[Jocosa]

Hi,

I have a home system running Vistas Home Premium. Restore has been on since I got this system a few years back. It's saved my butt a few times.



However when I went to restore from an earlier date 4 days ago it told me restore was turned off. And when I try to turn it on group policy blocks me. I tried typing in “gpedit.msc” (as suggested in a few help web sites) in the search area and it finds nothing.



Another site gave step by step instructions about going into regedit to the restore folder and what to delete. I deleted the files it said to there and it changed nothing.



I’ve also seen suggestions to go into local security but that is not coming up under the Admin page.


I am Admin so have full access but it's not letting me do a thing to correct this.

I have done full scans with MalWareBytes and Super Anti-Spyware Pro and Ad-Aware. They all come back clean.

My system has been acting wonky for a week or so now - Firefox randomly freezes and closing it does not fully close it. I have to go into Task Manager and end the .exe program manually now. The system quit seeing my router so the home network is gone (I tried all the trouble shooting tasks) and it has now decided I need to log into my DSL account each time I want to websurf and before you would just turn on the system, click on Firefox and away it went.

Which is why I was hoping to restore from a earlier date and how I found out that is no longer an option. I know my older restore points are most likely all gone now thanks to this but would still love to have restore back on. It's scary without it. And it is odd and anoying to have no control over my system anymore. There were no changes in the past few months and I changed no settings.

Any help at all would be awesome! Thanks so much in advance.

[Phantom010]

Please click here to download and install the HijackThis installer.

Run it and select Do a system scan and save a logfile.

The log will be saved in Notepad. Copy and paste the log in your next post.

Do not fix anything

[Jocosa]

Downloaded and ran it. Results coming right up. Thanks so much!

Hrm, pasted in and they look pretty wacked. Am attaching instead. Hope that is ok?

[Phantom010]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:41:50 PM, on 9/26/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SetPoint\LBTWiz.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\SetPoint\SetPoint.exe
C:\Windows\System32\CTxfispi.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Trillian\trillian.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Logitech BT Wizard] LBTWiz.exe -silent
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Windows\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall /Get1noarp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-1010\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Chris & Kaile')
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-501\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Guest')
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-501\..\Run: [StartUp This] "C:\Program Files\Laplink\PCmover\LaunchSt.exe" (User 'Guest')
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Guest')
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-501\..\Run: [Dell DataSafe Scheduler] C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exe (User 'Guest')
O4 - HKUS\S-1-5-21-1523090135-2532815062-2000566303-501\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'Guest')
O4 - S-1-5-18 Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe (User 'Default user')
O4 - Startup: Webshots.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O15 - Trusted Zone: http://www.nfl.com
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/FWInstaller.exe
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/40...2/cpbrkpie.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B752F6-30B7-40B9-8191-EC400C15A776}: NameServer = 68.94.156.1 68.94.157.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
--
End of file - 10009 bytes

[Phantom010]

To get into the Group Policy editor, click on Start > Run > type gpedit.msc

Computer Configuration > Administrative Templates > System > System Restore.

If no luck, try System Restore in Safe Mode.

Or, turn off UAC.

Also, click on Start > Run > type services.msc

Locate the System Restore service. Double-click on it and make sure it's Started and Automatic.

[Phantom010]

You have too many Startup applications loading with Windows. This can significantly increase your Startup time and affect overall performance.

You should definitely trim down your Startup list.

Click on Start > Run > and type msconfig.

Under the Startup tab, uncheck all unnecessary applications. Use these three websites to help you decide which items to uncheck:

Startup applications #1

Startup applications #2 (for this one, you can paste the whole 04 entry)

Startup applications #3

Simply copy and paste the .exe files you see at the end of your HijackThis log's 04 (Startup) entries one by one.

Remember, a lot of applications can be started manually when needed.

[helpful]

Another option is to rename the group policy files and eliminate all policies, including hopefully the one that is blocking system restore from being enabled:

1. Navigate to %windir%\system32\GroupPolicy in explorer
2. Inside the directory there are two folders of interest "Machine" which contain machine specific policies and user which contain user specific policies
3. Open the machine folder, rename Registry.pol to Registry.Old
4. Open the user folder, rename Registry.pol to Registry.Old
5. Open the command prompt, type "gpupdate /force"
6. Attempt to enable system restore, if that does not work please reboot your pc and try to enable system restore again

Please note that this eliminates all local group policy settings defined on the pc. If you need to go back open the machine and user folders and rename the files back to Registry.pol.

