System Restore does not work on XP

[Marke522]

Hi, and thanks for reading.

I'm currently working on an old Gateway, Pentium III 1.0 that now has an 80 GB Maxtor, 512 ram, and an MX 440. Kinda old, but still a decent machine. It did not originaly come with XP, it was built with ME, I installed XP on it awhile back for this person and he said it had been running better than when it was brand new. Go figure. But now he has asked me to look at it again for a new reason.

It has been infected, he said he knows he got a virus on Limewire while looking for a Demo of Battlefield 2. ( Right, I totally believe him /end sarcasm) Anyway... I have found a worm or two, I think thier gone, removed a few spyware programs, got it running smooth and nice, but the System Restore goes into an error message immediately after trying to open it.

Run dll as an app has encountered a problem and needs to close. We apologize blah blah blah...

There are options at the bottom to Debug, Send or Don't Send. If I try to Debug, I get another message saying Dr Watsons Postmortem Debugger has encountered a problem and needs to close, blah blah blah. I have no idea what this Debugger program is, don't know where he got it, but appearently it isn't all that good.

Has anyone seen kind of thing before? I'm sure it still means there are other worms, viruses, or bacteria that I have not found. :P Would I be better off telling him to back all data and reformat? That might save a lot of time, but I would hate to do that if someone knows of a 5 minute fix.

Thanks, Mark.

[Marke522]

I think we used Maxblast to move his install to the new harddrive. He gave me the old drive, it was a WD 40 gig Caviar. I can't remember if we made a clean install or not.

I just found this article while Googling for some ideas.

http://techrepublic.com.com/5100-1035_11-5225409.html

If you've recently replaced your hard drive and used the drive manufacturer's software to transfer data from the old to the new drive, it's likely that Windows System Restore won't start. This Solution Base article explains how to fix that problem.

Problem
When trying to start Windows System Restore, the following error message appears:

"Run a DLL as an App has encountered a problem and needs to close. We are sorry for the inconvenience."

Cause
This error may occur if the primary hard drive or boot partition has been changed/upgraded/replaced and software from the hard drive vendor (such as MaxBlast from Maxtor or Data Lifeguard from Western Digital) has been used to move the data from the old to the new drive.

Solution
1. Click Start | Control Panel | Administrative Tools | Services.
2. Right-click System Restore Service and click Properties.
3. From the Startup Type drop-down, select Disabled.
4. Click OK.
5. Close the Services and Administrative Tools windows.
6. Right-click My Computer, click Properties, and click the System Restore tab. The System Restore tab should now display properly; however, the System Restore service will be disabled.
7. Enable System Restore and click Apply.

Note: All previous restore points will be removed.

Tried the whole thing, only got a different error message.
I'll have to ask if he remembers what we did. It's hard to keep all these pc's straight. I may just have to do a reformat. Guess I should start backing some data.

[macko72]

You may try using Recovery console and fixboot command before you reformat!!!
I would say that you shall try to run the utility in Safe mode,Check the System log for any errors that relate to sr or srservice.

If these steps don't help, run srdiag.exe to troubleshoot further. Srdiag creates a .cab file, which it places in the \%windir%\system32\restore folder by default. You can double-click the file or right-click it and choose Extract. You can then examine the 14 extracted files to troubleshoot your problem.

http://www.microsoft.com/technet/pro.../xpsysrst.mspx

Check the event logs to investigate System Restore service errors:

1. Click Start, click Control Panel, and then click "Performance and Maintenance".
2. Click Administrative Tools, click Computer Management, double-click Event Viewer, and then click System.
3. Click the Source tab to sort by name, and then look for "sr" or "srservice." Double-click each of these services, and then
evaluate the event description for any indication of the cause of the problem.

[Marke522]

Program does not run in safe mode. Same error message as above.

Rundll as an App has blah blah blah.

I'll try a few more things and repost.

[Marke522]

Went into the Event Viewer, it was absolutely no help. Here's what it said.

The System Restore initialization process failed.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp

After clicking on that link I get another message of no help:

Details

We're sorry
There is no additional information about this issue in the Error and Event Log Messages or Knowledge Base databases at this time. You can use the links in the Support area to determine whether any additional information might be available elsewhere.

Thank you for searching on this message; your search helps us identify those areas for which we need to provide more information.

At least they said they were sorry.

Just ran srdiag.exe and the computer gave me another message saying: Windows cannot find srdiag.exe Make sure the path name is correct then try again.

Maybe you're right about the repair.

[Marke522]

Talked to a friend I met on GameSpy that works for Microsoft. After talking about it for maybe 30 minutes we agreed the best thing to do was reformat. Even if I could find AND remove all the worms and trojan horses, he said there could be a lot of back doors left open making the copmputer vulnerable for another attack, or reinstallation of the same program. He also said I may never find the full effect of damage that has been done, if the System Restore does not work, then there has to be more programs that are not functioning properly that I havn't noticed yet.

Besides, I think it's been close to a year since the last install, I've heard lots of people recommend that it be done once a year or so.

[macko72]

Well that is the best idea if there is no other solution or if solution is limited !

[Marke522]

Yeah, it just helps to have someone tell you what you allready know. Especially when you don't want to do it.

I had him backup everything so that saved me a bit of time, and also a bit of worry, because if he is missing a photo or file, then it's not my fault.

[rjfvillarosa]

I had exactly the same problems with a customer's machine after a particularly bad virus infection and sorry for your friend but the only cure was a format and reinstall, no matter what I did and what I repaired something else would go wrong and as you say system restore would not work, if I remember correctly I couldn't get MSCONFIG to work (it's been awhile since the job), also for some very strange reason the calculator dissapeared (figure that one out)