Cannot disable System Restore

When I try to turn off System Restore I get an error, "System Restore encountered an error trying to enable/disable one or more drives. Please restart your machine and try again." I have been doing this spyware removal thing for a while now and this one is new to me. Assistance will be appreciated.

Thanks,

Mr. Frerichs

 

Download the file below, save to your desktop and extract the contents. Double click the file to open, this will disable System Restore.

http://forums.majorgeeks.com/attachment.php?attachmentid=22376

 

ok, did that. Now how do I restart it once I am done? The service is not and was not even running before.

 

Once your system is completely clean we can fix the System Restore issue. Before you start cleaning it needs to be disabled, now thats it's disabled you can continue with the READ ME.

Once you have completed the READ ME post your results here with a current HJT log as an attachment to your post.

Good Luck!

 

ok the scans are clean plus some that I run in addition to the ones major geeks recommends. attached you will find my HJT log. still cannot enable/disable system restore. sfc finds issues but does not let me fix them because the system disk I have is out of date (pre sp2).

thanks for the assist,

Mr. Frerichs

 

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

here is my spysweeper log I had to edit the original as it was too large. IT kept saying the windows messenger error over and over again. So i took all of those out. except the first.

 

Download this trial version of Ewido Security Suite

• First, please download and run CCleaner to clean temp files, cookies, etc; to make the log shorter.
  
• Install ewido security suite
  
• When installing the program, under "Additonal Options" uncheck..
  
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should now be an icon on your desktop, double-click it.
• You will need to update ewido to the latest definition files:
  
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido. Ewido Manual Updates

• Once the updates are installed, exit Ewido.
• Now print the below instructions or save them locally because I want you to have all browsers closed and also have no connection to the internet (unplug your cable) while doing the below:
• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine
• While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report[/size][/color]
• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.
• Reboot into normal mode and reconnect to the internet.

Once your machine reboots please attach the report from Ewido along with a fresh HJT log from normal mode.

 

My apologies for not running crap cleaner earlier. I am not sure why I didn't, just forgot I guess. anyway, here are the logs from ewido and the new hjt log.

Thanks,

mrfrerichs

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Spy Sweeper

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM\..\Run: [Cryptographic Services] C:\WINDOWS\system32\Client\services.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab

O23 - Service: Network DDE DSDA (DDE) - Unknown owner - C:\WINDOWS\System32\Microsoft\svchost.exe (file missing)
O23 - Service: MS Patch Service (MScom) - Unknown owner - C:\WINDOWS\Config\q\aux\.xdax\Iass.exe (file missing)
O23 - Service: NTP (Network Time Protocol) - Unknown owner - C:\WINDOWS\system32\Client\winlogon.exe (file missing)
O23 - Service: CSRSS (ras) - Unknown owner - C:\WINDOWS\System32\ras\csrss.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\system32\Client\services.exe <-- Delete this file ONLY, there is a legit file with the same name in the Sys32 folder, dont get the two confused.

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

The only trouble I had with the instructions was that the computer restarted on its own twice when trying to boot into safe mode. Otherwise the scans came back clean. Attached is the new hjt log.

 

Click Start > Run > type services.msc and Click OK

Locate Network DDE DSDA (DDE) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Locate MS Patch Service (MScom) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Locate NTP (Network Time Protocol) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Locate CSRSS (ras) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Next, open up HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

Network DDE DSDA (DDE)

MS Patch Service (MScom)

NTP (Network Time Protocol)

CSRSS (ras)

You may be told to reboot at this point, if so please reboot and attach a fresh HJT log.

 

Ok tried that. WHen I tried to delete the NT Services with HJT it gave me error saying they did not exist in the registry and to make sure I used their short name. Using services.msc worked though. here is the latest hjt log.

 

Have HJT fix the below entry, after you remove this entry your log will be clean. Let me know how things are running and if your having any problems.

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

 

Ok, the log is clean now. But, I still cannot enable/disable the system restore. it is still giving the original error I posted. How do I get that turned back on and working?

Thanks,

mrfrerichs

 

Click Start > Run > type in regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore

Single click once on the entry; "SystemRestore" to empty its contents into the right pane.

Find the entry "DisableSR", right click on it and delete it.

 

Big Problem! System Restore is not listed there. I knew this one was tricky.

Thanks,

mrfrerichs

 

Do a manual search for the file "drivetable.txt". Be sure you have the options as follows under Advanced Options:

Search system folders
Search hidden files and folders
Search subfolders

The file should be located in the directory below:

C:\System Volume Information\_restore

If you find this file, rename it to drivetable1.txt. Afterwards reboot and see if the tab is back.

 

If the last post does not work, then navigate to the directory...

C:\WINDOWS\INF

Locate the file SR.INF, right click and select Install from the menu. Reboot and see if it returns.

 

my search for drivetable.txt comes up empty.

 

Okay, try my previous post and let me know. (#19)

 

I did find it manually though in at c:\System Volume Information\_restore{b37680B2-BA0A-4E5D-BF30-83E44C588624}

Should I rename thatone and reboot?

 

Yes, rename it and reboot if that does not work try my other post.

 

ok we're off a post here but when I tried to install the sr.inf it asks for the sr.sys file from the sp2 disk that I don't have. I will jsut copy from on of the other 8 coputers I have here. That should work right?

 

Did you try the renaming first? Did it work?

If the first method didnt work then if its the same OS it should work but you shouldnt need it, just when it prompts for the file point it to the C:\WINDOWS\system32\drivers and it should go thru.

 

ok, the renaiming of the drive table thing didn't work. So, I reinstalled using the .inf file after some digging for all the filed the friggin thing needed it went. Now, everything is working wonderfully. Thanks to you! I truly appreciate the assist. You guys are a great help when I get stuck. Never had this System Restore thing before. And good call with the Ewido scan, I'd never used that one before. Thanks again.

mrfrerichs

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!