Solved System restore problem

[Borg 386]

EDIT....Please mark this tread as solved

Hi all,

Well, this all started on the 16th when an update for Silverlight got "stuck" and after 2 hours of the update running, I had to reboot the machine. When I tried to use my System restore it started giving me the "Could not restore, nothing has been changed" message Error 0xc0000022.

Investigating the logs, I found that I was also getting TransactionManager cannot advance log due to the update being "in stasis' so to speak. I tracked down the offending update package and deleted it, still the same with Sys Rest.

So far I have tried:

Googling the hell out of it, SFC / SCANNOW, MicrosoftFixit50202 (passive mode), Deleting Silverlight with Revo, Shutting off Sys Rest and purging the restore points & rebooting & then turning it back on, and some praying and crossing my fingers. So far, nothing.

The first logs had this for the data which makes me think Update Agent is still trying to update the failed update.

<EventData>
<Data>Windows Update</Data>

I'm open to a repair install if need be, but prefer to save that for the last ditch effort. I'm wondering if there's some way to "reset" the updater and clear out all the current updates that may be pending. Or uninstall it & reinstall it.

Anyone had any problems like this or have any thoughts? I would appreciate it lots.

Here are the Logs I'm seeing in the event viewer for the most recent one:

An unspecified error occurred during System Restore: (after passive update run). Additional information: 0xc0000022.
System
- Provider
[ Name] System Restore
- EventID 8210
[ Qualifiers] 0
Level 2
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2010-12-22T17:49:59.000000000Z
EventRecordID 43213
Channel Application
Computer PC
Security
- EventData
after passive update run
0xc0000022
00000000C20800009408000000000000CBC8392507000000000000000000000000000000
Binary data:
In Words
0000: 00000000 000008C2 00000894 00000000
0008: 2539C8CB 00000007 00000000 00000000
0010: 00000000
In Bytes
0000: 00 00 00 00 C2 08 00 00 ....Â...
0008: 94 08 00 00 00 00 00 00 ”.......
0010: CB C8 39 25 07 00 00 00 ËÈ9%....
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 ....

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="System Restore" />
<EventID Qualifiers="0">8210</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-22T17:49:59.000000000Z" />
<EventRecordID>43213</EventRecordID>
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security />
</System>
- <EventData>
<Data>after passive update run</Data>
<Data>0xc0000022</Data>
<Binary>00000000C20800009408000000000000CBC8392507000000000000000000000000000000</Binary>
</EventData>
</Event>

Thank you

BTW....everything else seems to be working great.

 

[SledgeDG]

Here's something I found that might help to clear the failed update:

Bring up a command prompt and type 'proxycfg -d' to clear the proxy cache.

Type 'net stop wuauserv' to stop the automatic updates service.
Delete contents of C:\WINDOWS\SoftwareDistribution.
Go back to the command prompt and type 'net start wuauserv' to restart the automatic updates


Hope that helps

-DG

 

[Borg 386]

Thank you SledgeDG

proxycfg didn't work with 7, and I'm hesitant to clear the SoftwareDistribution folder since it has several sub folders(scan file, auth cabs, self update, etc) and 235 MB of data.

I do however remember now that on some XP machines I had to clear the cache when an update kept insisting it wasn't in there. I don't think you can do that in Win7 anymore.

BTW...all this @#$^&* was apparently caused by a leftover McAfee key. Looking at the contents of the USER.DAT in that folder where the update was stuck, I saw references to McAfee.

 

[SledgeDG]

Darn Mcafee...just like Symantec they dig themselves so deep into the system that it becomes a real pain to get rid of.
I don't think it'll work but here is the McAfee removal Tool:
Download McAfee Consumer Product Removal Tool 3.5.109.1 Free - Will remove all 2005, 2006, and 2007 versions of McAfee consumer products - Softpedia

As for the SoftwareDistribution Folder...why don't you just backup those folders and delete it afterward if you think it could cause any problems...Just zip or rar them up and move the archive to a safe location.

-DG

 

[Borg 386]

As for the SoftwareDistribution Folder...why don't you just backup those folders and delete it afterward if you think it could cause any problems...Just zip or rar them up and move the archive to a safe location.

-DG

DOH! :drool: Yeah, I guess I could do that. From what I've googled it seems I won't be able to delete a couple of the files unless I use the command line. I've got the commands & I'll try it at a later time. I'm hoping if I take the whole thing out it'll reset & clear whatever problem is interfering with the sys rest.

Yeah, McAfee came with the sys & it caused nothing but headaches.

 

[SledgeDG]

I'm hoping if I take the whole thing out it'll reset & clear whatever problem is interfering with the sys rest.

Yep, that's what I was hoping for, too I'll keep my fingers crossed

-DG

 

[Borg 386]

Well Sledge, by emptying out the SoftwareDistibution folder it broke the updater, so I put everything back and rebooted....and now it's actually reset itself. I see the Silverlight update again....which is somewhat strange since I took all of Silverlight out, but more then likely a leftover in the files. But it's a start, I'll try rolling back in a bit & if it doesn't work then I'll try installing the update & hopefully it pushes it through or it invalidates itself.

