Cleaning Up XP
Suggestions:
1. Go offline.
2. Check Add/Remove for any bogus software. If any are found - uninstall. If the process is
denied check the Task Manager - to end the application before removing.
Added info: http://www.kellys-korner-xp.com/xp_a.htm#addremove
3. Go to Disk Cleanup remove all then go to More Options and clear out all system restore points
but the last one.
4. In Windows Explorer/C: clear out the Prefetch folder and remove unnecessary items within the pss folder.
5. Go to Start/Run - msconfig/startup and uncheck accordingly (especially rundll or 32...).
Note: Windows XP doesn't need anything checked there to boot.
6. While still there under the Services tab, hide all MS services and scan through what is
left. Everything listed there is what you have installed - uncheck accordingly.
7. Under all users, check each startup folder and programs folder and look for suspicious entries.
8. Do the same via the registry (Start/Run/Regedit) under the runkeys for Local and Current user.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
9. Also in the registry - scan the software list for both Local and Current user.
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_CURRENT_USER\Software
10. Poll startupfolder and startupreg: Delete as needed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\MsConfig
11. Here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Verify that: Shell = explorer.exe and Userinit = C:\Windows\system32\userinit.exe,
12. Here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Check data listed for AppInit_DLLs
13. Check all policy folders:
HKEY_CURRENT_USER\Software\Policies
HKEY_LOCAL_MACHINE\SOFTWARE\Policies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
14. Run cleaners: Make note of the path and manually remove them. If need be run via Safe Mode.
Cleaners: http://www.kellys-korner-xp.com/xp_s.htm#spy
Safe Mode: How to boot into Safe Mode:
You need to hit F8 during boot, just after the BIOS info switches to black screen. Or...
Go to Start/Run/Msconfig. Boot.Ini and check off /SafeBoot. Apply/Ok, reboot.
Note: Before leaving safe mode, revert.
Description of Safe Boot Mode in Windows
http://support.microsoft.com/support/kb/articles/q202/4/85.asp
Safe-Mode Boot Switches for Windows Boot.ini File
http://support.microsoft.com/support/kb/articles/q239/7/80.asp
Another option: Add Safe Mode to the Boot Screen
Use as an example/guideline: Go to Start/Run and type in: C:\boot.ini and copy/add what you
want (Safe Mode or with Command Prompt), then save, reboot.
Normal, Safe Mode and Command Prompt.
[boot loader]
timeout =15
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Windows XP Normal"
/fastdetect /sos)
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Windows XP SAFE
Mode"/safeboot:minimal)
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "XP SAFE Mode with
Command Prompt" /safeboot:minimal(alternateshell)
15. If you get access denied for removal of any of the files - you could try to rename them or
use KillBox: http://killbox.net/
16. If Task Manager, Regedit, CMD ....etc are disabled:
Manual: Navigate to the key below and change the dword value to end with a zero as shown:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
"DisableTaskMgr"=dword:00000000
Do the same for the rest:
DisableRegistryTools
DisableCMD
17. For Registry cleanings, Download Registry Booster or other similar softwares.
Automated: http://www.dougknox.com/xp/utils/xp_emergencyutil.zip or
http://www.kellys-korner-xp.com/regs_edits/regtmcmdrestore.vbs
Note: I am not liable for problems or mishaps that occur from the reader using advice posted here. No warranty, express or implied, is given with the posting of this message.
Good luck!
~~~~~~
Refererence : http://www.kellys-korner-xp.com/xp_c.htm#cleanup
Saturday, October 9, 2010
Friday, October 1, 2010
Removal of a file, folder from WINDOWS.
MANUALLY DELETING STUBBORN FILES
http://aumha.org/a/stubborn.php
You Cannot Delete a File or a Folder
http://support.microsoft.com/default...b;en-us;320081
Delete A File That Is Seemingly "Undeletable"
http://www.theeldergeek.com/delete_undeletable_file.htm
How To Delete "Undeletable" Files And Folders In XP
http://www.bootdisk.com/xptop20.htm#8
"Access Denied" Error Message When You Try to Delete a File
http://support.microsoft.com/?kbid=298345
You cannot delete a file or a folder on an NTFS file system volume
http://support.microsoft.com/?kbid=320081
You Receive an "Access Denied" Error Message When You Delete Folders from a
Mounted Drive
http://support.microsoft.com/?kbid=319368
How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/?kbid=308421
http://aumha.org/a/stubborn.php
You Cannot Delete a File or a Folder
http://support.microsoft.com/default...b;en-us;320081
Delete A File That Is Seemingly "Undeletable"
http://www.theeldergeek.com/delete_undeletable_file.htm
How To Delete "Undeletable" Files And Folders In XP
http://www.bootdisk.com/xptop20.htm#8
"Access Denied" Error Message When You Try to Delete a File
http://support.microsoft.com/?kbid=298345
You cannot delete a file or a folder on an NTFS file system volume
http://support.microsoft.com/?kbid=320081
You Receive an "Access Denied" Error Message When You Delete Folders from a
Mounted Drive
http://support.microsoft.com/?kbid=319368
How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/?kbid=308421
$RECYCLE.BIN , found.000, Found.011 , found0000.chk, file0000.chk
$RECYCLE.BIN::
When you delete files, it goes from Your Files to the Recycle Bin, obviously. You know that part. But when you delete the files in your Recycle Bin, they don't disappear; instead, they are 'sent' to the $Recycle.Bin Folder.
When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk.
Other words, When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk. In other words, the data is not erased, but the address marking the data's existence is.You cannot delete the $Recycle.Bin Folder; it is built in and will always reappear when you delete it.
The actual location of the Recycle Bin depends on the type of operating system and file system. On older FAT file systems (typically Windows 98 and prior), it is located in Drive:\RECYCLED. In the NTFS filesystem (Windows 2000, XP, NT) it is Drive:\RECYCLER. On Windows Vista and Windows 7 it is Drive:\$Recycle.Bin folder.[1]
How to remove $RECYCLE.BIN folder from removable drive ?
To remove the virus
1. Open Run
2. Open CMD
3. Terminate explorer.exe process in task manager.
3. Navigate to pendrive and use "del autorun.inf" command. If it says "Can't find autorun.inf" type "attrib -h -r -s" and repeat the command.
4. Navigate to C:/ Documents and Settings/ Your username directory and type "attrib -h -r -s"
5. Type "del csrss.exe". If it says "access is denied" terminate every process running under your username and repeat the command.
6. Restore explorer by typing "start explorer", go to the pendrive and delete the recycle bin folder.
To prevent pendrive viruses in the future, download a free program called "Autorun Eater" from http://oldmcdonald.wordpress.com/
Youtube : http://www.youtube.com/watch?v=vdVhxpkmX4Y
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Alternatively you can disable the AUTORUN feature:
1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following entry in the registry:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutorun
3. Right-click NoDriveTypeAutoRun, and then click Modify.
4. In the Value data box, type 0xFF to disable all types of drives. Or, to selectively disable specific drives, use a different value as described in the "How to selectively disable specific Autorun features" section.
5. Click OK, and then exit Registry Editor.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
================================================================================
found.000
These found.000, found.001 ..etc folders are system hidden folders that are made hidden by default by the Operating System.
These folders are created automatically when we run the chkdsk scan or possibly another disk checking utility. When errors are found such as lost clusters on your drive, Windows will fix the errors but depending on whether or not you have chosen to convert lost clusters or chains to file, windows will create these folders sequentially starting with .000. So you may have several of them.The folders contain files with names File0000.chk, File 0001.chk and so on. These file are created to save any lost data during the chkdsk fix.But usually these files are of no use and you can delete them at your will.
The reference to the FOUND.XXX folder is the results of Windows 2000 or Windows XP (not used in Windows 98) finding a problem in the operating system and placing random segments of unallocated data that it finds into those folders.The folders reside on the “root” of your primary hard drive (usually the C: drive) and are hidden. There are a number of ways to see if you have built up FOUND folders, but my preference is to use the command line.
