System Restore MAJOR FAILURES

Discussion in 'Returnil releases' started by StevieO, Jul 16, 2009.

Thread Status:
Not open for further replies.
  1. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    I have reason to believe that, Returnil ( may ) be the culprit in completely wiping ALL the SR points on Vista PC's, at least this one. Not sure about other OS's right now, but i'm sure it didn't happen on XP.

    Recently i encountered what appeared to be a nasty Malware infection https://www.wilderssecurity.com/showthread.php?t=246938 Or it could have been a serious malfunction etc of some kind, either way a full reinstall etc was required to fix it. I tried to first do a SR, but i discovered they had ALL dissapeared ?

    Today i checked the SR points before i enabled Returnil to try out some software, they were ALL in place. Enabled Returnil, installed the software and experimented with it, and afterwards rebooted. On rebooting i decided to check the SR points, and found they had ALL vanished !

    Are you aware of this occurring previously on other peoples PC's ?

    What are your suggestions to sort this out ?
     

    Attached Files:

  2. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi StevieO,
    We are looking into this. For the time being, create Restore Points manually from time to time while RVS protection is off (of course) and see if they are available in the restore point list. Let us know if this resolves the issue temporarily and look for a correction (if required) in the v3 Beta.

    Mike
     
  3. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Coldmoon

    Hi, i have no problems creating Restore Points manually, that's not the issue.

    The fact that ALL the Restore Points are eliminated after using Returnil is.

    Any ideas yet ?

    Thanx
     
  4. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    The issue is being investigated so you will need to be patient while this process runs its course.

    The part about creating manual restore points was a work-around suggestion for you and other readers until we have the issue solved...

    Mike
     
  5. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    One additional point is that the restore points are not gone, just not being displayed properly . As you noted, they are available again once you deactivate RVS.
     
  6. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Hi,

    I wasn't being impatient lol, just wondered how things are progressing !

    Actually my experience is that, the restore points are NOT available again after RVS is deactivated and rebooted !!!

    S
     
  7. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    This will be investigated be sure. In my own testing, the restore points were there, but were not properly offered in the restore point list.

    Mike
     
  8. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Ok, i look forward to the results of your tests.

    Thanx
     
  9. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Hi,

    kcazzie posted this on BBR -

    " Users who are new to Norton Internet Security may not realize that Windows System Restore can fail due to the security feature in Norton that prevents any unauthorized changes to your Norton Product.

    You may receive the message: "Restoration Incomplete. Your computer cannot be restored . . . " when you run Windows System Restore.

    You can perform a System Restore by temporarily turning off this Norton feature. "

    http://www.broadbandreports.com/forum/r22759474-XP-System-Restore

    -

    I don't have NIS but do have AntiVir v9. I have a similar option enabled in it. So i just wondered if there might be any connection with this and the RVS SR problem, or is the RVS issue a completely seperate one ?
     
  10. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Hi, any news ?
     
  11. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi StevieO,
    At this point I do not have an update on this issue. A fix or changes (depending) will be included in a beta build to test when available so please be patient...

    Mike
     
  12. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Oh dear, that's a GREAT shame indeed. I was hoping, as i imagine were others, that this critical issue could be fixed urgently.

    I do understand you have other things you're also attempting to address too.

    So i guess the advice is, NOT to use Returnil with Vista until such a time as you announce it's ok to do so ?

    Hope you get it sorted soon.

    S
     
  13. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    No, that is not what is being said or implied. Corrections for issue reports are updated in the software as soon as possible,; which also includes proper in-house QA. This necessarily means that time will elapse between the report of the issue, its verification in the lab, changes made to the code, testing those changes for quality, and then release to the public for additional testing.

    If you are using a version of Vista that supports imaging (total PC restore) you should schedule regular emergency images and also use the file backup feature which is available on all versions of Vista. One thing to keep in mind is that Windows System Restore points are just as vulnerable to being exploited as is Windows itself and more often than not, malware will target RP's as part of their SOP...

    Mike
     
  14. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Coldmoon

    Good evening Sir.

    Sure i understand about all the required testing etc, that was Never misconscrued.

    As i linked to above, i did have some serious malfunction which at the time appeared to be Malware related, which later turned out to be All FP's. However, something ? happened which required a big fix. SR was not available as previously mentioned, so i had to reinstall.

