windows xp system restore failure

Hello
I am using a Micron Millenia computer with Windows XP home, SP 2 as my OS with several user accounts.

Several weeks ago something happened to my computer. For some reason it apparently was shutdown improperly. Now whenever any user logs off or shuts the computer down( this does not happen on hibernation) even with proper procedure, upon restart or log-on we get the following message:

SYSTEM RESTORE:

" Restoration incomplete. Your computer could not be restored to (most recent shutdown or log off --my words). This restoration is incomplete. It was interrupted by an improper shutdown. You should undo this restoration or choose another restoration point."

Clicking on "home" to restore to an ealier times gives only about a 24 hour restoration window, all earlier points are gone. Clicking "cancel" at this time or simply ignoring the "incomplete restoration" message produces a "RUNDLL" message:
"Error loading C\WINDOWS\system32\NVMCTRAY.DLL. The specified module could not be found."

Clicking on "X" or "ok" at this time always allows the system to restart without any apparent loss of functionality or data. Reversing the most recent "incomplete restoration" will proceed normally, but when you log off or shutdown the computer again, the same "restoration incomplete" message appears at restart.

I have noticed that, since this incident, at restart my Ad-watch always gives me a notice that some registry modifications have been made, some of which refer to this NVCMTRAY.DLL registry value.

I assume that the missing module / changed registry values is the reason for the restore problems, but have no idea how to correct it. I have checked with Microsoft's knowledge base (articles # 283096 and 3027960) and followed their recommendations, but this has not changed anything for better or worse. I am also extremely reluctant to start playing around with registry values without a much better knowledge of what I am doing.

I can supply you with the Ad-watch data if it will help.

thanks bearbuddy

 

Please do a on line virus scan.Follow directions and let it finish.
http://housecall.trendmicro.com/

 

hello jujet84:

Thanks for the post. I tried both Trendmicro and Norton's online AV scans. Both said my system was clean. Ran latest scans from Ad-AwareSE, CWShredder and Spybot S&D. The spybot found a little spyware on my system and removed it, but that didn't fix the system restore problem. CWShredder and Ad-AwareSE found nothing.

Any other suggestions would be appreciated!!

Thanks again. Bearbuddy

 

OK referring to your info Quote
"Error loading C\WINDOWS\system32\NVMCTRAY.DLL. The specified module could not be found."
The library file nvmctray.dll, contains functions used by the Media Center software installed with nVidia Video Card Drivers. If nvmctray.dll is unavailable or stopped, the Media Center and/or the Video Card Drivers may not function correctly. You should leave nvmctray.dll, unless it is causing problems for your system.
This file should be located "C:\WINDOWS\System32 chk to see if there,.

 

Hello jujet84:

Thanks for your reply. I checked the folder you mentioned. There is no file in it labeled “NVMCTRAY.DLL”

Let me also give you the “Registry Modification” notices I’ve found every time at restart or log-on in my Ad-Watch logs since this problem began. They refer to this module and the restart sequence. Maybe they will help you figure out what’s happening. These modifications are:


Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\RunOnce
Value:*Restore
Data:C:\WINDOWS\system32\restore\rstrui.exe -i
New Data:

Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\RunOnce
Value:MSIWU_0
Data:"C:\PROGRA~1\MSI\LIVEUP~1\MSIWUPro.exe" -DEL:[C:\PROGRAM FILES\SETUP FILES\NVIDIA NFORCE SYSTEM DRIVERS V2.29\CACHE\NVIDIANFORCESYSTEMDRIVERSV2.29.EXE]
New Data:

Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\RunOnce
Value:NvRegisterMCTray
Data:RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvMCRegisterApp C:\WINDOWS\system32\NvCpl.dll
New Data:

Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\RunOnce
Value:NvExportOEMDefaults
Data:RUNDLL32.EXE C:\WINDOWS\system32\NVCPL.DLL,ExportOEMDefaults
New Data:

While my Ad-Watch program logs these changes to the registry and blocks others, I’ve not found any process in it(at my own comfort level) that allows me to undo these modifications and be sure that I’m not introducing other problems.

Thank you again. bearbuddy

 

Hello again:

I forgot to mention in my other posting that my windows media player and other media players have all been funtioning normally since this problem started.

bearbuddy

 

Go to Start/Run/type in msconfig/enter---- how many programs do you have starting up.

 

there are 36 processes listed on the startup list accessed by this method.

bearbuddy

 

Sorry I'm late but being do some research.I do believe you have some virus infections,including trojan's.What you should do first is take your time and read this article
http://forums.majorgeeks.com/showthread.php?t=35407
After cleaning up will get back to the msconfig issue.

 

Hello again:

I think the restore problem has been eliminated, but I am not sure how or why. Prior to reading your last post I was doing some exploration in the registry with the Spybot S&D advanced mode. I came across several missing shared DLL’s and the references to remnants of some uncooperative software/shareware that I had installed and uninstalled a few times. After eliminating these DLL’s and rerunning the uninstall programs for the software, I was instructed to shut down my computer to complete the process. When I rebooted, the system restore problems were gone and now everything seems to be back to normal.

None of the DLL’s that I removed referred to the missing NVMCTRAY module or the system restore function. The installation and removal of the uncooperative software was separated by a few days from the onset of the system restore problems and I did not think that the problems might be related; if, in fact, there was a link.


The NVMCTRAY file is not in the system32 folder at this time, but all media players are still functioning normally.

I will run the AV clean-up procedures you mentioned in your last posting to be sure there is not a virus hiding somewhere else in the system.

THANK YOU for the time and effort you put into helping me solve this problem.

Bearbuddy

 

Good to hear that it worked out for ya