Sometimes, When you don't make a habit of shutting your pc without closing windows properly. When you do that file pointers are not properly written and you end up with orphan files which the bootup disk checking utility finds but doesn't know what they are or their real filename extension so it puts .chk. Probably if you rename the large one to avi or mpg you will find that's it's one of those videos your friend brought over. Nothing "virus or trojan" about it. Just don't shut the power to the pc until windows says it's safe to do so and you should rarely if ever see any lost files.
How to remove "found.000" folder from removable drive ?
Go to the folder location and use below command for removal of folder.
rd found.000 /s
When you delete files, it goes from Your Files to the Recycle Bin, obviously. You know that part. But when you delete the files in your Recycle Bin, they don't disappear; instead, they are 'sent' to the $Recycle.Bin Folder.
When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk.
Other words, When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk. In other words, the data is not erased, but the address marking the data's existence is.You cannot delete the $Recycle.Bin Folder; it is built in and will always reappear when you delete it.
The actual location of the Recycle Bin depends on the type of operating system and file system. On older FAT file systems (typically Windows 98 and prior), it is located in Drive:\RECYCLED. In the NTFS filesystem (Windows 2000, XP, NT) it is Drive:\RECYCLER. On Windows Vista and Windows 7 it is Drive:\$Recycle.Bin folder.[1]
How to remove $RECYCLE.BIN folder from removable drive ?
To remove the virus
1. Open Run
2. Open CMD
3. Terminate explorer.exe process in task manager.
3. Navigate to pendrive and use "del autorun.inf" command. If it says "Can't find autorun.inf" type "attrib -h -r -s" and repeat the command.
4. Navigate to C:/ Documents and Settings/ Your username directory and type "attrib -h -r -s"
5. Type "del csrss.exe". If it says "access is denied" terminate every process running under your username and repeat the command.
6. Restore explorer by typing "start explorer", go to the pendrive and delete the recycle bin folder.
To prevent pendrive viruses in the future, download a free program called "Autorun Eater" from http://oldmcdonald.wordpress.com/
Youtube : http://www.youtube.com/watch?v=vdVhxpkmX4Y
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Alternatively you can disable the AUTORUN feature:
1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following entry in the registry:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutorun
3. Right-click NoDriveTypeAutoRun, and then click Modify.
4. In the Value data box, type 0xFF to disable all types of drives. Or, to selectively disable specific drives, use a different value as described in the "How to selectively disable specific Autorun features" section.
5. Click OK, and then exit Registry Editor.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
================================================================================
found.000
These found.000, found.001 ..etc folders are system hidden folders that are made hidden by default by the Operating System.
These folders are created automatically when we run the chkdsk scan or possibly another disk checking utility. When errors are found such as lost clusters on your drive, Windows will fix the errors but depending on whether or not you have chosen to convert lost clusters or chains to file, windows will create these folders sequentially starting with .000. So you may have several of them.The folders contain files with names File0000.chk, File 0001.chk and so on. These file are created to save any lost data during the chkdsk fix.But usually these files are of no use and you can delete them at your will.
The reference to the FOUND.XXX folder is the results of Windows 2000 or Windows XP (not used in Windows 98) finding a problem in the operating system and placing random segments of unallocated data that it finds into those folders.The folders reside on the “root” of your primary hard drive (usually the C: drive) and are hidden. There are a number of ways to see if you have built up FOUND folders, but my preference is to use the command line.
Sometimes, When you don't make a habit of shutting your pc without closing windows properly. When you do that file pointers are not properly written and you end up with orphan files which the bootup disk checking utility finds but doesn't know what they are or their real filename extension so it puts .chk. Probably if you rename the large one to avi or mpg you will find that's it's one of those videos your friend brought over. Nothing "virus or trojan" about it. Just don't shut the power to the pc until windows says it's safe to do so and you should rarely if ever see any lost files.
How to remove "found.000" folder from removable drive ?
Go to the folder location and use below command for removal of folder.
rd found.000 /s
RECYCLER and SYSTEM VOLUME INFORMATION
RECYCLER:It is the folder that any files you place in the recycle bin are placed. You need to make unhidden this first by "attrib RECYCLER -r -a -s -h" and then simply delete the same.
SYSTEM VOLUME INFORMATION:It is the folder where windows system restore files are located. If you do not want to use this folder then disable System Restore.
How to get rid of above folders created in Window drives ?
===================================================================================
***********************************************************************************
C:/RECYCLER Folder
C://RECYCLER is basically a location where a users deleted files are stored. After a user empties their Recycle Bin the data will stay in the RECYCLER location. This could be viewed as a kind of hidden back-up for deleted files (99.9% of users don't know about it) or back door to track a user if ever needed. I would imagine its purpose is in the event a user deleted a critical system file that needed to be recovered.
How to remove files in recycler ?
At a Command Prompt issue:rd /s /q c:\recycler - (Use at your own risk) You want also to check permissions on this folder.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
C:/System Volume Information Folder
If you've done much wandering around in Windows Explorer you might have noticed a folder called System Volume Information and wondered what purpose it serves. It's actually a part of System Restore; the tool that allows you to set points in time to roll back your computer. The System Volume Information folder is where XP stores these points and associated information that makes them accessible. If you have System Restore enabled but don't see this folder, go into [Tools] [Folder Options] [View] and click the radio button next to [Show Hidden Files and Folders] and it will be visible.
How to operate/remove System Volume Information folder?
Access is denied to this folder by default. If you feel that there is a virus inside this folder, the to fix:
Right click on My Computer Select properties Select System restore Check turn off system restore Apply and reboot computer
This will delete all contents inside System Volume Information folder restore points including viruses backed up there. Remeber to turn system restore back on, so that it will recreate with virus free new system restore info.
::::Note >> Both Recycler and _Restore (System Volume Information) are system folders. Their contents can be deleted but they will recreate.
***********************************************************************************
There is free utility "Unlocker", it can help. Here is link:
http://ccollomb.free.fr/unlocker/
And If you are using winXP, you can remove System Volume Information by disabling system restore: right click "My computer" -> properties ->System restore
**********************************************************************************
Look If your pc is virus free and you are sure that these folders are not virus then you can
Go to services.msc and disable system restore there and reboot. It will delete system volume information folder which is used to create restore points by windows.
**********************************************************************************
These two folders might contains most of the virus like...
w32.gammia
w32.infostealer
In one organisation where we have installed SEP, we found it, it was very easy to go and manually delete all files inside both folders, instead of SEP to scan and remove viruses. Couple of file does not get removed, ignore them.
This will reduce the scan time, and SEP will remove virus from the files which can not be deleted, if virus are present.
**********************************************************************************
===================================================================================
RECYCLER::
==========
1. click start>>run>>type in "cmd"
2. type the location of your flash drive.. e.g. "d:", "e:", "f:", etc..
3. type "dir /ah"
*you will now see the files/folders with hidden attributes
4. type "attrib [name of file/folder] -r -a -s -h"
*if you're going to unhide files, you should type the whole name plus the extension (format).. example "attrib party.jpg -r -a -s -h"
**if you have folders with 6 characters and above, type the first 6 characters then "~1".. example for folder named "birthday"
"attrib birthd~1 -r -a -s -h"
5. you should repeatedly type dir /ah after unhiding some files/folders so you'll know if they're now working or not..
6. now check you flash drive.. it should be there..
7. Go a head and Delete the folder "rmdir C:\recycler /s" and hit.
SYSTEM VOLUME INFORMATION:
==========================
System Volume Information or _Restore Folder can be emptied by disabling the System restore.Right click on My Computer Select properties Select System restore Check turn off system restore Apply and reboot computer.This will delete all restore points including viruses backed up there. Remeber to turn system restore back on.
SYSTEM VOLUME INFORMATION:It is the folder where windows system restore files are located. If you do not want to use this folder then disable System Restore.
How to get rid of above folders created in Window drives ?
===================================================================================
***********************************************************************************
C:/RECYCLER Folder
C://RECYCLER is basically a location where a users deleted files are stored. After a user empties their Recycle Bin the data will stay in the RECYCLER location. This could be viewed as a kind of hidden back-up for deleted files (99.9% of users don't know about it) or back door to track a user if ever needed. I would imagine its purpose is in the event a user deleted a critical system file that needed to be recovered.
How to remove files in recycler ?
At a Command Prompt issue:rd /s /q c:\recycler - (Use at your own risk) You want also to check permissions on this folder.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
C:/System Volume Information Folder
If you've done much wandering around in Windows Explorer you might have noticed a folder called System Volume Information and wondered what purpose it serves. It's actually a part of System Restore; the tool that allows you to set points in time to roll back your computer. The System Volume Information folder is where XP stores these points and associated information that makes them accessible. If you have System Restore enabled but don't see this folder, go into [Tools] [Folder Options] [View] and click the radio button next to [Show Hidden Files and Folders] and it will be visible.
How to operate/remove System Volume Information folder?
Access is denied to this folder by default. If you feel that there is a virus inside this folder, the to fix:
Right click on My Computer Select properties Select System restore Check turn off system restore Apply and reboot computer
This will delete all contents inside System Volume Information folder restore points including viruses backed up there. Remeber to turn system restore back on, so that it will recreate with virus free new system restore info.
::::Note >> Both Recycler and _Restore (System Volume Information) are system folders. Their contents can be deleted but they will recreate.
***********************************************************************************
There is free utility "Unlocker", it can help. Here is link:
http://ccollomb.free.fr/unlocker/
And If you are using winXP, you can remove System Volume Information by disabling system restore: right click "My computer" -> properties ->System restore
**********************************************************************************
Look If your pc is virus free and you are sure that these folders are not virus then you can
Go to services.msc and disable system restore there and reboot. It will delete system volume information folder which is used to create restore points by windows.
**********************************************************************************
These two folders might contains most of the virus like...
w32.gammia
w32.infostealer
In one organisation where we have installed SEP, we found it, it was very easy to go and manually delete all files inside both folders, instead of SEP to scan and remove viruses. Couple of file does not get removed, ignore them.
This will reduce the scan time, and SEP will remove virus from the files which can not be deleted, if virus are present.
**********************************************************************************
===================================================================================
RECYCLER::
==========
1. click start>>run>>type in "cmd"
2. type the location of your flash drive.. e.g. "d:", "e:", "f:", etc..
3. type "dir /ah"
*you will now see the files/folders with hidden attributes
4. type "attrib [name of file/folder] -r -a -s -h"
*if you're going to unhide files, you should type the whole name plus the extension (format).. example "attrib party.jpg -r -a -s -h"
**if you have folders with 6 characters and above, type the first 6 characters then "~1".. example for folder named "birthday"
"attrib birthd~1 -r -a -s -h"
5. you should repeatedly type dir /ah after unhiding some files/folders so you'll know if they're now working or not..
6. now check you flash drive.. it should be there..
7. Go a head and Delete the folder "rmdir C:\recycler /s" and hit
SYSTEM VOLUME INFORMATION:
==========================
System Volume Information or _Restore Folder can be emptied by disabling the System restore.Right click on My Computer Select properties Select System restore Check turn off system restore Apply and reboot computer.This will delete all restore points including viruses backed up there. Remeber to turn system restore back on.
Windows System Restore
Reference : http://bertk.mvps.org/
-------------------------------------------------------------------------------------
Log on to Windows as an Administrator.
Click Start, point to All Programs - Accessories - System Tools - System Restore.
On the Welcome to System Restore page, click Restore my computer to an earlier time, and click Next.
Or type or paste the following command in the Start - Run box then press Enter.
%systemroot%\system32\restore\rstrui.exe
On the Select a Restore Point page, click on a bold date on the calendar pryer to the day of the problem stated. There may also be a restore point for an earlier time on the same day. Try to use a restore point as close as possible to a time just before the problem started. If the problem persists, an earlier restore point can be used.
On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows XP configuration, and then restarts the computer.
If Windows will not start in normal mode
System Restore can be run form Safe Mode or Safe Mode Command Prompt.
Warning: When restoring a system from Safe Mode or from the Command Prompt an Undo restore point will NOT be created!
=====================================================================================
Window 7: To open System Restore
Before you start System Restore, save any open files and close all programs. Once you confirm your restore point, System Restore restarts your computer.
* Open System Restore by clicking the Start button Picture of the Start button. In the search box, type System Restore, and then, in the list of results, click System Restore. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
=====================================================================================
-------------------------------------------------------------------------------------
Log on to Windows as an Administrator.
Click Start, point to All Programs - Accessories - System Tools - System Restore.
On the Welcome to System Restore page, click Restore my computer to an earlier time, and click Next.
Or type or paste the following command in the Start - Run box then press Enter.
%systemroot%\system32\restore\rstrui.exe
On the Select a Restore Point page, click on a bold date on the calendar pryer to the day of the problem stated. There may also be a restore point for an earlier time on the same day. Try to use a restore point as close as possible to a time just before the problem started. If the problem persists, an earlier restore point can be used.
On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows XP configuration, and then restarts the computer.
If Windows will not start in normal mode
System Restore can be run form Safe Mode or Safe Mode Command Prompt.
Warning: When restoring a system from Safe Mode or from the Command Prompt an Undo restore point will NOT be created!
=====================================================================================
Window 7: To open System Restore
Before you start System Restore, save any open files and close all programs. Once you confirm your restore point, System Restore restarts your computer.
* Open System Restore by clicking the Start button Picture of the Start button. In the search box, type System Restore, and then, in the list of results, click System Restore. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
=====================================================================================
Troubleshooting FAQs - 1
How do I open System Restore?
1. Go to Start - All Programs - Accessories - System Tools - System Restore.
2. Go to Start - Run and paste the following command then press enter.
%systemroot%\system32\restore\rstrui.exe
3. Go to Start - Run and type msconfig and press enter. Click on Launch System Restore.
4. Go to Start - Help and support, "Undo changes to your computer with System Restore"
5. Press Ctrl+Alt+Del to launch Task Manager. Click File - New Task (Run...) and enter the following command then click OK.
%systemroot%\system32\restore\rstrui.exe
6. From Safe Mode, and from the Command Prompt. See the next two FAQs.
How do I Start the System Restore from the command prompt?
1. Boot the system and start tapping the F8 key as BIOS information goes by.
At the Windows Advanced Options Menu select Safe Mode with a command prompt.
For additional information about the Safe mode with a command prompt, click the following article in the Microsoft Knowledge Base:
A description of the Safe mode boot options in Windows XP
2. Log on to your computer with an administrator account or with an account that has administrator credentials.
3. Type the following command at a command prompt, and then press ENTER:
%systemroot%\system32\restore\rstrui.exe
4. Follow the instructions to restore your computer to an earlier state, or undo the last restore if available.
Note: When restoring a system from the command prompt, a automatic “UNDO” restore point will NOT be created and will not allow a restoration to the current state.
How do I test System Restore?
Create a new restore point named TEST.
Create a new shortcut on the desktop and point it to My Computer or any other file of your choice and name it TEST.
Now restore to the Test restore point.
The system will now reboot, and you will receive a message if the restore was successful, and the Test shortcut on the desktop will be gone. If not, follow these troubleshooting tips.
Note: This should be conducted on a regular basis. Once a month should do. Or if the system has been subject to virus or malware/spyware infection but only after the system has been fully cleaned.
How do I disable the Indexing Service?
Go to Start - Run – and type the following command then press OK.
services.msc
Scroll down to and double click: Indexing Service
Click the Stop button
In the Startup Type field select Manual of Disabled, then click Apply then OK
After you restart your machine it will stay disabled.
Can I use System Restore to uninstall applications?
NO! System Restore does not completely uninstall applications when restoring to a point prior to the applications installation. What happens is, System Restore only removes the monitored files for the installed applications and the remaining non-monitored files are left behind. Any registry entries made by the installation of the application will also be gone. This will cause the application not to function. And in some cases, cause the uninstall and reinstall process of the partially removed application to fail. This is why it is recommended to uninstall any applications installed after the restore point you will be restoring to. If the uninstall and reinstall fail, try to undo the restore point, uninstall the application in question, then perform the restore again. The only other option would be to manually remove (for advanced users) leftover files, folders, shortcuts, and registry entries.
Can I use System Restore to reinstall deleted or uninstalled applications?
For the most part, NO. System Restore will not restore uninstalled applications. It was not designed to do so. System Restore monitors a core set of system files and most of the registry. In a typical application installation there are file types that System Restore does not monitor, and therefore will not restore. This would cause the application to fail to run. An exception to this would be if an application consisted of only monitored file types. Such as just an EXE file.
Can I permanently save a restore point for later use?
By designed and under normal conditions System Restore will automatically create a new restore point every 24 hours.
When the allotted disk space is reached, the oldest restore point will be purged on a first in first out (FIFO) basis. Otherwise, restore points over 90 days are purged automatically by default.
Each one of these restore points are chained (or linked) together with previous restore points. When a restore point is chosen, all restore point created prior to that restore point are also required to complete the restoration.
While all of this is going on, in real time, a log is being created or updated that tracks the consistency between the files System Restore is monitoring, and the files that are actually backed up. If an inconsistency is found between the log file and the files located in the System Volume Information folder, restore point corruption can occur. In turn this causes the chain to become broken and any prior restore points to become useless, thus causing System Restore to fail at a restore. At this point all restore points would have to be purged to remove the corruption. So you can see, backing up and restoring restore points would cause an inconsistency in the restore log thus causing corruption and the loss of all restore points.
Note: Any changes made within the System Volume Information folder (where System Restore stores restore information) will almost certainly cause the same corruption.
Can I delete individual restore points from the system volume information folder?
No, and here why. Each restore points is chained (or linked) together with previous restore points. When you choose to restore a system all the previous restore point are required to complete the restore, thus if one is missing the chain will be broken and cause all existing restore points become corrupt. At this point all restore points will need to purged to correct the corruption. So the best advise is to NOT touch the contents of the System Volume Information folder.
Can I use System Restore to remove virus or malware infection?
NO. System Restore was not designed to be a virus or spyware removal tool and should not be depended on to do so. Click here for more information on virus and spyware removal.
Should I purge all my restore point BEFORE removing virus & malware infection?
No, and here’s why. If something goes wrong in the virus/malware removal process you will have no way to reverse your actions. Sometimes the removal process can be more damaging to the system than the infection. Two examples would be if the system became unbootable, or if the ability to connect to the internet to retrieve additional cleaning utilities is lost. So it is a good practice to leave System Restore restore points intact until the cleaning process is over and the system is otherwise clean of infection. Virus and malware infection residing within restore points are dormant, unless the system is restored to an infected restore point.
Warning: Just don't forget to purge all existing restore points after the cleaning is complete.
Should I let System Restore monitor my external drive?
It is a bad practice to let System Restore monitor an external drive. By design most external drives are monitored by System Restore. If any changes are made to the external drives files while it is not connected to the system, the next time it’s connected System Restore will find an inconsistency in the SR log and cause all existing restore points to become corrupt and require there deletion. The same can be true if the external drive is powered off while the system is running.
A possible work around is to assign a permanent drive letter (the higher in the alphabet the better) to the external drive via Disk Management. To access Disk Management, go to Start - Run and type diskmgmt.msc then press enter.
Right-click a partition, logical drive, or volume, and then click Change Drive Letter and Paths.
Do one of the following:
1. To assign a drive letter, click Add, click the drive letter you want to use, and then click OK.
2. To modify a drive letter, click it, click Change, click the drive letter you want to use, and then click OK.
Reboot the system. Open System Restore and stop monitoring that drive. This should keep System Restore from monitoring that drive, but not always.
USB drive letter manager - USBDLM
What should I do before running System Restore?
Any application installed after the restore point you are reverting to may not function. What happens is, System Restore only removes monitored files for the installed applications and the remaining files are left behind. This can cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. It is recommended to uninstall any applications that were installed after the restore point you will be restoring to.
What should I do after restoring my system to an earlier date?
After restoring a system to an earlier date all monitored files and folders will be reverted back to that date.
Any type of application that requires regular updates, such as virus and spyware applications may need to have there definitions updated.
Run Windows Update and MS Office Update, if installed
Any application installed after the restore point you are reverting to may not function. What happens is, System Restore only removes monitored files for the installed applications and the rest are left behind. This can cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. It is recommended to uninstall any applications that was installed after the restore point you will be restoring to.
Application that were uninstalled will not be fully reinstalled in the restore process because the installation may have contained unmonitored file types. Monitored files from that installation will be restored. To remove one of these partially installed application it may be necessary to reinstall it, then uninstall it via add/remove programs in Control Panel.
Top of page
What are the types of restore point I may see in the “Select a restore point” window?
Initial System checkpoints: This restore point is created the first time you start your computer after you upgrade it to Windows XP or when you first start a new computer.
System checkpoints: System Restore creates restore points on a regular basis even if you have not made any changes to the system. System Restore automatically creates these restore points every 24 hours of calendar time, or every 24 hours your computer is turned on. If your computer is turned off for more than 24 hours, System Restore creates a restore point the next time you start the computer. The computer must be idle for a few minutes before System Restore creates a scheduled restore point.
Program name installation restore points: When you install a application and provided the application utilizes an installer that is System Restore compliant this restore point will be created. Selecting this restore point removes installed files and registry settings made to the system during and after the install process. Files not monitored by System Restore will remain.
Automatic update restore points: If you use Windows XP automatic updates to receive downloaded updates, System Restore creates a restore point before installing the updating software.
Software Distribution Service 2.0 restore points: When Windows Update installs updates this restore point will be created prior to installing.
Manually created restore points: You can manually create your own restore points in the System Restore Wizard. When a created restore point is listed in the Select a restore point screen, it includes the name you gave it and is prefaced with the day, date and time it was created. You can create a restore point when you like the way your computer is functioning or before you make changes on your computer, like installing programs, hardware, changing system or registry settings that might make your computer function in an unexpected way.
Restore operation restore points: Each time you perform a restoration, System Restore creates a restore points that will allow you to UNDO the restoration. On option to “Undo my last restoration” will be displayed when opening System Restore for a period of time.
Unsigned device driver restore points: System Restore immediately creates a restore point if it detects that you are installing a driver to your computer that has not been signed or certified by Windows Hardware Quality Labs (WHQL). If the installation of the driver makes undesirable changes to your computer, you can select these restore points in the System Restore Wizard to undo the changes and restore your computer to the state that existed before the driver was installed.
Microsoft Backup utility recovery restore points: When you perform a recovery using the Backup utility, System Restore immediately creates a restore point before the process starts. If the recovery puts your computer in an undesirable state, you can select these restore points in the Select a restore point screen in the System Restore Wizard to undo the changes and restore your computer to the state that existed before you performed the recovery.
Where are the System Restore files located on the drive?
System Restore holds it’s restore points in a in a Super Hidden folder named “System Volume Information” on root of every drive, partition or volume, including most external drives, and some USB flash drives. On drives or partitions that are not monitored by System Restore this folder will be very small in size or completely empty, unless Encrypting File System is in use or the Indexing Service is turned on. Note: If the System Volume Information folder is deleted, it will be recreated automatically.
For Windows XP using the NTFS File System on a Workgroup or Standalone Computer
Click Start then My Computer.
On the Tools menu Then Folder Options.
On the View tab, click “Show hidden files and folders”.
Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Uncheck to clear the “Use simple file sharing (Recommended)” check box. This option is not available in Windows XP Home Edition. Warning This may have negative effects on system connected to a network, and possibility the network itself.
Click OK.
Right-click the System Volume Information folder in the root folder, and then click Properties.
Click the Security tab. Note: Windows XP Home users will have to boot into Safe Mode then logon to the default “Administrator” account to access the Security tab.
Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK again.
Double-click the System Volume Information folder in the root folder to open it.
Warning: Remember to hide the hidden System Files when done.
More information:
How to gain access to the System Volume Information folder
How to set, view, change, or remove file and folder permissions in Windows XP
Warning: Making changes to these files and folders can cause all restore points to become corrupt and useless, requiring them to be purged.
What is the System Volume Information folder used for?
The System Volume Information (SVI) folder is a super hidden system folder, and for good reason. There will be a SVI folder on each partition or volume that Windows sees. This includes external drives and some flash or thumb drives connected to the system. The SVI folder can not be permanently deleted, if so it will be recreated automatically. If a particular partition or volume is set to not be monitored by System Restore, the Indexing Service is turned off, and EFS is not in use, the SVI should be nearly empty or empty.
System Restore uses the SVI folder to store it’s information and hold restore points.
If the Indexing Service is turned on it will use the SVI folder to store files. This will be evident by the existence of a folder named catalog.wci or by typing cmd /k net start in the Start - Run box and looking for Indexing Service. Keep in mind that having the Indexing Service turned on can cause the SVI folder to grow very large. It's useful if you have a lot of Office documents or text files and want to do searches of them based on Content. Otherwise it's best turned off.
How do I disable the Indexing Service?
How to gain access to the System Volume Information folder
If Encrypting File System (EFS) is in use, it will use the SVI folder to store the log file that is generated during the encryption and decryption process.
Also see the warning below for Zone Alarm version 6.5 users.
Why is the System Volume Information folder so large?
The (SVI) System Volume Information folder is where System Restores holds it’s restore points and other information. There will be a SVI folder on every partition Windows sees. Normally the size of the SVI will be slightly larger than the of the amount of disk space allocated to hold restore points. Where are the System Restore files located on the drive?
Encrypting File System (EFS) also uses the System Volume Information folder on each partition to store the log file that is generated during the encryption and decryption process.
The Encrypting File System and Best practices for the Encrypting File System
If the Indexing Service has been turned on it will store files in the SVI folders. The peasants of the catalog.wci within the SVI folder would indicate that the Indexing Service started. To avoid this, disable the Indexing Service, reboot, and delete the catalog.wci folder. The catalog.wci should not be recreated. To confirm that the “Indexing Service” is running, click Start, click Run, and then type cmd /k net start then press enter. If Indexing Service is present, then Indexing is turned on.
Encrypting File System (EFS) and the Indexing Service can cause the SVI folder to become very large.
How to create and configure a catalog for indexing
How do I disable the Indexing Service?
Zone Alarm version 6.5 has a bug that creates very large .rdb files within the system. These .rdb files are monitored by System Restore and thus end up in the restore points located in the System Volume Information folder, along with other locations on the system. The best advise is to revert to an earlier version of Zone Alarm. Then disable System Restore which will purge all existing restore points, then turn it back on. For more information on this subject please visit the Zone Labs User Forum.
What happens to User Accounts in the restore process?
Restoring a system to a time before the user accounts were created, will remove those user accounts. The user account names will still persist under C:\Documents and Settings, which will contain the My Documents folder. Files and folder with the My Documents will be gone because the My Documents folder is not monitored by System Restore.
Restoring a system to a point before a user account was deleted will restore the user account. User files within the My Documents folder will not be restored because the My Documents folder is not monitored by System Restore.
After restoring there are programs listed in add/remove that can not be uninstalled
When a system is restored, all monitored files and registry settings of any program installed after that restore point was was created will be lost, and the non monitored files will be left behind. This will cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. This is why it is recommended to uninstall any applications installed after the restore point you will be restoring to. Attempt to reinstall the program and then uninstall it via the add/remove programs utility, that is as long as that was not the program that prompted the restore. A restore point created before that program was installed could also be used, but this will depend on how long ago it was installed and what other programs and setting would be affected by the restore. Another option is to UNDO the restore, uninstall the program in question via add/remove programs then restore the system. Otherwise you would have to manually remove the files and registry settings. That is of course after creating another restore point in case the manual removal causes more problems.
To manually remove entries from the add/remove utility follow the instruction from Kelly's site.
Add and Remove -Removing Invalid Entries in the Add/Remove Programs Tool
A good practice is to create a restore point before installing any new hardware or software.
In the restore process, what's restored and what's not!
Restored
Registry (note: some current values will persist)
Profiles (local only—roaming user profiles not impacted by restore)
COM+ DB
WFP.dll cache
WMI DB
IIS Metabase
Files with extensions listed in the Monitored File Extensions list
Not Restored
DRM settings
SAM hives (does not restore passwords)
WPA settings (Windows authentication information is not restored)
Contents of the My Documents folder(s)
Specific directories/files listed in the Monitored File Extensions list
Any file with an extension not listed in the Monitored File Extensions list
Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore)
User-created data stored in the user profile
Contents of redirected folders
A drive letter(s) are missing or mismatched on the System Properties - Restore Tab?
This is often caused by, but not limited to the install of a new physical drive to the system. There are two known solutions to this problem. The available drive letters may look like THIS.
The first solutions was discovered by MVP Ramesh Srinivasan. This is the recommended, and least destructive method. Drive letter missing in System Restore settings page?
The second is to Reinstall System Restore.
Warning, all restore points will be lost in this process.
System Restore opens to a blank window?
Go to Start -> Run and type or paste each of the following commands, one at a time while pressing enter after each one.
regsvr32 jscript
regsvr32 vbscript
regsvr32 /i mshtml
Related articles and fixes:
System Restore window is completely blank
System Restore Tool Displays a Blank Calendar in Windows XP
System Restore Calendar Blank
Several dialog boxes are blank
Restore the default associations for htm/html files
Installing Windows security update KB896688 (MS05-052) can be responsible for a blank page
The System Restore window relies on Internet Explorer (IE) to display correctly. It may be necessary to reinstall or repair IE to repair the blank window.
How to reinstall or repair Internet Explorer and Outlook Express in Windows XP
If “AnalogX DLL Archive” was run recently to remove .DLL files, restore the .DLL files using DLL Archive and then open System Restore. A reboot may be required. Note: If you are not EXACTLY SURE what a particular .DLL file does, DO NOT REMOVE IT!
Microsoft support is asking me to generate a .cab file to troubleshoot System Restore?
To generate a system restore Cab file please use the following procedure:
1. Click Start, click Run.
2. Type or paste the following: "%windir%\system32\restore\srdiag.exe" (without the quotation marks) and either press Enter or click OK.
3. A CMD window will open while the Srdiag.exe runs. The CMD session will automatically close when complete, and the .CAB file will be created as desired in your 'Windows\system32\restore' directory. Please be patient as this could take several minutes.
Reference : http://bertk.mvps.org/html/tips.html#SVIFolder
1. Go to Start - All Programs - Accessories - System Tools - System Restore.
2. Go to Start - Run and paste the following command then press enter.
%systemroot%\system32\restore\rstrui.exe
3. Go to Start - Run and type msconfig and press enter. Click on Launch System Restore.
4. Go to Start - Help and support, "Undo changes to your computer with System Restore"
5. Press Ctrl+Alt+Del to launch Task Manager. Click File - New Task (Run...) and enter the following command then click OK.
%systemroot%\system32\restore\rstrui.exe
6. From Safe Mode, and from the Command Prompt. See the next two FAQs.
How do I Start the System Restore from the command prompt?
1. Boot the system and start tapping the F8 key as BIOS information goes by.
At the Windows Advanced Options Menu select Safe Mode with a command prompt.
For additional information about the Safe mode with a command prompt, click the following article in the Microsoft Knowledge Base:
A description of the Safe mode boot options in Windows XP
2. Log on to your computer with an administrator account or with an account that has administrator credentials.
3. Type the following command at a command prompt, and then press ENTER:
%systemroot%\system32\restore\rstrui.exe
4. Follow the instructions to restore your computer to an earlier state, or undo the last restore if available.
Note: When restoring a system from the command prompt, a automatic “UNDO” restore point will NOT be created and will not allow a restoration to the current state.
