Results 1 to 13 of 13
  1. #1
    Star Lounger
    Join Date
    Jan 2001
    Location
    Michigan - U.S.A.
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    XP Restore Points (XP Pro SR2)

    I've done a search and didn't see this answered. Hope it's not a duplicate. A few weeks ago I noticed that all my restore points were gone. I kept tabs on it and noticed that they were disappearing every few days. A check of the system event log (eventvwr.msc /s) tied the disappearances to an SR error '0xC000003A' related to my flash drive. I finally determined that every time I pull out the flash drive, it kicks an SR error and wipes out all restore points. Of course I never go through the 'safe removal' dance, I just pull it out. That never was a problem before on any computer. Now it's a problem. I can't find any reference to this anywhere. I did reinstall SR, but that was no help. Does anyone here have any ideas on this?
    Keith

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,588
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: XP Restore Points (XP Pro SR2)

    If the error from the event log please post the whole event entry. Was this after an specific changes to your system? Is your system up-to-date with patches?

    Joe
    Joe

  3. #3
    Uranium Lounger viking33's Avatar
    Join Date
    Jun 2002
    Location
    Cape Cod, Massachusetts, USA
    Posts
    6,308
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: XP Restore Points (XP Pro SR2)

    This probably doesn't apply to your case but there is a known issue when dual booting XP and Vista. When you boot into XP it will wipe out the Restore Points in Vista, unless you put in the fix from Microsoft.

    KB926185
    BOB
    http://lounge.windowssecrets.com/S/flags/USA.gif http://lounge.windowssecrets.com/S/f...sachusetts.gif


    Long ago, there was a time when men cursed and beat on the ground with sticks. It was called witchcraft.
    Today it is called golf!

  4. #4
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    When you add a drive/partition, I don't know what you mean with "flash drive" if it's only a small USB memory stick (but they do get bigger) or something else, SR will be enabled on it by default.

    That is: any drive or partition you add will have SR enabled, until you disable SR on that drive/partition.

    It is not good to let SR monitor external drives, and why the OS enables SR by default on non-system drives is beyond me.

    If a change is made to a monitored file (on that drive) when it's not connected, there will be an inconsistency in SR's log, RP's becomes corrupt and purged.

    If you do not have enough space on a non-system drive, such as described above, SR will also be suspended; such as when (quote MSFT):

    A drive that is not a system drive that has System Restore enabled on it has reached less than 50 MB of free disk space.
    A copy, delete, modify operation was made to a file that is monitored by System Restore on such drive.

    So, have look at SR settings.

    Safe removal is a different matter, but I always use it, since I value my data.

  5. #5
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    Hello Bob,
    It is well known problem since long before Vista, and it is exactly similar to monitoring external drives, i.e. something happens on a drive when SR isn't "watching".

    It could happen on dual 2000-XP, dual XP-XP and as you mention dual XP-Vista.

    I mentioned it over here in Vista forum <post:=710,168>post 710,168</post:>, but you dual booting guys know this very well, I understand. <img src=/S/smile.gif border=0 alt=smile width=15 height=15>

  6. #6
    Star Lounger
    Join Date
    Jan 2001
    Location
    Michigan - U.S.A.
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    This is the error received in the event log: "The System Restore filter encountered the unexpected error '0xC000003A' while processing the file 'MEMOREX UFD (F)' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume." It obviously thinks it is (or should be) monitoring the memory stick.
    I thought you had the answer, Argus. But when I checked the SR setting with the memory stick in, it shows monitoring on the C: drive only. This occurs with any memory stick, but ONLY on this computer. By the way, this particular 500 MB stick has 375MB free and the computer is current on all updates except SP3. Strange one, isn't it?

  7. #7
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    I see. But no matter how much free you have on a stick/another partition/non-system drive you don't want it monitored.

    Since you lost all your RPs earlier, and even purged them, a little test could perhaps be done. You do know that if you disable SR in Control Panel System you will purge all RPs. You could (if you don't need the RPs you have now):

    Disable SR, reboot, enable SR and check the settings, start using your external memory and see what happens (check settings etc.).

    It could also be, in rare cases, some other program such as anti-virus that has modified etc a monitored file, and as I said, when inconsistency occurs, the RPs get corrupt, since they are all part of a long chain and all must be working; in some cases SR purges them, in other cases the user must do it.

    A sync tool (which seems OK to have on a USB memory), could be such a program, some file is changed when you "sync" the USB memory on another PC.

  8. #8
    Star Lounger
    Join Date
    Jan 2001
    Location
    Michigan - U.S.A.
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    No luck. I disabled SR and rebooted. Then I stuck in the memory stick and turned on SR. With the stick in, it still only showed that it was monitoring C: - not the stick. I pulled out the stick and instantly got another SR error. It acts like it's monitoring the stick somehow, but it doesn't show. Hey, this is supposed to be the GOOD version of Windows. <img src=/S/scratch.gif border=0 alt=scratch width=25 height=29>

  9. #9
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    Well, <img src=/S/smile.gif border=0 alt=smile width=15 height=15> I didn't say you should have the USB memory connected when you enabled SR first time after the reboot (i.e. you directly gives it an opportunity to monitor it, if that is what it does), just enable SR with what's there, i.e. HDDs and their partitions, and then use the memory.

    You said earlier it happens with all kinds of USB memories but on this PC only. Now that isn't necessarily as odd as one might think. Does this PC have, for example, a different anti-virus program compared to other PCs you use?

    If you redo the test: do you experience the error and does SR work if you use "Safe removal" in the tray?

    I haven't stumbled on a PC that happen to monitor USB sticks (as it seems), so I don't know if they show up correctly in System Properties' SR tab under Available drives all the time. There are some things that could be tested there also.

