# Solved: System Restore on Windows 8



## brilumb (Feb 5, 2002)

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 8, 64 bit
Processor: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, Intel64 Family 6 Model 58 Stepping 9
Processor Count: 4
RAM: 8139 Mb
Graphics Card: NVIDIA GeForce GT 630, 2047 Mb
Hard Drives: C: Total - 114470 MB, Free - 35281 MB; E: Total - 1430789 MB, Free - 885904 MB; H: Total - 953865 MB, Free - 293031 MB;
Motherboard: ASUSTeK COMPUTER INC., P8Z77-V LX
Antivirus:* Windows Defender, Disabled*

First, a note to the above. Windows Defender is running properly and updates OK.

I have searched the forum and cannot find any other reports of my new problem, which is that SR will not work.
I have even created a new restore point, tried to restore a short while later, it still does not work.

The error report is:
" SR did not complete successfully
SR failed to extract the original copy of the directory from the restore point
The restore point was damaged or was deleted during the restore
You can try an advanced recovery method"

Can anyone please help ?

Also, I can find no reference anywhere to an "advanced recovery method". Can anyone provide a link to it ?


----------



## dai (Mar 7, 2003)

http://windows.microsoft.com/en-au/windows7/choosing-an-advanced-recovery-method


----------



## Macboatmaster (Jan 15, 2010)

1. Windows Defender reported as disabled in the Tech Support Guy report is a glitch in that report
Providing you know that it is enabled and all working you may safely ignore that

2. In Windows press the Windows key + C, that as you know I am sure will open the charms menu, click settings, then click power and whilst holding down the shift key click restart
That will then take you to the first of the recovery screens

3. On that first screen you will note there is then a troubleshoot option, and then also an advanced option
If you click that you can then see the refresh or start again etc

4. If when you open system restore from Control Panel recovery - have you noticed the show more restore points - if you have not and you check on that then it maybe that there is a restore point then shown that will work before the problem arose with the apparently damaged restore point.
here is an excellent guide to restore
http://www.bleepingcomputer.com/tutorials/windows-8-system-restore-guide/

ALSO you will note that it covers all the options for recovery on further links below

5. In view of this


> I have even created a new restore point, tried to restore a short while later, it still does not work.


I would check as shown on the link above that you have sufficient space allocated to system restore and indeed it is set on for the drive with Windows installed

6. I would also ensure that you have a complete backup and repair disc, as even if it is only to return the system to its present state that may of course be preferable to starting again.

7. I would also recommend before you start any attempt at using the advanced options a full scan with Defender and if you do not have it installed I would install the free Malwarebytes and scan with as well, using the quick scan first.
That will produce a log, if there is anything indicated amiss, please copy and paste the log.


----------



## Macboatmaster (Jan 15, 2010)

Re my point 5 above if you go control panel and click system, then click system protection on left of window, you may then scroll down to the C drive select that drive and check there that it is turned on and by clicking configure button you can see the amount of space allocated.

Also, have you by any chance used any registry cleaning program AND have you any other anti-virus installed besides Windows Defender.
Some anti-virus programs and Norton is one such will in some cases not allow a system restore, until they are disabled


----------



## brilumb (Feb 5, 2002)

Thank you Dai,

I followed the link to the advanced system restore, It warned "the action cannot be undone". However I activated it.

It still did not restore and the error message this time was:
"System Restore failed to extract the original copy of the directory from the restore point.
Source: %SystemRoot%\registration
Destination: ComPlusStaging
The restore point was damaged or was deleted during the restore

I see there have been more replies to this thread and I will now study those. Thanks for the link


----------



## dai (Mar 7, 2003)

try the repair option that leaves your files intact


----------



## brilumb (Feb 5, 2002)

I will try that later, but will try the other suggestions first before such a drastic sounding possibility.