How do I test System Restore?
Create a new restore point named TEST.
Create a new shortcut on the desktop and point it to My Computer or any other file of your choice and name it TEST.
Now restore to the Test restore point.
The system will now reboot, and you will receive a message if the restore was successful, and the Test shortcut on the desktop will be gone. If not, follow these troubleshooting tips.
Note: This should be conducted on a regular basis. Once a month should do. Or if the system has been subject to virus or malware/spyware infection but only after the system has been fully cleaned.
How do I disable the Indexing Service?
Go to Start - Run – and type the following command then press OK.
services.msc
Scroll down to and double click: Indexing Service
Click the Stop button
In the Startup Type field select Manual of Disabled, then click Apply then OK
After you restart your machine it will stay disabled.
Can I use System Restore to uninstall applications?
NO! System Restore does not completely uninstall applications when restoring to a point prior to the applications installation. What happens is, System Restore only removes the monitored files for the installed applications and the remaining non-monitored files are left behind. Any registry entries made by the installation of the application will also be gone. This will cause the application not to function. And in some cases, cause the uninstall and reinstall process of the partially removed application to fail. This is why it is recommended to uninstall any applications installed after the restore point you will be restoring to. If the uninstall and reinstall fail, try to undo the restore point, uninstall the application in question, then perform the restore again. The only other option would be to manually remove (for advanced users) leftover files, folders, shortcuts, and registry entries.
Can I use System Restore to reinstall deleted or uninstalled applications?
For the most part, NO. System Restore will not restore uninstalled applications. It was not designed to do so. System Restore monitors a core set of system files and most of the registry. In a typical application installation there are file types that System Restore does not monitor, and therefore will not restore. This would cause the application to fail to run. An exception to this would be if an application consisted of only monitored file types. Such as just an EXE file.
Can I permanently save a restore point for later use?
By designed and under normal conditions System Restore will automatically create a new restore point every 24 hours.
When the allotted disk space is reached, the oldest restore point will be purged on a first in first out (FIFO) basis. Otherwise, restore points over 90 days are purged automatically by default.
Each one of these restore points are chained (or linked) together with previous restore points. When a restore point is chosen, all restore point created prior to that restore point are also required to complete the restoration.
While all of this is going on, in real time, a log is being created or updated that tracks the consistency between the files System Restore is monitoring, and the files that are actually backed up. If an inconsistency is found between the log file and the files located in the System Volume Information folder, restore point corruption can occur. In turn this causes the chain to become broken and any prior restore points to become useless, thus causing System Restore to fail at a restore. At this point all restore points would have to be purged to remove the corruption. So you can see, backing up and restoring restore points would cause an inconsistency in the restore log thus causing corruption and the loss of all restore points.
Note: Any changes made within the System Volume Information folder (where System Restore stores restore information) will almost certainly cause the same corruption.
Can I delete individual restore points from the system volume information folder?
No, and here why. Each restore points is chained (or linked) together with previous restore points. When you choose to restore a system all the previous restore point are required to complete the restore, thus if one is missing the chain will be broken and cause all existing restore points become corrupt. At this point all restore points will need to purged to correct the corruption. So the best advise is to NOT touch the contents of the System Volume Information folder.
Can I use System Restore to remove virus or malware infection?
NO. System Restore was not designed to be a virus or spyware removal tool and should not be depended on to do so. Click here for more information on virus and spyware removal.
Should I purge all my restore point BEFORE removing virus & malware infection?
No, and here’s why. If something goes wrong in the virus/malware removal process you will have no way to reverse your actions. Sometimes the removal process can be more damaging to the system than the infection. Two examples would be if the system became unbootable, or if the ability to connect to the internet to retrieve additional cleaning utilities is lost. So it is a good practice to leave System Restore restore points intact until the cleaning process is over and the system is otherwise clean of infection. Virus and malware infection residing within restore points are dormant, unless the system is restored to an infected restore point.
Warning: Just don't forget to purge all existing restore points after the cleaning is complete.
Should I let System Restore monitor my external drive?
It is a bad practice to let System Restore monitor an external drive. By design most external drives are monitored by System Restore. If any changes are made to the external drives files while it is not connected to the system, the next time it’s connected System Restore will find an inconsistency in the SR log and cause all existing restore points to become corrupt and require there deletion. The same can be true if the external drive is powered off while the system is running.
A possible work around is to assign a permanent drive letter (the higher in the alphabet the better) to the external drive via Disk Management. To access Disk Management, go to Start - Run and type diskmgmt.msc then press enter.
Right-click a partition, logical drive, or volume, and then click Change Drive Letter and Paths.
Do one of the following:
1. To assign a drive letter, click Add, click the drive letter you want to use, and then click OK.
2. To modify a drive letter, click it, click Change, click the drive letter you want to use, and then click OK.
Reboot the system. Open System Restore and stop monitoring that drive. This should keep System Restore from monitoring that drive, but not always.
USB drive letter manager - USBDLM
What should I do before running System Restore?
Any application installed after the restore point you are reverting to may not function. What happens is, System Restore only removes monitored files for the installed applications and the remaining files are left behind. This can cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. It is recommended to uninstall any applications that were installed after the restore point you will be restoring to.
What should I do after restoring my system to an earlier date?
After restoring a system to an earlier date all monitored files and folders will be reverted back to that date.
Any type of application that requires regular updates, such as virus and spyware applications may need to have there definitions updated.
Run Windows Update and MS Office Update, if installed
Any application installed after the restore point you are reverting to may not function. What happens is, System Restore only removes monitored files for the installed applications and the rest are left behind. This can cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. It is recommended to uninstall any applications that was installed after the restore point you will be restoring to.
Application that were uninstalled will not be fully reinstalled in the restore process because the installation may have contained unmonitored file types. Monitored files from that installation will be restored. To remove one of these partially installed application it may be necessary to reinstall it, then uninstall it via add/remove programs in Control Panel.
Top of page
What are the types of restore point I may see in the “Select a restore point” window?
Initial System checkpoints: This restore point is created the first time you start your computer after you upgrade it to Windows XP or when you first start a new computer.
System checkpoints: System Restore creates restore points on a regular basis even if you have not made any changes to the system. System Restore automatically creates these restore points every 24 hours of calendar time, or every 24 hours your computer is turned on. If your computer is turned off for more than 24 hours, System Restore creates a restore point the next time you start the computer. The computer must be idle for a few minutes before System Restore creates a scheduled restore point.
Program name installation restore points: When you install a application and provided the application utilizes an installer that is System Restore compliant this restore point will be created. Selecting this restore point removes installed files and registry settings made to the system during and after the install process. Files not monitored by System Restore will remain.
Automatic update restore points: If you use Windows XP automatic updates to receive downloaded updates, System Restore creates a restore point before installing the updating software.
Software Distribution Service 2.0 restore points: When Windows Update installs updates this restore point will be created prior to installing.
Manually created restore points: You can manually create your own restore points in the System Restore Wizard. When a created restore point is listed in the Select a restore point screen, it includes the name you gave it and is prefaced with the day, date and time it was created. You can create a restore point when you like the way your computer is functioning or before you make changes on your computer, like installing programs, hardware, changing system or registry settings that might make your computer function in an unexpected way.
Restore operation restore points: Each time you perform a restoration, System Restore creates a restore points that will allow you to UNDO the restoration. On option to “Undo my last restoration” will be displayed when opening System Restore for a period of time.
Unsigned device driver restore points: System Restore immediately creates a restore point if it detects that you are installing a driver to your computer that has not been signed or certified by Windows Hardware Quality Labs (WHQL). If the installation of the driver makes undesirable changes to your computer, you can select these restore points in the System Restore Wizard to undo the changes and restore your computer to the state that existed before the driver was installed.
