phantom system restore points?

ICit2lol said:

jchap mate I am just curious as to why the restore points are being triggered so often is it just that you want it set that way?

Anyway have you tried the sfc and chkdsk yet? if not then try running them as a starting point at least

check disk and SFC both came back empty handed

I have them set to be triggered so much because I'm playing around with robocopy and need frequent points I can restore from

EDIT: it seems like restore points ARE being created before installing Windows updates and/or applications and when creating a system image for scheduled backups. I can manually create a system restore point under the system protection settings, but I cannot force a restore point to be created by manually running the scheduled task even though it says it completes successfully.

ICit2lol said:

Sorry for late reply mate but my partners has been to surgery today and have been caught up.
Now as this is very strange behaviour I don't think it would do any harm and certainly will not take a lot of time but run these even just to eliminate any obvious malware. They are not real heavy duty scans as such but I find they pick up stuff on my own machines that my trusted Kaspersky doesn't see.

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer – delete any rubbishthese find.

I'm going to try restoring the system drive back to the last point (5 days ago). I remember now that I was wiping out registry keys to get rid of pesky remnants, maybe I accidentally deleted something pertaining to system restore. I'll try the malware scans if that turns up fruitless.

whs said:

Run this command:

vssadmin list shadows

it will show you all restore points

shouldn't that list be exactly the same as the one in the system restore wizard ("show more restore points")? is it possible for them to be out of sync?

whs said:

This is the safest method to see all restore points. And yes, the wizard does not always show them all. Why don't you try it - takes only 2 minutes.

it's the same list as in the wizard

looking at my event log, there are some errors corresponding at roughly the same time the SR is set to run. I had removed all the triggers from the task and added daily schedules so I can tell when a restore point should have been created.

I've attached the event logs for those instances (VDS Basic Provider) but I'm not sure if they pertain to my issue discussed here. the KB article on VDS Basic Provider suggests the error only occurs under a "guest operating system". I'm not even sure what a guest operating system is.

There are other events for 'source: volsnap' which says "the oldest shadow copy was deleted to keep disk usage.. on C: below the user defined limit". I can confirm that the current usage on C: is encroaching upon the limit, but that still doesn't explain why newer restore points are not showing up.

are restore points prioritized at all? maybe it's keeping the restore points created for backups/critical updates and deleting the oldest scheduled restore point? I don't know, I'm taking shots in the dark