----------



## brilumb (Feb 5, 2002)

Thanks for offering your help, referring to your numbered points:
1. OK about glitch.
2,3 Tried this, still no completed restore.
4. The same restore points were offered, also read all of the link to the restoration guide that you posted.
5. SR is set to operate on my C drive. The reported current usage is 4.72GB out of 5.59GB, 5%. I increased the allowance to 8.94GB, 8%

Using the 8.94GB capacity I tried my previous restore point, failed as before.
Created a new restore point, also failed. 
6. I have a backup system and drive, but want to try all other options before I use it. Lack of confidence in the backup is because I have never used it in a real situation.
7. A full scan with Defender shows no unwanted intrusions.

??


----------



## Macboatmaster (Jan 15, 2010)

1. Re 


> 2,3 Tried this, still no completed restore.


I am not sure what you mean by this, as those points were how to access the advanced recovery options etc.

2. Do you have OR have had any other antivirus installed

3. Is Volume Shadow copy in services set Manual and will it start, open services, scroll to the service double click to open it, if it is stopped try and start it - what is the start type of the service

4. AND why is a system restore necessary.

5. PLEASE do run a scan with malwarebytes the free one
http://www.malwarebytes.org/lp/lp4/?gclid=CNSt7uan5LkCFQTHtAodjCgAcA

6. What backup system have you used please


----------



## Macboatmaster (Jan 15, 2010)

I have posted separately, rather than edit my last, to include it, so that you cannot miss it.

On a previous topic of yours also on Windows 8 and the same computer you posted


> I have read the previous System Restore thread but it does not apply to my problem.
> 
> Every few days system restore points are deleted, I now need to create one daily just to be safe.
> 
> *I tried to set up automatic restore points using the Task Scheduler, the log says that they completed OK but they do not appear in the list of restore points*.


On windows 8 a restore point is created automatically for most windows updates, if ONE was not created in the last 7 days.
It also creates one for critical windows updates unless one was created in the last 24 hours - I think, but I am not 100% certain on that time schedule
It also creates a restore point irrespective of updates periodically and these are shown as system points
under type and automatic restore point under description.

See my screenshot please

How did you set it up in Task Scheduler, as I thought it required quite a complicated procedure
http://www.eightforums.com/performa...tem-restore-not-creating-restore-point-2.html

I would start by cancelling that Task you have set up and see if that changes anything.

-------------------------------------------

ALSO I note that you had a similar problem, back in 2007, when an anti-virus program was suggested as the cause - NORTON and you posted


> Great ! Norton WAS responsible for the problem and I can now successfully use System Restore.
> 
> What a pity that Norton has not admitted to the error and issued a warning to its subscribers. I can imagine the dismay when someone who has a serious error confidently invokes the restore process and finds to their horror that they cannot.
> 
> ...


It is, as I asked before - not by any chance installed on this system is it please. I do appreciate that you said you did not intend to use it again, but I have recently read that Norton still declare that their product does not cause this

*FINALLY HB for 27th*


----------



## brilumb (Feb 5, 2002)

Replying to your last few posts:

2/3 Sorry I did not make it clear, what I meant was that I followed the procedure, tried other restore points, got the same error report.
I am using a new Windows 8 PC, bought earlier this year. The only AV I have used is Windows Defender.
Can you guide me how to access the "Volume Shadow" please?
I had a problem not being able to log in to BT Yahoo to access my emails. It kept telling me I was using an incorrect password when I was not. Had I been able to go back in time with SR then the problem might have been solved that way. I did however solve it myself. BT are upgrading their site and this might have been the problem.
Downloaded and installed malwarebytes, it found some issues, corrected them but still SR is not working.
My backup system is Easus Home Edition Backup storing to an external 1TB drive.
I probably did not setup the Task Scheduler properly as it did not create restore points. I abandoned it.
Norton is not installed on my new system, the only AV is Microsoft Defender and I would not use Norton again.


----------



## Macboatmaster (Jan 15, 2010)

1. Control Panel, admin tools, services - volume shadow copy - note open services, by right click and click run as admin

2. Unless you know for certain that the issues found by Malwarebytes are only spyware etc and not an indication of something more concerning - post the log as requested please


> That will produce a log, if there is anything indicated amiss, please copy and paste the log.


