All system restore points constantly deleted with VSS services/volsnap errors

To confuse matters even more, last reboot, I got a volsnap error:

The shadow copies of volume D: were aborted during detection because a critical control file could not be opened.

actually, 2, both the same,

but DIDN'T lose my restore point! (this has never happened before)

Is it normal for the Properties of all System Volume Information folders to say 0 bytes? Is it worth restoring these from one of my many backups when System Restore was working yesterday and the day before?

Just checked System Restore config after my re-install. E drive was 65 Gb, D drive was 10 so I've increased it to 103, and C was only 5 so I increased it to 43. But, if the space is too small, does it destroy ALL system restore points or only some?

Hi, Rob,

I was just going to say that, at least system restore points were staying put, since I had about 7 from yesterday and the day before when I closed down last night, but just looked and there are none left!! And no obvious errors in the Event log (it's usually volsnap).

I'd already run Avast antivirus. Malwarebytes, Superantispyware and Spybot, and today, as you suggested,  I ran TDSSkiller, Microsoft SafetyScanner, Hitman Pro and Windows Defender Offline,  (still a full scan with WDO to do), with nothing found. And I was quite happy, then found I'd lost all the Restore points!! But I'm not sure WHEN I lost them - I just looked at the Event log and din't see any volsnap errors, so assumed they were OK

I did have a series of these this morning:

Application 'C:\Windows\System32\SkyDrive.exe' (pid 4732) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\System32\SettingSyncHost.exe' (pid 4388) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\WinStore\WSHost.exe' (pid 6380) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\explorer.exe' (pid 2748) cannot be restarted - Application SID does not match Conductor SID..

Application 'C:\Windows\System32\dwm.exe' (pid 996) cannot be restarted - Application SID does not match Conductor SID..

Session "ReadyBoot" stopped due to the following error: 0xC0000188

The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.

but the only one I had after restarting after the antivirus scans was:

Application 'C:\Windows\System32\dwm.exe' (pid 996) cannot be restarted - Application SID does not match Conductor SID..

Hi,

Running chkdsk does not "usually" cause any issue with VSS/Restore. None of the problems

you have been having around Restore Points is the normal function of Windows so something

external (to Windows) is the root cause.

Be sure to run TDSSkiller.exe and the others below.

Well having such an error on a Reset which is essentially a new install is very troubling and

I have never seen that sort of error before.

What could be affecting the computer now that was also the cause of the issue before the

Reset? Not much if you didn't install anything that caused the issue (and that is a big unknown

on my end). So among what could cause the error and survive a Reset is a Root Kit or other

malware.

Be sure to do an extremely thorough check for malware on all drives.

============================================================

If you need to check for malware here are my recommendations - these will allow you to do

a thorough check and removal without ending up with a load of spyware programs running

resident which can cause as many issues as the malware and maybe harder to detect as

the cause.

No one program can be relied upon to detect and remove all malware. Added that often easy

to detect malware is often accompanied by a much harder to detect and remove payload. So

its better to be overly thorough now than to pay the high price later. Check with these to an

extreme overkill point.

How do I find and remove a virus?

http://windows.microsoft.com/en-US/windows-8/how-find-remove-virus

TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN

it will show any infections in the report after running - if it will not run change the name from

tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not

check with the other methods below.

http://support.kaspersky.com/viruses/solutions?qid=208280684

Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

Malwarebytes - free

http://www.malwarebytes.org/products/malwarebytes_free

SuperAntiSpyware Portable Scanner - Free

http://www.superantispyware.com/portablescanner.html?tag=SAS_HOMEPAGE

Hitman Pro is a second opinion scanner, designed to rescue your computer from malware

(viruses, trojans, rootkits, etc.) that have infected your computer despite all the security

measures you have taken (such as anti virus software, firewalls, etc.).

http://www.surfright.nl/en/hitmanpro

What is Windows Defender Offline?

http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

Windows Defender Offline system requirements

http://windows.microsoft.com/en-US/windows/windows-defender-offline-system-requirements

If needed here are some online free scanners to help

http://www.eset.com/onlinescan/

http://www.kaspersky.com/virusscanner

Other Free online scans

http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

Hope this helps.

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!