    But prior to this event, i had felt that Returnil had in some way/s been responsible somehow for interfering with SR, and either deleting them all, or as you suggested, making the OS blind to them. Either way they were not available to me should i need them, and as it turned i did.

    Don't get me wrong, i fimly believe Returnil is a great product, and have recommended it to many people, including corporate. Inspite of this " apparent " shortcoming, i look forward to it's resolution at your earliest convenience, so i am able to use it again with renewed confidence.

    All the best,

    S
     
  15. SurfFoo

    SurfFoo Registered Member

    Joined:
    Aug 19, 2009
    Posts:
    2
    Same thing happens with all flavors of XP when one installs Ram-Drives that are emulating a hard-drive (if a Ram-Drive is used that emulates a removable device/drive then there is no issue with Restore-Points).

    Problem: You can not include "virtual drives" in System Restore!

    There is a fix, if you do not mind mucking-about in the registry. You have to tell System-Restore to ignore the virtual drive like this:

    run: regedit

    Go to:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BackupRestore

    There are 3 keys, and we want "FilesNotToBackup".

    We want to right-click on/in "FilesNotToBackup" and create a new Multi-string. Give it a name you will recognize like "ReturnilVirtualDrive" and enter the value:
    Z:\* /s
    (replace Z with the letter of "your Returnil virtual drive", and also note the space between Z:\* and /s (this is very important!).

    [Note that you can also add specific files and folders here to ignore as well, if you wish]

    Close regedit, and reboot your computer. Now create a new Restore-Point, shut-down and reboot, enjoy your now working System Restore!

    All it takes is one "virtual drive" or Ram-Drive to completely screw-up System-Restore, and you will lose all restore-points [Windows flaw, or feature? LOL! ;) ]

    EDIT: Removed comment about Flash-Drive, because it would not work. When the virtual drive/container is mounted it would still be given a drive letter (unless there was some way to designate it as a removable disk/drive/device).
     
    Last edited: Aug 22, 2009
  16. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    SurfFoo

    Very interesting indeed !

    I'm back on XP now, and even though i'd like to reinstall it, i havn't. Previously on XP i was using a Virtual drive created on my C Drive by Returnil. I'm not sure if this would affect the SR points too ? So unless i hear otherwise i might leave it for now until they get this issue sorted, hopefully VERY soon.

    I wonder how many other people are in trouble with their SR points, but just don't know it o_O Except they will if they need to do a restore, but too late then !

    Thanx for posting the info,

    Regards,

    S
     
  17. SurfFoo

    SurfFoo Registered Member

    Joined:
    Aug 19, 2009
    Posts:
    2
    Well, that's the point see, when that virtual drive mounts, it is going to take a drive letter (if one has not already been assigned) and then starts the trouble.

    Tons of people are affected by this, and most never know it, and the ones that do find that they have no restore-points blame it on a virus/worm/Trojan infection which can and do wipe-out restore-points as well.

    The only way I found out was through my experiences installing and using RamDrives on multiple computers. I had to do a lot of research to find the answer. So far, on two Vista systems I have not had that problem, but I have been using a RamDrive that has the option of "emulating a removable device".

    I have not yet tried Returnil, and have been waiting on the side-lines for long time now waiting for it to grow-up/come of age. In my opinion, it is nearly there. They need to fix this restore-point issue, and the defrag issue (they need a defrag prevention function) as people forget to turn off protection first, and so scramble their drives. Also, containers need to be filled with either random data, or any single character, so that if a container is caught in a drive defrag, the information will not be lost. Instead of deleting information from containers it should be over-written so that there is no free-space in a container at anytime (similar to what TrueCrypt does, but without encryption, or maybe with). Those fixes would take it far enough to get me to use it. Returnil is a great product idea, and one that is desperately needed. Mostly I just hang around and read the latest... In the past I was very involved in helping with various new product developments, but alas... now I am old and tired...
     
    Last edited: Aug 22, 2009
  18. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    SurfFoo

    Thanx for the extra info.

    I presume that the RVS folks have read all this, and are taking it all into account !

    Nice to hear that you were involved in various new product developments, i wonder which ones ?

    What, old and tired, nah you're still interested i can tell. And i'm glad you are otherwise we wouldn't have had the benefit of your very useful revelations about the SR issue.