3. I have heard of the problem with BT, it has not effected me, but it did a colleague of mine in Yorkshire

4. Send me this please
THE URL of speccy - download the FREE edition
http://www.piriform.com/speccy

*To publish a Speccy profile to the Web:*

In Speccy, click *File*, and then click *Publish Snapshot*.
In the *Publish Snapshot* dialog box, click Yes to enable Speccy to proceed.
Speccy publishes the profile and displays a second *Publish Snapshot*. You can open the URL in your default browser, copy it to the clipboard, or close the dialog box.


----------



## brilumb (Feb 5, 2002)

I think that you have probably zeroed in on something significant with Volume Shadow copy. When I opened it the service status was reported as STOPPED with the startup type as MANUAL. I started it and the service status was reported as RUNNING.

I created a new restore point and attempted to restore from it. It did not restore and on re-checking Volume Shadow copy the service status was reported as STOPPED.

Is this significant and should the service be running ? Should the startup type be changed to AUTOMATIC ?

How do I post the Malwarebytes log here ?

The URL of Speccy is http://speccy.piriform.com/results/r4HNoG1U512S8utWjpDfqOU


----------



## Macboatmaster (Jan 15, 2010)

No because manual means that it is started when required

open malwarebytes click log tab then select the entry, click open, click the edit tab, click select all, click edit, click copy and paste to reply

I do not see anything of concern in Speccy
However although I do not know of any previous problems, try disabling Easeus Todo Guard Agent and see if that has any success
Running: 
EaseUS Agent Service
Running: 
Guard Agent Service

If that is not the answer and I do not really think it will be TRY starting Safe Mode and then try a restore
http://windows.microsoft.com/en-gb/windows-8/windows-startup-settings-including-safe-mode


----------



## brilumb (Feb 5, 2002)

Ok - here is the Malwarebytes log:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.25.02

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16688
Brian :: BRIAN-PC [administrator]

Protection: Enabled

27/09/2013 11:39:31
MBAM-log-2013-09-27 (11-49-06).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 226591
Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 16
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (PUP.Optional.QuickShare.A) -> No action taken.
HKCR\IESmartBar.BHO (PUP.Optional.QuickShare.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (PUP.Optional.QuickShare.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (PUP.Optional.QuickShare.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (PUP.Optional.QuickShare.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF190686-9E72-403C-B99D-682ABDB63C5B} (PUP.Optional.TopArcadeHits.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111991162} (PUP.Optional.Crossrider) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111991162} (PUP.Optional.Crossrider) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> No action taken.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:\Users\Brian\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> No action taken.
C:\Program Files (x86)\RelevantKnowledge (PUP.Spyware.MarketScore) -> No action taken.
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> No action taken.

Files Detected: 23
C:\ProgramData\DSearchLink\DSearchLink.exe (PUP.Optional.Delta.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\wajam_install.exe (PUP.Optional.Wajam.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\95FCC8BA-BAB0-7891-BE58-5A6ED8CD2FFD\CrxInstaller.dll (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\95FCC8BA-BAB0-7891-BE58-5A6ED8CD2FFD\MyBabylonTB.exe (PUP.Optional.Delta) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\95FCC8BA-BAB0-7891-BE58-5A6ED8CD2FFD\Setup.exe (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\BExternal.dll (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\CrxInstaller.dll (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\DSearchLink.exe (PUP.Optional.Delta.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\A74913BE-BAB0-7891-9B25-CC483FD5CD1E\Latest\Setup.exe (PUP.Optional.Babylon.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\DIQ\google-earth_109\setup__120.exe (PUP.Optional.Amonetize.A) -> No action taken.
C:\Users\Brian\AppData\Local\Temp\is1275519350\DeltaTB.exe (PUP.Optional.Delta.A) -> No action taken.
C:\Users\Brian\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> No action taken.
C:\Program Files (x86)\RelevantKnowledge\rlls.dll (PUP.Spyware.MarketScore) -> No action taken.
C:\Program Files (x86)\RelevantKnowledge\rlls64.dll (PUP.Spyware.MarketScore) -> No action taken.
C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe (PUP.Spyware.MarketScore) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> No action taken.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> No action taken.

(end)

I cannot see any way to stop "EaseUs Agent Service" so I have contacted the supplier.

I will try a restore from Safe Mode tomorrow morning, although I have already done that without success.

It looks like I will need to try Dai's suggestion to try the repair option that leaves the files intact. I am reluctant to use this drastic step for fear that I may lose valuable data. Some time ago I downloaded and installed a number of useful utilities amongst which are Paint.net, Chroma Clock, IRIS OCR and AVS Video Converter. Do you think there would be any danger of losing them?

Also, Windows 8.1 is due to be released mid October, perhaps this will correct Systems Restore with other issues.


----------



## Macboatmaster (Jan 15, 2010)

1. I would hold on trying the repair option at the moment

2. As you have already tried from Safe Mode - try this
Open a cmd prompt with admin rights that is
windows key
type command ( I know there is no where to type)
If command prompt does not appear click apps (applications) on right of screen
right click cmd prompt, click run as admin
in the cmd window at the prompt type

*net user administrator /active:yes *

press enter, you should receive confirmation that the cmd completed successfully

type
*exit*
press enter

restart and log into that account, password is blank unless you have set one
See if you can create a restore point and restore from there.

Re the Malwarebytes log - post on that to follow.


----------



## Macboatmaster (Jan 15, 2010)

1.
stop "Guard Agent Service" and "EaseUS Agent Service" 
by accessing services as you did before and STOP the service and change start type to disabled.

2. Test once more to see if you can now create a restore point and restore.

3. I do not really expect it will work, as I said it is a long shot, but I have read that those aspects of Easeus have on occasions stopped Volume Shadow service running.

EVEN if by chance it does work YOUR Malwarebytes log reveals quite a number of Potentially Unwanted programs, which I am sure you would want to know had been successfully and completely removed from your computer
Most of them have I think been installed with other programs, as unwanted add-ons. Some of them are little else other than spying on all websites you click on. Whilst others have the potential to cause more troubles

Accordingly my strong recommendation is that you go to our Malware forum, following the advice and guidance in this link, creating a new topic with the required logs.
If you could provide in the post there, a link to this topic that would assist my colleague in Malware.

http://forums.techguy.org/virus-other-malware-removal/943214-everyone-must-read-before-posting.html


----------



## brilumb (Feb 5, 2002)

Message #14
Again tried to restore from Safe Mode - failed

Message#16
1. OK, will hold off repair option
2. Net User Administrator - tried to create and restore, no success

Message#17
1. Stopped &#8220;Guard Agent Service&#8221; and "EaseUS Agent Service" , tried create and restore, no success

Thanks for your advice about the Malwarebytes log, I will follow it up as advised


----------



## Macboatmaster (Jan 15, 2010)

Thanks for replying
Good luck with it in the Malware forum.
I will be interested to see if it can be solved, without a repair install


----------



## dvk01 (Dec 14, 2002)

What setting do you have for UAC in control panel/user accounts/select your account & press the change UAC settings
if it is anything except the second from the top SR will fail 
It will definitely fail if UAC is turned off or if it is set to highest setting 
It should work on either of the 2 middle settings


----------



## brilumb (Feb 5, 2002)

My UAC is set to the upper of the two middle settings so I will need to continue the search.

Thanks for your contribution


----------



## Macboatmaster (Jan 15, 2010)

Topic now the subject of this in Security forum
http://forums.techguy.org/virus-other-malware-removal/1109586-cannot-use-system-restore.html


----------



## brilumb (Feb 5, 2002)

Thank you for your patient help, the problem is now solved and I have posted the following in the Malware thread:

"I don't know why I did not think of it at the weekend, but now that I have a duplicate system on a separate hard disc I can try Repair Install without risk to my main C drive.

I tried it, it worked as advertised, and System Restore is now operational.

I would like to thank you and Macboatmaster for all your patient help and advice, I will now mark this post as solved."

What an incredible and knowledgeable adviser you are, I will similarly mark your thread as solved.


----------



## Macboatmaster (Jan 15, 2010)

VERY pleased for you
Thanks for the kind comments
Most of the hard work was done by my colleague in the Malware forum.
Pleased to have helped


----------



## dai (Mar 7, 2003)

glad you have it sorted


----------