    But, since data change is critical for SR's working, and corrupt or suddenly changed data that is not written correctly can happen if one just pulls the stick, you could test the above "Safe removal", especially since you mentioned that you get it all the time you do that. If it works, or even if not, we'll see if it's possible to move the USB memory out of SR's "radar", there are some other tricks.

    The first RP from the above will now be corrupt, so either they are purged or you could do it to start over if you like, but it follows FIFO as you know anyway, so if you don't need the first one it'll be replaced at some time. But I would start over.

  10. #10
    Star Lounger
    Join Date
    Jan 2001
    Location
    Michigan - U.S.A.
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    I connected it when I enabled SR, hoping that it would SHOW that it was monitoring the memory stick on the SR tab- and I could then I could actually turn the monitoring OFF. No such luck. It shows that it's monitoring C: only.
    I thought things would be fine if I removed the stick 'properly', but still no luck. I just did that, and it deleted my one restore point, this time with a slightly different error code - '0xC0000368' instead of the usual '0xC000003A' - and informed me that it had stopped monitoring the volume. <img src=/S/brickwall.gif border=0 alt=brickwall width=25 height=15>
    It seems like there's a problem with either SR (which I reinstalled) or with the monitoring report on the SR tab, if that's a separate function. If SR is monitoring the memory stick, as it apparently is, why doesn't the SR tab show it? Ah, it's a conspiracy...
    Is there a good way to decipher what those error codes mean?

  11. #11
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    Hello Keith,
    OK, I understand. It was just a thought that not using the stick when enabling would make it not see it/ignore it.

    I was thinking when I said I hadn't seen a monitored USB stick and don't know if they "show up correctly" in the SR settings dialog that: as you know it can happen that an USB memory for some reason is invisible to the explorer shell but visible in Disk management (due to drive letter confusion), something a long those lines.

    The error code may change but it indicates a corrupt RP, as you now very well know; a sudden change creates a mismatch. You may have seen on the net that this error "The System Restore filter encountered the unexpected error ..." may come in several flavours for several file types and drives, but I hadn't seen a USB mentioned.

    There is a MSFT KB article for a non-public hotfix. A post-SP2 hotfix as it seems. However, it doesn'r mention removable media such as USB, external drives per se.

    Someone might now suggest that you upgrade to SP3, which may very well solve your problem. But that is something we don't know, and then you have moved to SP3 to "no use", at least perhaps at an inconvenient time, since it may need some preparation. I say that because we know via MSFT documentation which security updates, other updates, added features that are included in a SP, but there is very little information about included hotfixes. Sometimes they don't make it into the SP.

    MVP Bert Kinney has a site with lots of information about SR in XP, Vista etc. http://bertk.mvps.org

    On searching the net you may have seen this short question and reply at PCreview: System Restore filter error '0xC000003A' processing '_filelst.cfg'

    The reply is from Ramesh Srinivasan, another MVP with lots of knowledge about Windows in general. He just concludes that the RP is corrupt, but points to a troubleshooting list. You will also see plenty of them at the other one, Bert Kinney, who focus on SR.

    The Microsoft KB article for the hotfix is: Hard disk volume monitoring may stop in Windows XP - 888402

    As you know, hofixes are for one problem only, the one described in the article. Period. <img src=/S/smile.gif border=0 alt=smile width=15 height=15>

    However, they mention 0xc000000d or 0c000007f, but as you may see here at Kinney's: “The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'SAVRT' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.”

    We have another error code, and he points to the MSFT KB also. So if your further troubleshooting don’t take you anywhere, perhaps MSFT support can help you. It may cost some, I don't know, since: "If additional issues occur [...] The usual support costs will apply to additional support questions ...".

    It seems like there are three variables in the error: error code, file name and volume name that can change quite a bit, even though MSFT only mentions two error codes.

    But if it was me I would do some general troubleshooting, perhaps removing the USB memories from the Device manager, disable & enable SR to start over.

    Do you have different anti-virus on this PC compared with the others?

  12. #12
    Silver Lounger
    Join Date
    Oct 2002
    Posts
    1,993
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    "Is there a good way to decipher what those error codes mean?"

    BTW
    0xC0000368, the new one.
    STATUS_MOUNT_POINT_NOT_RESOLVED

    "The create operation failed because the name contained at least one mount point that resolves to a volume to which the specified device object is not attached."

    0xC000003A, the old one.
    STATUS_OBJECT_PATH_NOT_FOUND

    "{Path Not Found} The path %hs does not exist."

    Windows Error Codes
    2.3 NTSTATUS
    2.3.1 NTSTATUS values http://msdn.microsoft.com/en-us/library/cc704588.aspx

    So it seems it is looking at that USB memory or something is looking at it and SR gets upset. <img src=/S/sad.gif border=0 alt=sad width=15 height=15>

    Do you get them under "sr" or "srservice" as source in Event Viewer?

  13. #13
    Star Lounger
    Join Date
    Jan 2001
    Location
    Michigan - U.S.A.
    Posts
    78
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Restore Points (XP Pro SR2)

    Thank you for taking the time to provide such a very detailed reply, Argus. Great information. It will take me some time to work through all the good leads you've given me (particularly since they actually expect some WORK out of me here at.... work). I'll let you know how things go when I get through it.
    Thanks for clearing up the error messages (and for the link), also. The meanings seem quite similar - pretty much saying the same thing two different ways, although I know there's a subtle difference.
    To briefly answer your questions before I dive into this though, I'm using the same anti-virus (AVIRA) everywhere and all errors appear on the log as "SR".

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •