System restore does not work.

Running Windows 7 Home and system has recently been cleaned of malware. Recurring problem is I have not been able to make a restore point.

When I try to create a system restore point, I get an error message stating "The restore point could not be created….The specified object was not found (0x80042308). Please try again".

Also after running System File Checker we found this error "The shadow copies of volume C: were aborted because of an IO failure on volume C:"

Thanks for any help
 

Hi Akita,

It would very helpful if you would post a link to your malware topic so we can have a look at your log files. This may provide us with a useful insight on what has been happening with your computer.

The make and model number of your computer would also be helpful in formulating our recommendations.

Have your run chkdsk with the r switch yet?

Regards

paws

Hi Akita, Thanks for the extra information.

Please rerun chkdsk, but this time with the r switch

here are the steps to both run chkdsk with the r switch and view the resulting log file:

You must run the command prompt as an administrator or in an "elevated mode".
at the Start menu, in the search bar type "cmd"
Right-click the cmd icon, select "run as administrator"
user account control (UAC)  may prompt you to accept that action, so do so
type in "chkdsk /r" (note the space twixt chkdsk and /
NOTE For these commands do not use the quotation marks


To view results log:

• Open the Start Menu, and type eventvwr.msc in the search box and press enter.
• If prompted by UAC, then click on Yes (Windows 7) or Continue (Vista).
• In the left pane of Event Viewer, double click on Windows Logs to expand it, then right click on Application and click on Find.
• Copy and paste Chkdsk into the line, and click on Find Next.
• You will now see the system log for the scan results of Check Disk (chkdsk).
• In the right had menu select copy, open notepad and paste the chkdsk results into notepad, save the file on your desktop
• Post it in your next reply. ( if you need assistance in interpreting it.)

Please download the All in One Repair Tool from:

www.tweaking.com 

and install it, but please don't run it just yet as I would like to see your chkdsk log first.

Regards

paws

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          12/10/2014 6:18:17 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Jim-PC
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is HP.

A disk check has been scheduled.
Windows will now check the disk.                        

CHKDSK is verifying files (stage 1 of 5)…
Cleaning up instance tags for file 0x14ea1.
Cleaning up instance tags for file 0x22042.
  1198848 file records processed.                                        

File verification completed.
  1498 large file records processed.                                  

  0 bad file records processed.                                    

  0 EA records processed.                                          

  60 reparse records processed.                                     

CHKDSK is verifying indexes (stage 2 of 5)…
  1290810 index entries processed.                                       

Index verification completed.
  0 unindexed files scanned.                                       

  0 unindexed files recovered.                                     

CHKDSK is verifying security descriptors (stage 3 of 5)…
  1198848 file SDs/SIDs processed.                                       

Cleaning up 552 unused index entries from index $SII of file 0x9.
Cleaning up 552 unused index entries from index $SDH of file 0x9.
Cleaning up 552 unused security descriptors.
Security descriptor verification completed.
  45982 data files processed.                                          

CHKDSK is verifying Usn Journal…
  34707600 USN bytes processed.                                           

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)…
  1198832 files processed.                                               

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)…
  41801059 free clusters processed.                                       

Free space verification is complete.
Windows has made corrections to the file system.

 962421988 KB total disk space.
 793640248 KB in 295089 files.
    242396 KB in 45983 indexes.
         4 KB in bad sectors.
   1335104 KB in use by the system.
     65536 KB occupied by the log file.
 167204236 KB available on disk.

      4096 bytes in each allocation unit.
 240605497 total allocation units on disk.
  41801059 allocation units available on disk.

Internal Info:
00 4b 12 00 5c 34 05 00 1e cc 08 00 00 00 00 00  .K..\4……….
35 e7 00 00 3c 00 00 00 00 00 00 00 00 00 00 00  5…<………..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  …………….

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:

 
   
    1001
    0
    4
    0
    0
    0x80000000000000
   
    987628
   
   
    Application
    Jim-PC
   
 
 
   

Checking file system on C:
The type of the file system is NTFS.
Volume label is HP.

A disk check has been scheduled.
Windows will now check the disk.                        

CHKDSK is verifying files (stage 1 of 5)…
Cleaning up instance tags for file 0x14ea1.
Cleaning up instance tags for file 0x22042.
  1198848 file records processed.                                        

File verification completed.
  1498 large file records processed.                                  

  0 bad file records processed.                                    

  0 EA records processed.                                          

  60 reparse records processed.                                     

CHKDSK is verifying indexes (stage 2 of 5)…
  1290810 index entries processed.                                       

Index verification completed.
  0 unindexed files scanned.                                       

  0 unindexed files recovered.                                     

CHKDSK is verifying security descriptors (stage 3 of 5)…
  1198848 file SDs/SIDs processed.                                       

Cleaning up 552 unused index entries from index $SII of file 0x9.
Cleaning up 552 unused index entries from index $SDH of file 0x9.
Cleaning up 552 unused security descriptors.
Security descriptor verification completed.
  45982 data files processed.                                          

CHKDSK is verifying Usn Journal…
  34707600 USN bytes processed.                                           

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)…
  1198832 files processed.                                               

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)…
  41801059 free clusters processed.                                       

Free space verification is complete.
Windows has made corrections to the file system.

