Solved System Restore not completing successfully

All,

Please help!!! I went to the System Restore and chose "restore system files and settings from a restore point".
Computer brought up the most recent restore date, which was earlier this morning.
Told it to restore.
After a while, it brought up the following message:

System Restore did not complete successfully
Details: An unspecified error occurred during system restore
You might want to restore again with a different restore point

I tried the date before this one. Same message occurred. NOTE: This has not always been the case. My computer has been able to restore in the past.

Did something corrupt the system? What do you think the problem is? And more importantly . . . how do I fix it. Can't leave the computer unable to restore. This is not good!!

Thanks in advance for your help.

(a trying not to freak out) Meltie

You may have corruption. Try to reapair it in the following manner.

In search, type cmd, do not hit enter>right click and run as adminitrator.

In cmd type sfc /scannow. You will get a report of any corruption and hopefully a repair.

Richard,
Before I do this (and thanks for answering), I found another thread that said if you have Symantec or Norton products running that would hamper the Restore. I do have Symantec. Should I try disabling it first and then trying to restore? What do you think? And if so, how do I disable Symantec. Not a computer savvy person here.
Thanks
Meltie

In my opionion not only should you disable them, you should get rid of them. These products are use by many here, including myself and find them to be problem free and excellent protection.

Malwarebytes

Microsoft Security Essentials.

I will get the links.

http://www.malwarebytes.org/mbam.php
http://www.microsoft.com/Security_Essentials/

Not using the Software that you mentioned, I do not have the answer to shut them off. But one method may be to type msconfig in search. Go to startup. In startup untick the software.
Then boot the computer, again, it will be off.

OK - thanks

BTW - I violated Cardinal Rule # 1. I forgot to tell you what O.S. I have DOH! I'm using Vista Home Premium 64 bit.

I have Malware already. I'll go check out the other link.

I tried typing the instruction you gave me in your first response, but I couldn't right click anywhere to "run as administrator" and it wouldn't let me proceed?? What am I doing wrong? UPDATE: Never mind this last part. I was typing it in the wrong place. Scan is running now - I'll let you know what it says

I hope that you know that I am rooting for you.

Guys,

I followed Richard's instruction and ran the sfc /scannow. This is the message it gave me:

Windows Resource Protection found corrup files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log
For Example C:\Windows\Logs\CBS\CBS.log

I went to this log and tried to open it but it said permission denied. Tried to change this but failed. As this is my personal computer, I am the administrator. (even though I can't figure out how to open stuff on my own computer ) Can you please tell me how to read this file? Oooor can I send it to someone who knows how?

Thanks again

Meltie

meltie said:

Guys,

I followed Richard's instruction and ran the sfc /scannow. This is the message it gave me:

Windows Resource Protection found corrup files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log
For Example C:\Windows\Logs\CBS\CBS.log

I went to this log and tried to open it but it said permission denied. Tried to change this but failed. As this is my personal computer, I am the administrator. (even though I can't figure out how to open stuff on my own computer ) Can you please tell me how to read this file? Oooor can I send it to someone who knows how?

Thanks again

Meltie

Click to expand...

OK Meltie, you do not have to read the log, yet. Run the sfc 3 times. It fixes one problem at a time. Lets see if we can get it fixed. If we cannot fix it with the sfc we will try something else
So far, have you tried system restore?
Did you try with the Anti Virus off?

In case, I am not here when you are done, try this. Boot up the computer, as it boots continually hit f8, this will get you into safe mode. Use system restore from safe mode. Go back to a point before the problems began.

C:\Windows\Logs\CBS\CBS.log is a massive file of approximately 5MB and if you care to see it all, you must send CBS.log to one of your own folders or the desktop from where you can double click on it. It will then open with Notepad. Note: You cannot open it inside the CBS folder. You will get an Access denied message.
But most likely you are only interested in the part that shows the corrupted files that were fixed – or not fixed. For that you need a significant data reduction. You do that as follows:
Open another elevated Command Prompt and paste this command into it:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

This will show all the files you want to see in the Command Prompt window.
Since that window is not very practical for a detailed study, you want to paste the content into a Notepad, Wordpad or Word file.
For that you right click on the Command Prompt window (any place is good) and click Select All. Then you right click anywhere in the window. Now this whole text is stored on the clipboard and you can paste it into a document file (e.g. Notepad) where you can analyze it.

Source: My own blog

Yes, I tried it once with the Anti Virus off. Didn't work. The only thing that made me question it though was when I went into the Task Manager (after I turned all of Norton off), it still had one process running. It was: ccSvcHst.exe *32 Description Symantec Service Framework. I was afraid to end that process as I don't know what it is. And it was most definately running. (I stopped something once on my old computer and caused myself quite a bit of pain so I'm a little more cautious now).

Question and Actions:

1. I'll run the SFC scans 3 more times regardless of the answer to Item 2

2. Should I stop the Symantec Service Framework process showing in Task Manager, then disable all of Norton again and then try Restore once more? or leave it and just go with the SFC scans?

Your thoughts?

Thanks

Meltie

P.S. Yes, I know you're rooting for me Me too!!

