SYSTEM RESTORE MISSING

[srobin]

I seem to have lost the system restore tab in windows XP .. any suggestions
greatly appreciated, I've been all through MS knowledge base, nothing about
it there. HELP. thanks

[Michael Solomon \(MS-MVP Windows Shell/User\)]

It's missing from where?

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"srobin" > wrote in message
...
> I seem to have lost the system restore tab in windows XP .. any
suggestions
> greatly appreciated, I've been all through MS knowledge base, nothing
about
> it there. HELP. thanks
>
>

[srobin]

my computer/ properties NO system retore tab

[srobin]

OH and I get this error message BEFORE system properties opens (minutes the
system restore tab)...

rundll32.exe Entry Point Not Found
The procedure entry point RemoteAssistancePrepareSystemRestore could not be
located in the dynamic link library WINSTA.dll

does that make sense?

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Yup, you have the blaster worm.

826955 Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?id=826955

For a quick, small removal tool for W32.Blaster.Worm, see
www.kellys-korner-xp.com/xp_qr.htm#rpc

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"srobin" > wrote in message
...
> OH and I get this error message BEFORE system properties opens (minutes
the
> system restore tab)...
>
> rundll32.exe Entry Point Not Found
> The procedure entry point RemoteAssistancePrepareSystemRestore could not
be
> located in the dynamic link library WINSTA.dll
>
> does that make sense?
>
>

[srobin]

thanks for your help, links and info. I downloaded and ran the script file
and received the message that I DID NOT have the blaster virus, then I
downloaded the patch and during installation received an error message
KB82390 setup error Failed to install catalog files. I still don't have
system restore. ANy other suggestions? thanks so much.

[srobin]

I also noticed I can't run system commands like regedit or msconfig, they
open and close immediataly. Part of the blaster I assume, seems it's left
its mark on my system, I got rid of it, but now can't fix what it messed up.
Geesh.

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Try a repair install as follows:
Be sure you are well backed up in case there is a problem from which you are
unable to recover. NOTE, while a repair install should leave your data
files intact, if something goes wrong during the repair install, you may be
forced to start over and do a clean install of XP. If you don't have your
data backed up, you would lose your data should that eventuality occur.



Boot from the CD. If your system is set to be able to boot from the CD, it
should detect the disk and give a brief message, during the boot up, if you
wish to boot from the CD press any key.



Once you have pressed a key, setup should begin. You will see a reference
asking if you need to load special drivers and another notice that if you
wish to begin the ASR (Automatic Recovery Console) depress F2. Just let
setup run past all of that. It will continue to load files and drivers.



Then it will bring you to a screen. Eventually, you will come to a screen
with the option to (1) setup Windows or (2) Repair Windows Installation
using the Recovery console.



The first option, to setup Windows is the one you want and requires you to
press enter. When asked, press F8 to accept the end user agreement. Setup
will then search for previous versions of Windows. Upon finding your
version, it will ask if you wish to Repair your current installation or
install fresh. Press R, that will run a repair installation. From there
on, follow the screens.


--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"srobin" > wrote in message
...
> thanks for your help, links and info. I downloaded and ran the script file
> and received the message that I DID NOT have the blaster virus, then I
> downloaded the patch and during installation received an error message
> KB82390 setup error Failed to install catalog files. I still don't have
> system restore. ANy other suggestions? thanks so much.
>
>

[srobin]

Ok I will try that, wish me luck. I'll be back shortly, I hope. Thanks

[srobin]

nothing worked :((((( don't tell me I have to reformat.

[Maureen Goldman]

>"srobin" > wrote:
>nothing worked :((((( don't tell me I have to reformat.

I copied a message from www.annoyances.org in response to a post about
a problem getting system restore to run and citing a winsta.dll error.
I haven't tried this method (haven't had the problem), and it isn't my
computer. However, the steps mentioned look very conservative. The
other most-cited cure at that website is to install SP1a, which seems
to be 125M.

http://www.annoyances.org/exec/forum/winxp/t1050321859
Friday, August 8, 2003 at 6:53 am
Posted by qball

Have a Compaq ML330e server with XP.. had the same problem but fixed
with having to install sp1.