Microsoft Backup utility recovery restore points: When you perform a recovery using the Backup utility, System Restore immediately creates a restore point before the process starts. If the recovery puts your computer in an undesirable state, you can select these restore points in the Select a restore point screen in the System Restore Wizard to undo the changes and restore your computer to the state that existed before you performed the recovery.
Where are the System Restore files located on the drive?
System Restore holds it’s restore points in a in a Super Hidden folder named “System Volume Information” on root of every drive, partition or volume, including most external drives, and some USB flash drives. On drives or partitions that are not monitored by System Restore this folder will be very small in size or completely empty, unless Encrypting File System is in use or the Indexing Service is turned on. Note: If the System Volume Information folder is deleted, it will be recreated automatically.
For Windows XP using the NTFS File System on a Workgroup or Standalone Computer
Click Start then My Computer.
On the Tools menu Then Folder Options.
On the View tab, click “Show hidden files and folders”.
Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
Uncheck to clear the “Use simple file sharing (Recommended)” check box. This option is not available in Windows XP Home Edition. Warning This may have negative effects on system connected to a network, and possibility the network itself.
Click OK.
Right-click the System Volume Information folder in the root folder, and then click Properties.
Click the Security tab. Note: Windows XP Home users will have to boot into Safe Mode then logon to the default “Administrator” account to access the Security tab.
Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK again.
Double-click the System Volume Information folder in the root folder to open it.
Warning: Remember to hide the hidden System Files when done.
More information:
How to gain access to the System Volume Information folder
How to set, view, change, or remove file and folder permissions in Windows XP
Warning: Making changes to these files and folders can cause all restore points to become corrupt and useless, requiring them to be purged.
What is the System Volume Information folder used for?
The System Volume Information (SVI) folder is a super hidden system folder, and for good reason. There will be a SVI folder on each partition or volume that Windows sees. This includes external drives and some flash or thumb drives connected to the system. The SVI folder can not be permanently deleted, if so it will be recreated automatically. If a particular partition or volume is set to not be monitored by System Restore, the Indexing Service is turned off, and EFS is not in use, the SVI should be nearly empty or empty.
System Restore uses the SVI folder to store it’s information and hold restore points.
If the Indexing Service is turned on it will use the SVI folder to store files. This will be evident by the existence of a folder named catalog.wci or by typing cmd /k net start in the Start - Run box and looking for Indexing Service. Keep in mind that having the Indexing Service turned on can cause the SVI folder to grow very large. It's useful if you have a lot of Office documents or text files and want to do searches of them based on Content. Otherwise it's best turned off.
How do I disable the Indexing Service?
How to gain access to the System Volume Information folder
If Encrypting File System (EFS) is in use, it will use the SVI folder to store the log file that is generated during the encryption and decryption process.
Also see the warning below for Zone Alarm version 6.5 users.
Why is the System Volume Information folder so large?
The (SVI) System Volume Information folder is where System Restores holds it’s restore points and other information. There will be a SVI folder on every partition Windows sees. Normally the size of the SVI will be slightly larger than the of the amount of disk space allocated to hold restore points. Where are the System Restore files located on the drive?
Encrypting File System (EFS) also uses the System Volume Information folder on each partition to store the log file that is generated during the encryption and decryption process.
The Encrypting File System and Best practices for the Encrypting File System
If the Indexing Service has been turned on it will store files in the SVI folders. The peasants of the catalog.wci within the SVI folder would indicate that the Indexing Service started. To avoid this, disable the Indexing Service, reboot, and delete the catalog.wci folder. The catalog.wci should not be recreated. To confirm that the “Indexing Service” is running, click Start, click Run, and then type cmd /k net start then press enter. If Indexing Service is present, then Indexing is turned on.
Encrypting File System (EFS) and the Indexing Service can cause the SVI folder to become very large.
How to create and configure a catalog for indexing
How do I disable the Indexing Service?
Zone Alarm version 6.5 has a bug that creates very large .rdb files within the system. These .rdb files are monitored by System Restore and thus end up in the restore points located in the System Volume Information folder, along with other locations on the system. The best advise is to revert to an earlier version of Zone Alarm. Then disable System Restore which will purge all existing restore points, then turn it back on. For more information on this subject please visit the Zone Labs User Forum.
What happens to User Accounts in the restore process?
Restoring a system to a time before the user accounts were created, will remove those user accounts. The user account names will still persist under C:\Documents and Settings, which will contain the My Documents folder. Files and folder with the My Documents will be gone because the My Documents folder is not monitored by System Restore.
Restoring a system to a point before a user account was deleted will restore the user account. User files within the My Documents folder will not be restored because the My Documents folder is not monitored by System Restore.
After restoring there are programs listed in add/remove that can not be uninstalled
When a system is restored, all monitored files and registry settings of any program installed after that restore point was was created will be lost, and the non monitored files will be left behind. This will cause the application not to function. And in some cases, can also cause the uninstall and reinstall process of the partially removed application to fail. This is why it is recommended to uninstall any applications installed after the restore point you will be restoring to. Attempt to reinstall the program and then uninstall it via the add/remove programs utility, that is as long as that was not the program that prompted the restore. A restore point created before that program was installed could also be used, but this will depend on how long ago it was installed and what other programs and setting would be affected by the restore. Another option is to UNDO the restore, uninstall the program in question via add/remove programs then restore the system. Otherwise you would have to manually remove the files and registry settings. That is of course after creating another restore point in case the manual removal causes more problems.
To manually remove entries from the add/remove utility follow the instruction from Kelly's site.
Add and Remove -Removing Invalid Entries in the Add/Remove Programs Tool
A good practice is to create a restore point before installing any new hardware or software.
In the restore process, what's restored and what's not!
Restored
Registry (note: some current values will persist)
Profiles (local only—roaming user profiles not impacted by restore)
COM+ DB
WFP.dll cache
WMI DB
IIS Metabase
Files with extensions listed in the Monitored File Extensions list
Not Restored
DRM settings
SAM hives (does not restore passwords)
WPA settings (Windows authentication information is not restored)
Contents of the My Documents folder(s)
Specific directories/files listed in the Monitored File Extensions list
Any file with an extension not listed in the Monitored File Extensions list
Items listed in both Filesnottobackup and KeysnottoRestore (hklm->system->controlset001->control->backuprestore->filesnottobackup and keysnottorestore)
User-created data stored in the user profile
Contents of redirected folders
A drive letter(s) are missing or mismatched on the System Properties - Restore Tab?
This is often caused by, but not limited to the install of a new physical drive to the system. There are two known solutions to this problem. The available drive letters may look like THIS.
The first solutions was discovered by MVP Ramesh Srinivasan. This is the recommended, and least destructive method. Drive letter missing in System Restore settings page?
The second is to Reinstall System Restore.
Warning, all restore points will be lost in this process.
System Restore opens to a blank window?
Go to Start -> Run and type or paste each of the following commands, one at a time while pressing enter after each one.
regsvr32 jscript
regsvr32 vbscript
regsvr32 /i mshtml
Related articles and fixes:
System Restore window is completely blank
System Restore Tool Displays a Blank Calendar in Windows XP
System Restore Calendar Blank
Several dialog boxes are blank
Restore the default associations for htm/html files
Installing Windows security update KB896688 (MS05-052) can be responsible for a blank page
The System Restore window relies on Internet Explorer (IE) to display correctly. It may be necessary to reinstall or repair IE to repair the blank window.
How to reinstall or repair Internet Explorer and Outlook Express in Windows XP
If “AnalogX DLL Archive” was run recently to remove .DLL files, restore the .DLL files using DLL Archive and then open System Restore. A reboot may be required. Note: If you are not EXACTLY SURE what a particular .DLL file does, DO NOT REMOVE IT!
Microsoft support is asking me to generate a .cab file to troubleshoot System Restore?
To generate a system restore Cab file please use the following procedure:
1. Click Start, click Run.
2. Type or paste the following: "%windir%\system32\restore\srdiag.exe" (without the quotation marks) and either press Enter or click OK.