[Phantom010]

By the way, you don't have an antivirus!

Malwarebytes' Anti-Malware, SuperAntiSpyware, Ad-Aware, Windows Defender and Spybot are not antivirus programs. They are anti-spyware programs.

You should get rid of Ad-Aware and Spybot, and disable Windows Defender. You already have MBAM and SAS in real-time protection, much better programs. In fact, you should only run one anti-spyware in real-time. You can even turn off real-time on all of them. Simply perform periodic scans. The most important thing would be to get yourself an antivirus at once. I always recommend ESET's NOD32 antivirus.

So, you have 5 anti-spyware programs working together in the background. A great way to create conflicting issues between them and your other Windows and non-Windows applications. Only use one or none in real-time. Otherwise, you're only overkilling it and rendering your computer even more vulnerable. This may very well be the root cause of your problems.

There's also an option in SuperAntiSpyware to fix System Restore. Click on Preferences and select the Repairs tab. Have you tried it?

I hope you have at least Windows Vista's firewall turned on?

[Jocosa]

"There's also an option in SuperAntiSpyware to fix System Restore. Click on Preferences and select the Repairs tab. Have you tried it?"

No. I did not know it existed. And I am in there now and not seeing it.

Yes, I at least have the Firewall on.

I like Spybot because I run it last and it finds things after the rest proclaim it "clean".

I like real time because this system has 3 users beside myself, 2 of which are early 20's with their own user log ins. And both are not always careful where they go. No matter how much I lecture and threaten. :P One of the 2 is a 23 year old male... need I say more why I keep real time on?

Will try all the rest tomorrow. Thank you.

[Jocosa]

And I tried that and get "Windows cannot find "gpedit.msc". Make sure you typed the name correctly, and then try again."

[Phantom010]

I think you might not have the Group Policy editor on your version of Vista. I'm on XP Pro and I have it but XP Home doesn't. I'm not familiar enough with Vista but I think Group Policy isn't available in Vista Home.

I don't think it's a Group Policy restriction in your case. If you haven't edited it, it shouldn't be set to block System Restore.

I would try the other suggestions.

And, removing your multiple real-time protection anti-spyware programs is not an option... You will definitely have problems. Your computer must surely be slow as a snail!!!

[Phantom010]

No. I did not know it existed. And I am in there now and not seeing it.

Look carefully, it is there.

[Phantom010]

First, try System Restore in Safe Mode.

If no luck,

How to start System Restore by using the Command prompt:

To start System Restore using the Command prompt, follow these steps:

1. Restart your computer, and then press and hold F8 during the initial startup to start your computer in safe mode with a Command prompt.
2. Use the arrow keys to select the Safe mode with a Command prompt option.
3. If you are prompted to select an operating system, use the arrow keys to select the appropriate operating system for your computer, and then press ENTER.
4. Log on as an administrator or with an account that has administrator credentials.
5. At the command prompt, type %systemroot%\system32\restore\rstrui.exe, and then press ENTER.
6. Follow the instructions that appear on the screen to restore your computer to a functional state.

[Jocosa]

I think you might not have the Group Policy editor on your version of Vista. I'm on XP Pro and I have it but XP Home doesn't. I'm not familiar enough with Vista but I think Group Policy isn't available in Vista Home.

I don't think it's a Group Policy restriction in your case. If you haven't edited it, it shouldn't be set to block System Restore.

It truly is that. The actual pop up said something about Group Policy not allowing access. It's how I knew what words to use and Google as I'd never heard of it before. :P It is not something I changed since I was unaware until all this that it even existed, let alone how to get to it. I may not have it in my version of Vista but it sure seems to think so.

I logged in today after totally shutting it down last night and it is actually allowing me into where restore is and as expected there are no restore points at all. However the box that should fill in with the drives I want to create restore points for is blank and the "create" button is greyed out.

I would try the other suggestions.

I printing them all out as I type this.

[Jocosa]

Originally Posted by Phantom010

Look carefully, it is there.

I just looked again, after a full nights sleep and honestly, it is not there. I highlighted each repair option, read the full description of it and there is nothing for restore. I was going to copy/paste the full list here but "copy" is not working in there and a screen capture won't help since it takes about 3 scrolls to see all the repair options.