This issue can occur if there are corrupted restore points or some
related system files are missing. To troubleshoot this issue, let's go
through the following steps:

Part I. Disable and then re-enable the System Restore feature:
------------------------------------------
1. Click the Start menu -> Run. Type "sysdm.cpl" (Without quotation
marks) in the Open field. Click OK.
2. Click the "System Restore" tab.
3. Click to check the "Turn off System Restore on all drives" box, and
click OK.
4. Restart the computer.
5. Click the Start menu -> Run. Type "sysdm.cpl" (Without quotation
marks) in the Open field. Click OK.
6. On the "System Restore" tab, remove the check mark from the "Turn
off System Restore on all drives" box, and click OK.
7. Restart the computer again.
8. Check whether you can use the System Restore function.

Part II. If this issue persists, please perform the following steps to
repair the System Restore feature:
-----------------------------------------------
1. In My Computer, click the Tools menu -> Folder Options.
2. On the View tab, make sure to check the option "Hide extensions for
known file types".
3. Click OK.
4. Click the Start menu -> Run. Type "%windir%\inf" (Without quotation
marks) in the Open field. Click OK.
5. Locate and select the file "sr.inf". Right-click it and then click
Install.

[srobin]

Maureen thank you those instructions helped me get back the System Restore
tab in computer properties but I still cant use other commands,like regedit
, it opens and closes quickly, is there a fix for that too?

[Maureen Goldman]

>"srobin" > wrote:
>Maureen thank you those instructions helped me get back the System Restore

It worked? Great! Really appreciate hearing that.

>tab in computer properties but I still cant use other commands,like regedit
>, it opens and closes quickly, is there a fix for that too?

You should be able to access regedit.exe after renaming it
regedit.com.

If the task manager is another problem area, here is advice from a
post by MVP Doug Knox, who is one of the stalwarts here:

Open a Command Prompt window [RUN cmd] and enter the following:

COPY C:\Windows\System32\Taskmgr.exe C:\Windows\System32\Taskmgr1.exe

Then

C:\Windows\System32\Taskmgr1.exe

Task manager should start.

[srobin]

Maureen, thanks again, I was able to access task manager too, but only by
going to run and typing that command, if i just clik the taskbar and click
Task Manager, it shuts down again.

Also cant do msconfig commands

so frustrating, why did they have to pick on us

[Maureen Goldman]

>"srobin" > wrote:
>Maureen, thanks again, I was able to access task manager too, but only by
>going to run and typing that command, if i just clik the taskbar and click
>Task Manager, it shuts down again.

>Also cant do msconfig commands

From another Doug Knox message (you've already changed to regedit.com,
I believe) Subject header dealt with being unable to get task manager
via ctrl-alt-del and also msconfig:

Do the following:

Click Start, Run and enter CMD to open a Command Prompt window. Then
copy and paste the following commands into the Command Prompt window.

COPY %WINDIR%\System32\Taskmgr.exe %WINDIR%\System32\Taskmgr1.exe
COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
COPY %WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG.EXE
%WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG1.EXE

Then you can use the new file names to get into these utilities to use
them to help your troubleshooting.



>so frustrating, why did they have to pick on us

If they find the culprits, perhaps we'll find out.

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Maureen has done an outstanding job of helping you piece things back
together but given a lot of what you have posted, it's an indication you are
fixing the effects and not the cause.

I am uncertain of what that cause might be, especially because early on
there was an indication of the blaster virus though that seemed to have come
up negative. Regardless, I do think you should run a full virus scan with
an antivirus application with all current definitions.

