System restore only works in safe mode

By rocker11
Sep 27, 2009
  1. For some reason I am only able to restore my computer to an earlier date when I am in Safe Mode. Before discovering that Safe Mode would work I did some troubleshooting. First, I turned System Restore off and then on, but that didn’t help. Second, I did a malware scan, which turned up no problems. Third, I did a scan with HijackThis, but I didn’t find anything that appeared to be a problem. Then I finally tried doing a restore in Safe Mode, and I found that the restore succeeded. I tried again several hours later, in normal mode not safe mode, and the restore failed. I returned to Safe Mode, and tried another restore, which succeeded again.

    So the simplest statement of the problem is that System Restore only works in Safe Mode. Any idea why this happens and what I can do to fix it?

    Here is some information on my computer:
    Dell Dimension 8200
    Windows XP Home, SP3
    Pentium 4 CPU, 2.26 GHz
    1064 MB RDRAM
    80 GB master hard drive, 44 GB free, Western Digital WD 800, WD Caviar drive, 7200 rpm, Ultra ATA
    Seagate 500 GB slave internal hard drive, 348 GB free, 7200 rpm, PATA/100 interface
    Seagate Free Agent Pro 500 GB USB external hard drive, 36 GB free
    BenQ DW 1640 DVD/CD read/write drive
    NVIDIA GeForce4 MX 420 video card
    StarTech combo USB/1394 PCI card


  2. superty12

    superty12 TS Enthusiast Posts: 413

    HijackThis Log

    Please post the HijackThis log.:)
  3. rocker11

    rocker11 TS Rookie Topic Starter

    Here you go. Since I am a newby on this site, I am not allowed to post links. I have replaced the "http:" with "xhttpx".

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:02:03 AM, on 9/26/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Norton Internet Security\Engine\\ccSvcHst.exe
    C:\Program Files\Norton Internet Security\Engine\\ccSvcHst.exe
    C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
    C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\SecCopy\SecCopy.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = xhttpx//
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\\IPSBHO.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\\coIEPlg.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Second Copy 2000] "C:\Program Files\SecCopy\SecCopy.exe"
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - xhttpx//
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - xhttpx//
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - xhttpx//
    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - xhttpsx//
    O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\\coIEPlg.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\\ccSvcHst.exe


  4. superty12

    superty12 TS Enthusiast Posts: 413

    You're right

    You're right. Nothing out of the ordinary here. What have you done to your system?!!!! Post the recent changes you did before this problem started happening.
  5. rocker11

    rocker11 TS Rookie Topic Starter

    There isn't a lot to say about recent history. I did a clean reinstall of the entire system on August 1, with the reinstallation of various applications occurring over the next few days. I have done clean reinstalls 8 to 10 times over the past 5 years, so I think I can do them correctly. But each one is always a bit different.

    This last reinstall seemed to proceed according to plan, and I generated multiple restore points as I went along so that if one step went badly I wouldn't have to go all the way back to the beginning. As I did on the last few reinstalls, I changed the logical letters of some of my drives to be the same as they were prior to the reinstall, rather than using the drive letters that are assigned as the reinstall proceeds. This hasn't been a problem in the past, but there's always a first time. I always do all of the Microsoft updates to the system as well as Office as I do the reinstall, and that was also the case this time.

    Nothing happened between the time of the reinstall and the day I first noticed the system restore problem. On that day I had tried to update my iTunes to the latest version. After downloading the software, the installation was taking a very long time, and Task Manager showed that the CPU utilization was 100 %. I waited and waited and finally decided to cancel the update.

    Then I decided to do a restore, to get rid of whatever had been downloaded from Apple. I tried a restore to the preceding evening. The restore process appeared to proceed normally, as in other restores I had done in the past. But after restarting and reopening Windows and my desktop, a System Restore window appeared with the following message: “Restoration Incomplete. Your computer cannot be restored to: (it indicated the date and event I attempted to restore to). No changes have been made to your computer. To choose another restore point, restart System Restore.” I tried numerous restore points going back to August 5, which was just a few days after I did the complete system reinstall. The only restore points that existed at that time were the daily System Checkpoints. While I tried these various restores, occasionally, but not always, an error window appeared just before the computer shut down while it was doing the restore. This message appeared only for a second, so at first I wasn’t able to read it. I finally captured it with my digital camera. Here is what it said: “point32.exe – DLL Initialization Failed. The application failed to initialize because the window station is shutting down.”

    So that's my story. Maybe the iTunes adventure was the problem. Otherwise, it must have been something in the reinstall.

    Any suggestions?

    Thanks again,

  6. rf6647

    rf6647 TS Maniac Posts: 829

    Computer shutdown is often caused by driver conflicts. However, point32.exe is most likely for the MS IntelliMouse - hard to implicate this as the faulty driver. Safe Mode does not load all the drivers and services that are used in normal mode. Ordinarily, the latest add to the hardware or software is most suspect.

    In safe mode, RAM usage is different from normal Windoz. Memtest86 can be used to test RAM. One pass through the test is good enough by me, rather than the "7 times" saw.

    Since you were able to turn off monitoring of the hard drives from System Restore, this forced a rebuild of the data base and removed corruption of this from the suspect list.

    For the inability to gain access to control system restore, I used msconfig to clear the load system services which forced the monitor for hard drives to be turned off and all restore points were cleared. KB310560 source for this procedure.
  7. CAMusing

    CAMusing TS Enthusiast Posts: 179

    Your antivirus running may prevent a system restore especially if you have Norton.
  8. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    1) Check if your System Restore service is running during normal vs safemode startup
    > Click Start->Run, enter services.msc
    > Scroll down to System Restore. Is Status= Started???

    2) Just what error message / what happens when you try running it in normal startup??
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...