Unable to use system restore

Sorry, having a little trouble with this. Have navigated to the setup folder but am unsure which is SourcePath? Have these listed:

(default)
BootDir
LogLevel
PrivateHash
ServicePathCachePath

 

You're missing several values there.

Right click in the right pane and select New>String Value
Name it DriverCachePath
Double click the new Value and enter %SystemRoot%\Driver Cache then click OK.

Right click in the right pane and select New>String Value
Name it SourcePath
Double click the new Value and enter C:\ then click OK.

 

Done. Just verifying that there is a space between the words driver and cache when entering the new value? Entered exactly as you listed.

 

Exactly as I listed it.

Have you looked at the CurrentVersion key, CommonFilesDir and ProgramFilesDir values? I suspect they have no data.

 

You are correct, they do not have data.

The type REG_SZ was listed but no value. I added value like you indicated.

Should I create the following also as you indicated?

Any clue what could cause this?

 

Is the ProgramFilesPath value missing? Or is it just missing the data? Either way, it needs to be there.

As to what caused it ......... I really don't know. I can only guess. A registry cleaner maybe?? Have you run any?

 

ProgramFilesPath is not even listed neither is ProgramFilesDir

As a matter of fact (keep in mind I know nothing about how registry should look) when I scroll down over each of the items listed in software, most of them show only: (default) type REG_SZ and data (value not set).

As far as a registry cleaner, I don't think any of the programs I would use have that feature. So I too have no clue what happened here.

 

That's normal.

Yes, you need to create both of those Values and add the Data.

Once you have that done, before running sfc, run Deckards System Scanner (dss.exe) again and post the main.txt file.

 

As requested:

Deckard's System Scanner v20070905.67
Run by Stacy on 2007-09-16 15:01:38
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Stacy.exe) ------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-09-16 15:01:43
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.0.5730.11)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Neoteris\Installer Service\NeoterisSetupService.exe
C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\ROVA Update\rovasrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\Program Files\Network Associates\VirusScan\shstat.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\regedit.exe
C:\Documents and Settings\TEMP.STACY-LAPTOP\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [ShStatEXE] "C:\WINDOWS\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EC3FCEC-2C86-44F5-8B18-C4A4A08DF484} (ROVAUpdate Class) - http://www.ras.ml.com/rovacompany/ml/updates/rovaup2-4-116e.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1189737460984
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} () - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5090/mcfscan.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe "
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - "C:\Program Files\iPod\bin\iPodService.exe "
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - "C:\WINDOWS\Program Files\Network Associates\VirusScan\Mcshield.exe "
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - "C:\WINDOWS\Program Files\Network Associates\VirusScan\VsTskMgr.exe "
O23 - Service: Neoteris Setup Service - Juniper Networks - "C:\Program Files\Neoteris\Installer Service\NeoterisSetupService.exe "
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ROVA Service (ROVA_Srvc) - Unknown owner - C:\Program Files\ROVA Update\rovasrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe


-- Files created between 2007-08-16 and 2007-09-16 -----------------------------

2007-09-16 14:42:08 0 d-------- C:\WINDOWS\LastGood
2007-09-15 11:16:44 0 d-------- \Deckard
2007-09-14 21:27:00 0 d-------- C:\Program Files\Spybot - Search & Destroy
2007-09-14 21:27:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-14 19:52:33 0 d-------- C:\Program Files\Hijackthis
2007-09-14 19:45:25 0 d-------- C:\Documents and Settings\Stacy\Application Data\Mozilla
2007-09-14 19:36:29 0 d-------- C:\Network Associates
2007-09-14 19:36:29 0 d-------- \Network Associates
2007-09-14 19:35:09 0 d-------- C:\WINDOWS\Program Files
2007-09-14 19:35:09 0 d-------- C:\WINDOWS\Common Files
2007-09-13 22:52:57 0 d-------- C:\WINDOWS\Microsoft Shared
2007-09-13 22:52:55 0 d-------- C:\WINDOWS\Internet Explorer
2007-09-12 20:40:14 536281088 --ahs---- \hiberfil.sys
2007-09-12 19:16:38 0 d-------- C:\WINDOWS\system32\%programfiles%
2007-09-12 19:16:35 0 d-------- C:\WINDOWS\system32\%commonprogramfiles%
2007-08-22 07:24:49 0 d--h----- C:\WINDOWS\system32\WLANProfiles
2007-08-22 07:24:49 0 d--h----- C:\Settings
2007-08-22 07:24:49 0 d--h----- \Settings
2007-08-16 18:38:08 0 d-------- C:\Program Files\MSXML 6.0