You asked if you needed to reformat. That's a real iffy question but I note
earlier that a repair install did not resolve the issues, again an
indication of something deeper going on. I can only suggest, you make sure
you have all your data backed up and keep it so because if you continue to
have issues, you may well be headed in that direction. If it becomes
necessary, even if you have a full backup, only restore your data from the
backup. Reinstall the operating system, reinstall your applications,
manually adjust your settings and then restore only your data. Reason
being, if you do a full restore, you likely will also be restoring whatever
caused these issues in the first place.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/


"srobin" > wrote in message
...
> Maureen, thanks again, I was able to access task manager too, but only by
> going to run and typing that command, if i just clik the taskbar and click
> Task Manager, it shuts down again.
>
> Also cant do msconfig commands
>
> so frustrating, why did they have to pick on us
>
>

[Sharon F]

On Sun, 17 Aug 2003 13:00:39 -0700, Michael Solomon (MS-MVP Windows
Shell/User) wrote:

> Maureen has done an outstanding job of helping you piece things back
> together but given a lot of what you have posted, it's an indication you are
> fixing the effects and not the cause.
>
> I am uncertain of what that cause might be, especially because early on
> there was an indication of the blaster virus though that seemed to have come
> up negative. Regardless, I do think you should run a full virus scan with
> an antivirus application with all current definitions.
>
> You asked if you needed to reformat. That's a real iffy question but I note
> earlier that a repair install did not resolve the issues, again an
> indication of something deeper going on. I can only suggest, you make sure
> you have all your data backed up and keep it so because if you continue to
> have issues, you may well be headed in that direction. If it becomes
> necessary, even if you have a full backup, only restore your data from the
> backup. Reinstall the operating system, reinstall your applications,
> manually adjust your settings and then restore only your data. Reason
> being, if you do a full restore, you likely will also be restoring whatever
> caused these issues in the first place.

As you know, Michael, Kelly and Doug have been working very hard on their
blaster cleanup tool. During this time, they are finding some systems that
also have spybot and they suspect it is being piggybacked into the system
via the blaster infection. Knocking out regedit, taskmanager, msconfig seem
to be typical side effects.

The current removal tool on Line 257 at MVP Kelly Theriot's website
addresses all of the variants they've run into so far:
http://www.kellys-korner-xp.com/xp_tweaks.htm

--
Sharon F
MS-MVP/ Windows XP - Shell/User

[Sharon F]

On Sun, 17 Aug 2003 13:00:39 -0700, Michael Solomon (MS-MVP Windows
Shell/User) wrote:

> Maureen has done an outstanding job of helping you piece things back
> together but given a lot of what you have posted, it's an indication you are
> fixing the effects and not the cause.
>
> I am uncertain of what that cause might be, especially because early on
> there was an indication of the blaster virus though that seemed to have come
> up negative. Regardless, I do think you should run a full virus scan with
> an antivirus application with all current definitions.
>
> You asked if you needed to reformat. That's a real iffy question but I note
> earlier that a repair install did not resolve the issues, again an
> indication of something deeper going on. I can only suggest, you make sure
> you have all your data backed up and keep it so because if you continue to
> have issues, you may well be headed in that direction. If it becomes
> necessary, even if you have a full backup, only restore your data from the
> backup. Reinstall the operating system, reinstall your applications,
> manually adjust your settings and then restore only your data. Reason
> being, if you do a full restore, you likely will also be restoring whatever
> caused these issues in the first place.

PS: Doug has created a utility that makes and emergency set of some XP
system tools: http://www.dougknox.com/xp/utils/xp_emerutils.htm

--
Sharon F
MS-MVP/ Windows XP - Shell/User

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Thanks, Sharon.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Sharon F" > wrote in message
...
> On Sun, 17 Aug 2003 13:00:39 -0700, Michael Solomon (MS-MVP Windows
> Shell/User) wrote:
>
> > Maureen has done an outstanding job of helping you piece things back
> > together but given a lot of what you have posted, it's an indication you
are
> > fixing the effects and not the cause.
> >
> > I am uncertain of what that cause might be, especially because early on
> > there was an indication of the blaster virus though that seemed to have
come
> > up negative. Regardless, I do think you should run a full virus scan
with
> > an antivirus application with all current definitions.
> >
> > You asked if you needed to reformat. That's a real iffy question but I
note
> > earlier that a repair install did not resolve the issues, again an
> > indication of something deeper going on. I can only suggest, you make
sure
> > you have all your data backed up and keep it so because if you continue
to
> > have issues, you may well be headed in that direction. If it becomes
> > necessary, even if you have a full backup, only restore your data from
the
> > backup. Reinstall the operating system, reinstall your applications,
> > manually adjust your settings and then restore only your data. Reason
> > being, if you do a full restore, you likely will also be restoring
whatever
> > caused these issues in the first place.
>
> As you know, Michael, Kelly and Doug have been working very hard on their
> blaster cleanup tool. During this time, they are finding some systems that
> also have spybot and they suspect it is being piggybacked into the system
> via the blaster infection. Knocking out regedit, taskmanager, msconfig
seem
> to be typical side effects.
>
> The current removal tool on Line 257 at MVP Kelly Theriot's website
> addresses all of the variants they've run into so far:
> http://www.kellys-korner-xp.com/xp_tweaks.htm
>
> --
> Sharon F
> MS-MVP/ Windows XP - Shell/User

