All system restore points constantly deleted with VSS services/volsnap errors

Hi, Rob,

I was just going to say that, at least system restore points were staying put, since I had about 7 from yesterday and the day before when I closed down last night, but just looked and there are none left!! And no obvious errors in the Event log (it's usually volsnap).

I'd already run Avast antivirus. Malwarebytes, Superantispyware and Spybot, and today, as you suggested,  I ran TDSSkiller, Microsoft SafetyScanner, Hitman Pro and Windows Defender Offline,  (still a full scan with WDO to do), with nothing found. And I was quite happy, then found I'd lost all the Restore points!! But I'm not sure WHEN I lost them - I just looked at the Event log and din't see any volsnap errors, so assumed they were OK

I did have a series of these this morning:

Application 'C:\Windows\System32\SkyDrive.exe' (pid 4732) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\System32\SettingSyncHost.exe' (pid 4388) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\WinStore\WSHost.exe' (pid 6380) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\explorer.exe' (pid 2748) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\System32\dwm.exe' (pid 996) cannot be restarted - Application SID does not match Conductor SID..

Session "ReadyBoot" stopped due to the following error: 0xC0000188

The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.

but the only one I had after restarting after the antivirus scans was:

Application 'C:\Windows\System32\dwm.exe' (pid 996) cannot be restarted - Application SID does not match Conductor SID..

Hi,

Running chkdsk does not "usually" cause any issue with VSS/Restore. None of the problems

you have been having around Restore Points is the normal function of Windows so something

external (to Windows) is the root cause.

Be sure to run TDSSkiller.exe and the others below.

Well having such an error on a Reset which is essentially a new install is very troubling and

I have never seen that sort of error before.

What could be affecting the computer now that was also the cause of the issue before the

Reset? Not much if you didn't install anything that caused the issue (and that is a big unknown

on my end). So among what could cause the error and survive a Reset is a Root Kit or other

malware.

Be sure to do an extremely thorough check for malware on all drives.

============================================================

If you need to check for malware here are my recommendations - these will allow you to do

a thorough check and removal without ending up with a load of spyware programs running

resident which can cause as many issues as the malware and maybe harder to detect as

the cause.

No one program can be relied upon to detect and remove all malware. Added that often easy

to detect malware is often accompanied by a much harder to detect and remove payload. So

its better to be overly thorough now than to pay the high price later. Check with these to an

extreme overkill point.

How do I find and remove a virus?

http://windows.microsoft.com/en-US/windows-8/how-find-remove-virus

TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN

it will show any infections in the report after running - if it will not run change the name from

tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not

check with the other methods below.

http://support.kaspersky.com/viruses/solutions?qid=208280684

Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

Malwarebytes - free

http://www.malwarebytes.org/products/malwarebytes_free

SuperAntiSpyware Portable Scanner - Free

http://www.superantispyware.com/portablescanner.html?tag=SAS_HOMEPAGE

Hitman Pro is a second opinion scanner, designed to rescue your computer from malware

(viruses, trojans, rootkits, etc.) that have infected your computer despite all the security

measures you have taken (such as anti virus software, firewalls, etc.).

http://www.surfright.nl/en/hitmanpro

What is Windows Defender Offline?

http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

Windows Defender Offline system requirements

http://windows.microsoft.com/en-US/windows/windows-defender-offline-system-requirements

If needed here are some online free scanners to help

http://www.eset.com/onlinescan/

http://www.kaspersky.com/virusscanner

Other Free online scans

http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

Hope this helps.

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!

Hi Rob,

Could it have been due to me running a Windows-based disk check at the time? I have 2 internal hard drives (3 partitions) and 2 external (each 1 Tb) and the errors ran from 19.03 to 22.34. The disk check would have been running then - I went to bed at about 10.30 and the last external drive was about half done. I left the computer running overnight and had no more errors. Is this a possible answer?

Hi,

When you did the reset did you tell it not to use any previous settings? Obviously that

is not a default Windows caused issue or millions and millions would have it.

Have you done or installed anything that works with or uses the VSS or Restore Points? 

Hopefully not. Or have you changed any setting anywhere that is related to the VSS,

Restore Points, Backup, or File History?

Are you trying to access the Restore Point area? Or did you change it?

 <- Mark Twain said it right!

Wow Rob!

Plenty of homework there!

I don't know about the previous settings, though I know the previous settings for Services were not still there. I also found about 3 were set to Auto when the defaults according to Black Viper are Manual (and were Manual before the re-install as I'd set all to his defaults - so I don't think I've kept the settings) so I changed them to the supposed "defaults".

I've no idea how to tell if anything else uses VSS or Restore points. Or if any settings anywhere would affect them.

Where is the Restore Piont area?

At least my System Restore points are still there. I tried a SR to a point a few hours before the VSS errors started, and it said it hadn't completed because it couldn't access a file to do with avast definitions. BUT it didn't rollback the changes (that hasn't happened before) and it does seem to have made changes, as the software it said would be affected by the SR no longer exists on the computer. I'll check which set of Services I'm now running - the so-called "defaults" or the defaults I had after the re-install

I'll look at the links you supplied and get back to you, if you don't mind, though you may be getting sick of this!

Hi,

When you did the reset did you tell it not to use any previous settings? Obviously that

is not a default Windows caused issue or millions and millions would have it.

Have you done or installed anything that works with or uses the VSS or Restore Points? 

Hopefully not. Or have you changed any setting anywhere that is related to the VSS,

Restore Points, Backup, or File History?

Are you trying to access the Restore Point area? Or did you change it?

Sounds like you might have a drive problem or possibly even malware. Check with your

system maker and Microsoft Support direct. Check with TDSSkiller.exe to check for RootKits.

You might need to download the ISO and re-install Windows 8/8.1 and in the process remove

all partitions.

Also check the guys are TechNet where they might have see that error. You could move the

VSS area however the problem might follow the change and worse whatever causing it would

be unknown and may pop up to bite you even worse.

=============================================================

TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN

it will show any infections in the report after running - if it will not run change the name from

tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not

check with the other methods below.

http://support.kaspersky.com/viruses/solutions?qid=208280684

=============================================================

Download Windows 8.1 ISO Using your Windows 8.0 Key

http://mcakins.com/2013/10/19/download-windows-8-1-iso-using-you-windows-8-0-key/

Download Windows 8.1 iso

http://philipyip.wordpress.com/download-windows-8-1-iso/

Download the Windows 8.1 ISO using a Windows 8 key and some simple trickery

http://betanews.com/2013/10/21/download-the-windows-8-1-iso-using-a-windows-8-key-and-some-simple-trickery/

You can also make a Recovery USB drive.

How to Create a Recovery USB Flash Drive in Windows 8 and 8.1

http://www.eightforums.com/tutorials/5132-recovery-drive-create-usb-flash-drive-windows-8-a.html

On Nov. 15, 2013 Windows 8.1 Back-up Media will be available for purchase. Newegg and

others will be offering the disc,

Windows 8.1 'Back-up Media' disc available to buy soon

http://betanews.com/2013/11/05/windows-8-1-back-up-media-disc-available-to-buy-soon/

============================================================

TechNet - XP, Vista, Windows 7, and Windows 8 IT Pro (Windows 8.1 Preview & RTM)

http://social.technet.microsoft.com/Forums/en/category/w7itpro,w8itpro,windowsvistaitpro,windowsxpitpro,windowsintune

TechNet- Forums

http://social.technet.microsoft.com/Forums/en/categories/

TechNet - Where is the Forum For…?

http://social.technet.microsoft.com/Forums/en/whatforum/threads

Hope this helps.

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!