 962421988 KB total disk space.
 793640248 KB in 295089 files.
    242396 KB in 45983 indexes.
         4 KB in bad sectors.
   1335104 KB in use by the system.
     65536 KB occupied by the log file.
 167204236 KB available on disk.

      4096 bytes in each allocation unit.
 240605497 total allocation units on disk.
  41801059 allocation units available on disk.

Internal Info:
00 4b 12 00 5c 34 05 00 1e cc 08 00 00 00 00 00  .K..\4……….
35 e7 00 00 3c 00 00 00 00 00 00 00 00 00 00 00  5…<………..
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  …………….

Windows has finished checking your disk.
Please wait while your computer restarts.

 

Hi Akita,That was very worthwhile, There was a small amount of data that was found in bad sectors of your hard drive, and chkdsk has fixed this by copying the data to undamaged sectors and marking the bad sectors as not to be used in the future.

To be sure that this has fixed all the errors can you please run chkdsk again ( with the r switch) and let me know if it finds any file eror this time

Thanks.

Did you install the "All in One" repair tool from tweaking.com   ?

Regards

paws

Hi Akita,

That's now looking good ( the 4kb has been marked by Windows as a "Do not use area")

Now run the All in one and perform each step( dont worry it will try and run sfc and chkdsk again and this is OK)

Make sure you follow the directions exactly especially when it comes to discharging any residual current in your computer.

Reboot the computer when you have finished and see if the problem has been resolved.

Regards

paws

I Ran All in One, rebooted and still get the same error when trying to create a restore point. I Ran All in One as advised.

An issue I had was my anti virus, AGV, may have interfered. It was turned off but you can only turn it off for 15 minutes max. I assume it turned itself back on while I was running All in One. I got 2 AGV warnings when All in One was making changes which I allowed.

Should I delete AGV for a short time and run All in One again?

Hi Akita, can you turn it off until the next reboot?

Regards

paws

I've never seen that option. Only options are turn off for 5,10, or 15 minutes. I'll look into it further tonight.

Hi Akita, I have had  good results with the All in one Repair Tool, even when running In safe mode… so this might be worth trying. 

If still no joy then the scope for further action is beginning to look a little limited……

Here's some thoughts for you:

1 Perform a repair install of Windows (non destructive) but make sure your back ups are watertight first.

2 Live with the problem… its just collateral damage caused by the infections, and use an alternative application to achieve a similar facility to that provided by System Restore….. The Registry back up tool from tweaking.com and also Erunt spring to mind as being worth consideration. 

http://www.tweaking.com/content/page/registry_backup.html

http://www.larshederer.homepage.t-online.de/erunt/

3 Restore to factory (NOTE this is a destructive process and will clear all your files and Windows itself, before resetting everything to as it was when the computer left the factory)Double check your back ups before starting …and then check once more time just to be sure you have included everything and its all reproducible….

4 Restore your machine from an" image" made when the computer was running well and with no problems.

5 If you haven't got a good disc image handy then make one now…. as you will then be able to re-image to how you machine is now if at some time in the future you have software or operating system problems that can't be resolved in the usual ways….

Macrium Reflect free version has a good reputation

http://www.macrium.com/reflectfree.aspx

Paid for applications are available from Symantec, Paragon, Acronis and a whole host of other firms.

Regards

paws

Haven't had much time to run All in One again (in safe mode) but will do soon.

For what it's worth (or not) I just recalled when this issue started. When I bought this system new it had Vista installed but came with a Windows 7 upgrade which was soon to be released. I received and installed Windows 7 a month or so later. The system restore issue started after upgrading to Windows 7.   

Hello Akita.  If I may offer my two cents…. Hold off on the all in one repair.  Its a nice tool, but in my opinion way too advanced for an average user and it defaults to running dozens of potentially explosive things on your system that are completely unnecessary and unneeded to target a specific problem.  Things that have a far reaching impact on security, etc.

There are a few things I would check here.  First and foremost we know that bad sectors have been identified on your hard drive.  But, CHKDSK and Windows in general is about worthless at handling these.  You need to run a real drive diagnostic tool on your system and make sure the hard drive is good.

Try downloading and installing SeaTools for Windows: http://www.seagate.com/support/downloads/item/seatools-win-master/

Here's some instructions: http://knowledge.seagate.com/articles/en_US/FAQ/202435en

Use the "Fix All -> Long" test.  Let us know what kind of information you get back.  Attach a screenshot if you can.

Next, try working with system restore in safe mode.  Here's how to boot into safe mode: http://windows.microsoft.com/en-us/windows/start-computer-safe-mode#start-computer-safe-mode=windows-7

Once in safe mode, go into control panel -> system -> system protection.  First, click Configure and "DELETE" existing restore points.  Next, make sure the Max Usage slider is set to about 2% or 3% of your hard drive.  Usually around 10GB is good.

Apply your changes and attempt to create a new restore point.  Let us know if it works or not.

If it does work, boot back into normal mode and attempt to create a new restore point in normal mode.  let us know how it works.

If you have any success you can also try SFC again.