-- Find3M Report ---------------------------------------------------------------

2007-09-16 14:42:27 0 d-------- C:\Program Files\Mozilla Firefox
2007-09-16 14:42:08 0 d-------- \WINDOWS
2007-09-16 14:38:54 805306368 --ahs---- \pagefile.sys
2007-09-15 14:12:08 0 dr------- \Program Files
2007-09-14 19:37:30 0 d-------- \Config.Msi
2007-09-12 18:57:06 0 --a------ \usb2scsi.txt
2007-09-08 05:08:21 0 d-------- C:\Program Files\Java
2007-08-22 07:24:49 516 --a------ \Settings.ini
2007-08-16 18:32:46 0 d-------- C:\Program Files\Internet Explorer
2007-08-08 20:53:04 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-08 20:51:33 0 d-------- C:\Program Files\Sling Media


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE "= "C:\WINDOWS\Program Files\Network Associates\VirusScan\SHSTAT.exe" [09/22/2004 08:00 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport "= "C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 06:00 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 09/07/2004 05:08 PM 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- D:\automenu.exe

-- End of Deckard's System Scanner: finished at 2007-09-16 15:02:30 ------------

 

Well, that looks better, but something is still amiss. Can you think of anything that happened on the 12th around 7:30 pm, such as a software installation, ran a tool of some kind, anything? I ask because you had 2 directories created at that time, very strangely named.

2007-09-12 19:16:38 0 d-------- C:\WINDOWS\system32\%programfiles%
2007-09-12 19:16:35 0 d-------- C:\WINDOWS\system32\%commonprogramfiles%

Please see if there is anything in those folders.

It looks as though there might have been a hibernation event around that time too. Do you remember?

2007-09-12 20:40:14 536281088 --ahs---- \hiberfil.sys

 

The files you mentioned have folders in them however are wiped clean with nothing in them.

I really wish I remember what happened if anything Wednesday night as it shows these files were modified on that date.

I am 9+ months pregnant and my memory is super bad at this time !

 

Well congratulations! I just love babies! (I have bunches of 'em)

Go ahead and delete those two folders then.

C:\WINDOWS\system32\%programfiles%
C:\WINDOWS\system32\%commonprogramfiles%

Try starting the system restore service again and let me know what happens.

I have an errand and will be back in just a few. We need to check some other registry keys.

 

I hope I don't sound stupid but how the heck do I get to system restore?

I found it the other night somehow but without anything popping up when I click start--->all programs--->accessories, etc. Like I used to do for system services, I am not sure where to find it?

Oh and the search for files/folders and ?Help and support do not work and give me error messages.

 

Click Start>Run and type services.msc then hit enter. Scroll down the list to System Restore Service and double click the entry. It needs to be set as Automatic startup type and started. Let me know if it starts successfully, and any error messages if it doesn't.

 

Well first thing to note is that when I type in services.msc it does come up but so does the Windows Installer box saying that what I am looking for is on a disk and to please install Microsoft Office XP Professional with FrontPage.

When I tried to start System Restore I still get this:

Could not start the System Restore Service service on Local Computer. Error 1114: A dynamic link library (DLL) initialization routine failed.

 

Go ahead and run sfc now.

Click Start>Run and type (or copy and paste) sfc /scannow then hit enter.

Let me know what happens.

 

Sorry, sleep and work got in the way of trying to fix this.

It takes about 45 minutes to run but does and then the box disappears when it's done.

 

No problem. I would expect that at this stage you're ready for a nap every couple of hours. What's your due date?

Does there seem to be any difference in the way your computer is behaving after running sfc? Did you check to see if System Restore will start?

I need to look at your event logs, so that I can get a better idea of what direction to proceed in. Please create a new folder in C:\ named events. Right click My Computer and select Manage. Expand the Event Viewer entry, then click the Application entry to select it. Either right click the entry or click Action on the menu and select Save Log File As. Name it Application and save it in the C:\events folder. Now repeat the process to save logs for both the Security and System events, naming them accordingly. When complete, right click the events folder and select Send To>Compressed (zipped) Folder. It will create the file C:\events.zip

Please attach that zip file in an email to me. Put RE:smitRem in the subject line of the email.

It may take a while for me to review the logs and recommend any action, so don't expect a reply right away.

 

Due date is 9/24... if she would quit turning breech. Seems she'd like to greet this world butt first.

I've emailed you as you requested. I will have a disk tomorrow or Wednesday from work tech support of Microsoft Office XP with Frontpage. Since Office isn't the only problem I'm not sure to use it just yet but at least I will have it for when if it is needed.

No rush on the reply, if there is ever a hesitation in my reply you will know where I've gone.

 

A couple of mine didn't turn head down and stay put until the day of or the day before their birthdate. Chalked it up to being small enough to have room to do it, and a desire to be acrobats.

If you want to drop that office cd in when prompted I don't see a problem with that. What I am thinking though, is that you should make sure you have your data backed up to an external source, such as CDs, DVDs, external or separate hard drive, etc. You should also make sure you have the product key for your operating system. If it's not on a sticker somewhere on the case, let me know and I will link you to a utility to extract it. With the corruption I've observed up to now, I fear that full resolution will only come about via a clean installation. I will do my best though, to help correct whatever we can before throwing in the towel, as long as you're willing to continue.

I received the logs, and will post back when I have something.

Oh BTW, hope you're gonna share pics of that new baby when she arrives