[srobin]

Doug, sharon, Maureen, t hanks for all your feedback. I'm tending to believe
Doug is right, I've tried all the fixes, I'v copied and renamed all the
files, they do work, they open that way, but they don't work the way they
should, ctrl-alt-del shuts down, regedit shuts down, all the major commands,
so I'm thinking there may be more wrong of which I have no idea, maybe
another virus. But I'm current on my virus definitions and I've run virus
several times, and according to all the virus fix's that I have run, there
are no idications of the virus in my system. Frustrating to say the least.I
really hate to reformat, but I dont' think I have any recourse. Thanks
again guys, you're doing an awsome job attacking this thing.

[Sharon F]

On Mon, 18 Aug 2003 07:54:54 -0400, srobin wrote:

> Doug, sharon, Maureen, t hanks for all your feedback. I'm tending to believe
> Doug is right, I've tried all the fixes, I'v copied and renamed all the
> files, they do work, they open that way, but they don't work the way they
> should, ctrl-alt-del shuts down, regedit shuts down, all the major commands,
> so I'm thinking there may be more wrong of which I have no idea, maybe
> another virus. But I'm current on my virus definitions and I've run virus
> several times, and according to all the virus fix's that I have run, there
> are no idications of the virus in my system. Frustrating to say the least.I
> really hate to reformat, but I dont' think I have any recourse. Thanks
> again guys, you're doing an awsome job attacking this thing.

Well, at least you have working copies of important tools now.

Current virus definitions: While most of the antivirus companies now do a
wonderful job updating, your protection is only as good as those virus
definitions. You could have the most current definitions and still get
infected with something. New variants are discovered all of the time and
it's a race to discover these in a timely manner and then get updated
definitions out to customers.

This is what is happening with Blaster. Doug and Kelly have noticed that
several machines are showing up with spybot or a nimda type of thing
present to. They are working diligently trying to keep up with all the
variations that are appearing. You can bet your bottom dollar the antivirus
companies are doing the same.

In the middle of an "epidemic" like this, it's possible to overlook the
fact that you may just have some more mundane problem with your XP setup.
Example, I was getting slow response calling up some of the system tools a
little while ago. I run a pretty streamlined setup but spoiled myself with
a copy of StylesXP. I'm not going to say that this is a problem with every
system but on *my* setup, uninstalling (and giving up my extra colors
<sniff>), got rid of that slow response. Tools I had problems with: msinfo,
msconfig, task manager, notepad (!), help and support and a few other
basics. All are working fine now.

You experienced the disappearance of System Restore and fixed it by
repairing the system control panel and running sr.inf. Perhaps there is
other damage clouding the issues at hand. Would suggest, running as
streamlined as possible. Disable extras for now. Use programs as you need
them. Do some basic maintenance: deleting temp files, running chkdsk and
defrag. You may find that at least some of the troubles you're experiencing
will subside.

Meanwhile, keep updating your definitions and checking the system
vigilantly.

PS: I also agree with Michael and Doug. It certainly sounds like something
"bit" your setup due to the symptoms (ctrl+alt+del should not shutdown an
XP system unless you've set this up with an XP tweaking program!) but
unfortunately, short of a rebuild on the system (something I *don't* like
to recommend if it can be avoided) I have nothing else to suggest.

I know Michael and a few others are watching this thread closely and if
they have more info for you, they will post it. If I think of anything,
I'll do the same.

--
Sharon F
MS-MVP/ Windows XP - Shell/User