3. A CMD window will open while the Srdiag.exe runs. The CMD session will automatically close when complete, and the .CAB file will be created as desired in your 'Windows\system32\restore' directory. Please be patient as this could take several minutes.
Reference : http://bertk.mvps.org/html/tips.html#SVIFolder
SYSTEM VOLUME INFORMATIONS
SYSTEM VOLUME INFORMATIONS :This is WINDOWS feature folder to use for Drive Image to back up the system disk. If you are using Drive Image to back up the system disk, then you can delete the folder.
To delete the System Vol Info folder, follow below steps.
Microsoft Windows XP Professional or Windows XP Home Edition Using the FAT32 File System
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Click OK.
6. Double-click the System Volume Information folder in the root folder to open it.
Back to the top
Windows XP Professional Using the NTFS File System on a Domain
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Click OK.
6. Right-click the System Volume Information folder in the root folder, and then click Sharing and Security.
7. Click the Security tab.
8. Click Add, and then type the name of the user to whom you want to give access to the folder. Choose the account location if appropriate (either local or from the domain). Typically, this is the account with which you are logged on. Click OK, and then click OK again.
9. Double-click the System Volume Information folder in the root folder to open it.
Back to the top
Windows XP Professional using the NTFS File System on a Workgroup or Standalone Computer
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Clear the Use simple file sharing (Recommended) check box.
6. Click OK.
7. Right-click the System Volume Information folder in the root folder, and then click Properties.
8. Click the Security tab.
9. Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK again.
10. Double-click the System Volume Information folder in the root folder to open it.
NOTE: The System Volume Information folder is now accessible in normal mode to users of Windows XP Home Edition.
Back to the top
Using CACLS with Windows XP Home Edition Using the NTFS File System
In Windows XP Home Edition with the NTFS file system, you can also use the Cacls tool, which is a command-line tool, to display or modify file or folder access control lists (ACLs). For more information about the Cacls tool, including usage and switches, search the Help and Support Center for "cacls."
1. Click Start, click Run, type cmd, and then click OK.
2. Make sure that you are in the root folder of the partition for which you want to gain access to the System Volume Information folder. For example, to gain access the C:\System Volume Information folder, make sure that you are in the root folder of drive C (at a "C:\" prompt).
3. Type the following line, and then press ENTER:
cacls "driveletter:\System Volume Information" /E /G username:F
Make sure to type the quotation marks as indicated. This command adds the specified user to the folder with Full Control permissions.
4. Double-click the System Volume Information folder in the root folder to open it.
5. If you need to remove the permissions after troubleshooting, type the following line at a command prompt:
cacls "driveletter:\System Volume Information" /E /R username
This command removes all permissions for the specified user.
The following steps also work if you restart the computer to Safe mode because simple file sharing is automatically turned off when you run the computer in Safe mode.
1. Open My Computer, right-click the System Volume Information folder, and then click Properties.
2. Click the Security tab.
3. Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on.
4. Click OK, and then click OK again.
5. Double-click the System Volume Information folder to open it.
==================================================================================
Navigate to
%systemdrive%\System Volume Information
and delete all of the contents.
==================================================================================
Disable System Restore from REGEDIT by Command Line(i.e. start->run->cmd)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000001
Disable System Restore Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
"Start"=dword:00000004===================================================================================
Thanks,
To delete the System Vol Info folder, follow below steps.
Microsoft Windows XP Professional or Windows XP Home Edition Using the FAT32 File System
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Click OK.
6. Double-click the System Volume Information folder in the root folder to open it.
Back to the top
Windows XP Professional Using the NTFS File System on a Domain
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Click OK.
6. Right-click the System Volume Information folder in the root folder, and then click Sharing and Security.
7. Click the Security tab.
8. Click Add, and then type the name of the user to whom you want to give access to the folder. Choose the account location if appropriate (either local or from the domain). Typically, this is the account with which you are logged on. Click OK, and then click OK again.
9. Double-click the System Volume Information folder in the root folder to open it.
Back to the top
Windows XP Professional using the NTFS File System on a Workgroup or Standalone Computer
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options.
3. On the View tab, click Show hidden files and folders.
4. Clear the Hide protected operating system files (Recommended) check box. Click Yes when you are prompted to confirm the change.
5. Clear the Use simple file sharing (Recommended) check box.
6. Click OK.
7. Right-click the System Volume Information folder in the root folder, and then click Properties.
8. Click the Security tab.
9. Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK again.
10. Double-click the System Volume Information folder in the root folder to open it.
NOTE: The System Volume Information folder is now accessible in normal mode to users of Windows XP Home Edition.
Back to the top
Using CACLS with Windows XP Home Edition Using the NTFS File System
In Windows XP Home Edition with the NTFS file system, you can also use the Cacls tool, which is a command-line tool, to display or modify file or folder access control lists (ACLs). For more information about the Cacls tool, including usage and switches, search the Help and Support Center for "cacls."
1. Click Start, click Run, type cmd, and then click OK.
2. Make sure that you are in the root folder of the partition for which you want to gain access to the System Volume Information folder. For example, to gain access the C:\System Volume Information folder, make sure that you are in the root folder of drive C (at a "C:\" prompt).
3. Type the following line, and then press ENTER:
cacls "driveletter:\System Volume Information" /E /G username:F
Make sure to type the quotation marks as indicated. This command adds the specified user to the folder with Full Control permissions.
4. Double-click the System Volume Information folder in the root folder to open it.
5. If you need to remove the permissions after troubleshooting, type the following line at a command prompt:
cacls "driveletter:\System Volume Information" /E /R username
This command removes all permissions for the specified user.
The following steps also work if you restart the computer to Safe mode because simple file sharing is automatically turned off when you run the computer in Safe mode.
1. Open My Computer, right-click the System Volume Information folder, and then click Properties.
2. Click the Security tab.
3. Click Add, and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on.
4. Click OK, and then click OK again.
5. Double-click the System Volume Information folder to open it.
==================================================================================
Navigate to
%systemdrive%\System Volume Information
and delete all of the contents.
==================================================================================
Disable System Restore from REGEDIT by Command Line(i.e. start->run->cmd)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000001
Disable System Restore Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
"Start"=dword:00000004===================================================================================
Thanks,
Remove "RECYCLER".....
First you need to unhide the RECYCLER Folder by following steps.
------------------------------------------------------------------
1. click start>>run>>type in "cmd"
2. type the location of your flash drive.. e.g. "d:", "e:", "f:", etc..
3. type "dir /ah"
*you will now see the files/folders with hidden attributes
4. type "attrib [name of file/folder] -r -a -s -h"
*if you're going to unhide files, you should type the whole name plus the extension (format).. example "attrib party.jpg -r -a -s -h"
**if you have folders with 6 characters and above, type the first 6 characters then "~1".. example for folder named "birthday"
"attrib birthd~1 -r -a -s -h"
5. you should repeatedly type dir /ah after unhiding some files/folders so you'll know if they're now working or not..
6. now check you flash drive.. it should be there..
7. Go a head and Delete the folder "del [name of file/folder]"
==================================================================================
------------------------------------------------------------------
1. click start>>run>>type in "cmd"
2. type the location of your flash drive.. e.g. "d:", "e:", "f:", etc..
3. type "dir /ah"
*you will now see the files/folders with hidden attributes
4. type "attrib [name of file/folder] -r -a -s -h"
*if you're going to unhide files, you should type the whole name plus the extension (format).. example "attrib party.jpg -r -a -s -h"
**if you have folders with 6 characters and above, type the first 6 characters then "~1".. example for folder named "birthday"
"attrib birthd~1 -r -a -s -h"
5. you should repeatedly type dir /ah after unhiding some files/folders so you'll know if they're now working or not..
6. now check you flash drive.. it should be there..
7. Go a head and Delete the folder "del [name of file/folder]"
==================================================================================
Subscribe to:
Posts (Atom)