    Thanx again,

    S
     
  19. listener

    listener Registered Member

    Joined:
    Sep 7, 2009
    Posts:
    4
    I had a similar problem using Truecrypt, I kept loosing all my restore points I just couldn't understand. Turns out it had nothing to do with Truecrypt, Windows was the culprit I did a little research an here is what I found, it has to do with low disk space. Windows in it's great wisdom starts warning you when your disk space falls below 10% (I'm not shure about the number) anyway it will start warning you a few times here again I'm not sure about the number of times but I think It's 10, but the point is that if your disk space (your virtual disk in this case) fall's below a "certain" % and after a certain number of warnings, Windows starts making free space by deleting the restore points. Probably it's the same with Returnil when the virtual disk gets full. By the way I think SurfFoo's suggestion might be a good workaround.
     
  20. MikeRogers

    MikeRogers Registered Member

    Joined:
    Jul 6, 2009
    Posts:
    25
    Just my 2 cents, but WRT SurfFoo's detailed (and much appreciated) info regarding RAM drives, my own XP Home SP3 machine is using a RAM drive (drive R) without causing any system restore problems. I also checked the registry and there's no "FilesNotToBackup" entry for drive R (or any other drive letter, for that matter).

    I also note that the OP states that he was having this problem with Vista and is sure it didn't happen on XP, whereas SurfFoo suggests that the RAM drive problem happens with "all flavors of XP".

    Perhaps the two issues aren't in fact related.

    MikeR
     
  21. listener

    listener Registered Member

    Joined:
    Sep 7, 2009
    Posts:
    4
    Maybe you are right MikeRodgers maybe the two aren't related at all, but let me tell you what happened to me using Truecrypt. I was making 700mb containers (to copy to CD) so when my mounted container K: in my case was getting full if I remember around 630mb windows started warning me about low disk space which I ignored many times, that's when I noticed that I had lost all my restore points. After a couple times I searched for the reason why it was happening and this is what I found. When you run low disk space on whatever mounted volume, if you did not diseable System Restore for that volume's letter at a certain point Windows will start making free space by deleting what it can find that is not necessary in my case it deleted the Restore points on my System partition. It's not because it's a Ram drive or a mounted volume it's because it is getting full. Maybe I'm wrong but to me right now that's the only explanation.
     
  22. listener

    listener Registered Member

    Joined:
    Sep 7, 2009
    Posts:
    4
    Oups I made a mistake, I meant diseable "Low disk space warning" instead of diseable "System restore" and when you diseable Low Disk Space Warning it's for the whole system which is not always a good idea.
     
  23. MikeRogers

    MikeRogers Registered Member

    Joined:
    Jul 6, 2009
    Posts:
    25
    Hi listener. Perhaps your point isn't related to SurfFoo's point.

    First off, my RAM disk (R) is in RAM, not on my C drive. Your Truecrypt container "drive K" is on disk. That's a difference - maybe significant, maybe not. The question seems to be: if your (virtual) K drive is getting full, would Windows try to free up space on your C drive, since there may still be loads of free space on C? I can't say one way or the other but I've completely filled up my RAM disk on many occasions with no ill effect.

    MikeR
     
  24. listener

    listener Registered Member

    Joined:
    Sep 7, 2009
    Posts:
    4
    When I searched for a solution to my problem that's an article that explained what I think was happening, and the problem was solved by disabling" Low disk space warning" which by the way is not always a good solution but it worked for me, I don't loose my restore points anymore and I can fill my Truecrypt containers to the top. That happened quite a while back and I didn't remember all the technical details. But then again I may be completely off target because nobody actually mentioned receiving Low disk space warning signals.

    http://support.microsoft.com/kb/301224
     
  25. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    listener + MikeRogers

    Thanx for your input on this.

    No further input from RVS though ?


    I found this useful, and have made the change anyway, even though i havn't re-installed RVS.

    Turn Off the Low Disk Space Warning

    Intended For

    Windows XP
    Windows 98

    When Windows detects that one of your hard drives has too little free space, a warning appears offering to run the "Disk Cleanup" utility. Here's how to turn off this message:

    Windows XP

    * Run the Registry Editor (REGEDIT.EXE).
    * Open HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ Explorer.
    * If it's not there, create a DWORD value and call it NoLowDiskSpaceChecks.
    * Double-click on NoLowDiskSpaceChecks, and enter the value 1, and press OK.

    http://www.annoyances.org/exec/show/article03-102
     
Thread Status:
Not open for further replies.