WHS - thanks

I'll try Richard's directions first . . . then I'll follow your steps to open file. And yes, you're correct. I only want to see what's corrupted and what's been fixed.

Baby steps me for. Sometimes even one thing at a time is more than I can handle LOL

Meltie

richc46 said:

In my opionion not only should you disable them, you should get rid of them. These products are use by many here, including myself and find them to be problem free and excellent protection.

Malwarebytes

Microsoft Security Essentials.

I will get the links.

Malwarebytes.org
http://www.microsoft.com/Security_Essentials/

Not using the Software that you mentioned, I do not have the answer to shut them off. But one method may be to type msconfig in search. Go to startup. In startup untick the software.
Then boot the computer, again, it will be off.

Click to expand...

If you can shut if off like this, you can forget about anything else.

Guys,
I ran the sfc scan 4 more times. Each time got some items repairs, some not.

Then - I followed whs' instructions for cbs.log

Looks like it couldn't repair 2 items and not sure about a third. Below is the excerpt of the report:

2010-03-11 21:20:05, Info CSI 00000b7f [SR] Cannot repair me
mber file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6
002.18005, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope
= 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName ne
utral, PublicKey neutral in the store, hash mismatch
2010-03-11 21:20:05, Info CSI 00000b81 [SR] Cannot repair me
mber file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6
002.18005, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope
= 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName ne
utral, PublicKey neutral in the store, hash mismatch
2010-03-11 21:20:05, Info CSI 00000b82 [SR] This component w
as referenced by [l:162{81}]"Package_17_for_KB948465~31bf3856ad364e35~amd64~~6.0
.1.18005.948465-60_neutral_GDR"

Looks like two of them are in the settings.ini file. Please bear in mind I don't know what I'm reading here. What do I do with this info now?

Please Help!

Thanks

Meltie

Hi Melti, received your note and will try to help.

Check my earlier post and disable your anti virus, boot the computer, and then try to use restore again. If it still does not work we can try to repair the corruption using a repair install or other methods.

Okay, I'm going to detail everything I did just in case anyone else has to go through this. I still have some corrupted files from the sfc scan and would like some further help with that and a question regarding Protections, but . . . the good news is that I did get the system to restore!!

**Richard, thank you, thank you, thank you!!! for all your help. And a thank you to WHS too!

After performing the sfc scans 5 times and cleaning up the majority of those files, I did the following:

Disabled Norton: the link provided in the response above didn't work on my version of Vista "exactly" so this is what I did:
Went into Task Manager
Highlighted Norton
Hit Services Button in lower right hand corner
Hit "stop" service
Then I right clicked on Norton again
Hit "properties"
Under "General" tab under "startup type": changed from "automatic" to "disabled"
Hit "apply", then "OK"
Under "Recovery" tab, under "first failure" and "second failure" changed from "restart" to "take no action"
Hit "apply", then "OK"

I did the second action because after I stopped the program, I saw in another tab of the task manager that Norton was still running.

After that . . . I created a "restore point" I was a little anxious to create a restore point without the protections on but I did so for two reasons:
a. I figured I wouldn't be any worse off than I already was
b. If I restored to a point where Norton was active, I thought that as soon as it hit that point, Norton would activate and start messing with the restore process and it would fail again - seems I may have been correct

Final step - Did a System Restore choosing the "non active Norton restore point" I just created and voila! the system restored successfully.

Question 1: Do I need to pursue taking care of the corrupt files from the sfc scan?

Question 2: I have Windows Defender, and the free versions of Malware, and SuperAntiSpyway already installed and active. Do either of the latter provide anti-virus protection with a paid subscription? And if so, please share your thoughts on them.

Question 3: Do I reactive Norton (and disable it if I have to perform a restore) or go with another Product that doesn't impact my Operating System during restore? I'm thinking I should just go with the link Richard provided but since my subscription with Norton is still paid for another 4 months . . . should I just suffer through it? Thoughts?


I'd just like to add that this whole thing has been beyond frustrating for me. Without Richard's support and expertise, I wouldn't have gotten through it. Thanks again Richard. You rock!!

Meltie

OK Melti, I am just as glad as you are.

Now one thing at a time.

Make a system restore point now. Do not install any of your old antivirus software etc. We can turn Defender off but uninstall Anti Spyware.

Install these two:
http://www.microsoft.com/Security_Essentials/ and this
Malwarebytes.org

Run the computer if you are happy, make a new system restore and then post and we can move from there.

Q1---- the 2 first corrupted files are apparently from the sidebar. What you could do is get a sidebar folder from another system (in C > Program Files) and install it on your system per this method. And don't get confused by the Windows7 annotation - Works just as well for Vista.
For the third corruption I have no idea.

Q2----Go with MSE as Richard says. But make sure you uninstall Norton first with the Norton removal tool - very important. MSE will replace Defender - in fact it uses the same msmpeng.exe.

Q3----see Q2

OK - thanks. I'll give it a whirl and get back to you guys.
P.S. Thank you WHS for that note regarding uninstalling Norton FIRST. I wouldn't have done that.