix some of the files, details are in cbs log.

So I am wondering which one you got?


Btw did desk check complete okay?

See here:

Check Disk (chkdsk) - Read Event Viewer Log
My System SpecsSystem Spec
18 May 2014   #40
sassofalco

Windows 7 Home Premium x64 - SP1
 
 

Quote   Quote: Originally Posted by andrew129260 View Post
Ok, so you did the following:

You clicked then typed cmd. You then right clicked on command prompt and ran it as administrator. You then typed sfc /scannow and hit enter. When it completed you either get one of 3 things:

Windows resource protection found no integrity violations.
It found corrupt files and successfully repaired them.
It was unable to fix some of the files, details are in cbs log.

So I am wondering which one you got?


Btw did desk check complete okay?

See here:

Check Disk (chkdsk) - Read Event Viewer Log
1. Message was; It was unable to fix some of the files, details in the cbs.log

2. Check Disk seemed to go well ... no hitches and while I was away from the laptop, it rebooted successfully

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 19/05/2014 08:45:23
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Tony-PC
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is Acer.


A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
384512 file records processed.

File verification completed.
3141 large file records processed.

0 bad file records processed.

0 EA records processed.

76 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
472684 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
384512 file SDs/SIDs processed.

Cleaning up 28 unused index entries from index $SII of file 0x9.
Cleaning up 28 unused index entries from index $SDH of file 0x9.
Cleaning up 28 unused security descriptors.
Security descriptor verification completed.
44087 data files processed.

CHKDSK is verifying Usn Journal...
34003000 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

611883007 KB total disk space.
290212224 KB in 261038 files.
161000 KB in 44088 indexes.
16 KB in bad sectors.
506523 KB in use by the system.
65536 KB occupied by the log file.
321003244 KB available on disk.

4096 bytes in each allocation unit.
152970751 total allocation units on disk.
80250811 allocation units available on disk.

Internal Info:
00 de 05 00 f1 a7 04 00 97 50 08 00 00 00 00 00 .........P......
60 b8 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 `...L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-18T22:45:23.000000000Z" />
<EventRecordID>192074</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Tony-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is Acer.


A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
384512 file records processed.

File verification completed.
3141 large file records processed.

0 bad file records processed.

0 EA records processed.

76 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
472684 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
384512 file SDs/SIDs processed.

Cleaning up 28 unused index entries from index $SII of file 0x9.
Cleaning up 28 unused index entries from index $SDH of file 0x9.
Cleaning up 28 unused security descriptors.
Security descriptor verification completed.
44087 data files processed.

CHKDSK is verifying Usn Journal...
34003000 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

611883007 KB total disk space.
290212224 KB in 261038 files.
161000 KB in 44088 indexes.
16 KB in bad sectors.
506523 KB in use by the system.
65536 KB occupied by the log file.
321003244 KB available on disk.

4096 bytes in each allocation unit.
152970751 total allocation units on disk.
80250811 allocation units available on disk.

Internal Info:
00 de 05 00 f1 a7 04 00 97 50 08 00 00 00 00 00 .........P......
60 b8 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 `...L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
My System SpecsSystem Spec
Reply

 why do my Restore Points keep disappearing?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Restore Points Disappearing in Windows 7 Home Premium 64 bit OS
I am having trouble with system restore points disappearing on my Windows 7 OS. Both automated and manually created restore point vanish. I have more than enough space allocated for the restore points and yet they still disappear. I know that this has been a Windows 7 issue for some time, and I...
Backup and Restore
Problem with disappearing restore points
I was going to set a manual restore point and was quite shocked when the screen opened and indicated that I had NO restore points. I know that old ones are removed as new ones are added, etc., but something (not me) had deleted ALL restore points. After I set the new restore point it was recorded...
Backup and Restore
Restore points are disappearing every time I reboot, need help
Hi, everyone Recently, I got my pc cleaned from virus/malware, but now is in good/health shape.. When I create system restore point, it's succeed, but every time I reboot or turn off computer, my restore point is missing.. and I'm newbie about computer can you please help me? I'm using...
Backup and Restore
Restore Points Disappearing: Allocated Space Still Available. Why?
I have allocated approx 18gb of space for system restore and it is currently sitting around 12gb. My question is, why do I only have 2 days worth of system restore available? When there is still more space, I would expect it to go back a bit further and the way that I understand it, Windows 7...
Backup and Restore
Restore points are disappearing every time I reboot
Hi, everyone. My restore points are disappearing every time I reboot or turn off computer. I did cace2002 method, it didn't help. And I was trying what was suggested by computersplus : started Volume Shadow Copy and set it to automatic. Problem still exist. And I am not able to find backup...
Backup and Restore
System Restore points disappearing
System Restore points always disappearing at reboot! Help! :cry: I keep getting the “volsnap” error messages in the Windows system event log during the early stage of the boot. Error 09/03/2010 16:33:08 volsnap 25 The shadow copies of volume C: were deleted because the shadow copy storage...
Backup and Restore


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 21:39.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App