 

[SledgeDG]

Like I said, Borg...mühsam ernährt sich das Eichhörnchen (means = we're working with Baby steps here)
I just returned from a Sysrestore myself.
If you don't need Silverlight you could always tell the updater not to mention that dreaded update to you ever again Well let's think positive and hope it'll work as expected for once so you don't still sit there on Christmas Eve, fixing your installation.

 

[Borg 386]

Yeah...I'm working on this slowly & since my wife is off for a few days, it'll be sporadic. So far I've updated the update agent (sounds redundant doesn't it?), ran MicrosoftFixit50202 in aggressive mode (which BTW looks like it wipes out the list of past updates, although that's still avail though cont panel/programs & features).

BTW...rolling back after all this still had the same prob

I'm wondering if I should try wiping the SoftwareDistribution folder, rebooting and THEN install the new agent.

Might try that later....one step at a time.

 

[SledgeDG]

Well if it breaks the update again, the installation of the agent should take care of that.
But it sure would get rid of old leftovers.in the worst case you still have the zipped content

 

[Borg 386]

Problem solved. it turns out it had nothing to do with the updater. Or maybe it did...or the update...who knows. Anyway, Norton has something called Product Tamper Protection, which must be disabled before you do a system restore. Read more here:

Message: "Restoration Incomplete. Your computer cannot be restored..." when I run Windows System Restore with a Norton 2010 product installed | Norton Support

Now, as to the big question of why it was sitting in my system for 3 months & I never had a problem restoring before that update....just another one of those Windows mysteries I guess....

Once you restore, it still looses all it's AV defs, but those reload and it's all set to go.

 

[marsmimar]

Nice to know you got it fixed. Would have been even nicer if Norton had a warning message of some sort like: "This action is being blocked by ..." so users wouldn't be spinning their wheels for days trying to figure out what the problem is. (Just my first mini-rant of the day. )

 

[SledgeDG]

That is GREAT news, Borg! That also explains, why I never experienced anything like that before :Whenever there is a new Computer in this family I make sure to get rid of everything that remotely sounds like Norton, McAfee or Symantec
[Rant]
All went to shreds when Peter Norton sold his superb programs to Symantec. If only I remember the Norton Commander or the Norton Disk Doctor/ Editor. both the best and most important tools I used in times of MS-DOS and OS/2...there simply was nothing better on the market.
[/Rant]
Back to topic
The REAL question here is why Norton, that might swamp you with pop ups and messages at one point, doesn't intercept the restore process and notifies the user and offers a solution (like a temp-disable etc.)
especially since you have to reboot after a restore anyway and your AV would just load back up.

Of course, after a restore you lose all AV updates you received after the time, the restore point was generated...but that's expected and easily remedied.
Anyways...glad you got your rig back on track
Thanks for the feedback

-DG

 

[Borg 386]

True marsmimar. All windows was giving me was "unspecified error" and Norton didn't chime in once.

When the Silverlight update stuck, I found that, somehow a remnant of McAfee was disallowing it to run fully. And as I mentioned earlier, I had never had a problem rolling back with Norton on the system save for the AV defs needing to be updated fully. Now all of a sudden, it started it's behavior on that update and, I was assuming based on the evidence that the update/windows updater were somehow responsible.

The update was indeed stuck and I had to track down the installer package & delete it to stop getting "Transaction manager cannot advance file log" messages.

Oh yeah...it's been fun

Yeah Sledge, one less thing I have to worry about...The only reason I gave Norton a spin was a friend of mine bought it with 3 licenses and asked me what I thought of it, and he let me give it a try. It seemed to integrate just fine with everything, and it still actually does...EXCEPT for that little debacle.

Thanx for the input & help, much appreciated

 

[SledgeDG]

Yeah, I got bitten more than once by the likes of Symantec. Granted that was in the beginning when their programs had more bugs...but I have never regret to switch to a different product.
Once bitten, twice shy, :roflmao::roflmao:

no need to thank me YOU did all the work you didn't really need help

I sit here in the warmth while outside the Blizzard still roars.

-DG

 

[Borg 386]

Hey, at least you're inside. This is the time of year when working outdoors definitely sux in the northern parts. I used to do that before the cancer.

It's mostly windy here with chills in the negative numbers....stay safe

 

[marsmimar]

Don't suppose anyone will feel sorry for me. Had a "cold" front move through the other day. Expected high today is about 13C / 57F. By Wednesday they say it will be back to near 20C / 72F. Sorry ... off topic. Second mini-rant of the day. I hate hot weather.

 

[SledgeDG]

Absolutely...I used to work Highway construction at one point in time so I know you definitely get used to being "weatherproof" after a while (as long as you dress appropriate, that is)

I still remember my first blizzard when I came over here....I took a stroll at -30º...that was a bit chilly so I bought myself a hot cup of coffee....which turned cold the moment I left the store
This one right now is almost nothing...it tapers down already and ithe Temperature is ~18ºF
so I'm fine...the furnace works, my coffee stays warm while Junior asks me to explain the solar system

[email protected] 20ºC is hot @ North pole :roflmao::roflmao:

Have fun...laterz

-DG