System restore only works in safe mode

[rocker11]

For some reason I am only able to restore my computer to an earlier date when I am in Safe Mode. Before discovering that Safe Mode would work I did some troubleshooting. First, I turned System Restore off and then on, but that didn’t help. Second, I did a malware scan, which turned up no problems. Third, I did a scan with HijackThis, but I didn’t find anything that appeared to be a problem. Then I finally tried doing a restore in Safe Mode, and I found that the restore succeeded. I tried again several hours later, in normal mode not safe mode, and the restore failed. I returned to Safe Mode, and tried another restore, which succeeded again.

So the simplest statement of the problem is that System Restore only works in Safe Mode. Any idea why this happens and what I can do to fix it?

Here is some information on my computer:
Dell Dimension 8200
Windows XP Home, SP3
Pentium 4 CPU, 2.26 GHz
1064 MB RDRAM
80 GB master hard drive, 44 GB free, Western Digital WD 800, WD Caviar drive, 7200 rpm, Ultra ATA
Seagate 500 GB slave internal hard drive, 348 GB free, 7200 rpm, PATA/100 interface
Seagate Free Agent Pro 500 GB USB external hard drive, 36 GB free
BenQ DW 1640 DVD/CD read/write drive
NVIDIA GeForce4 MX 420 video card
StarTech combo USB/1394 PCI card

Thanks

rocker11

 

[superty12]

HijackThis Log

Third, I did a scan with HijackThis, but I didn’t find anything that appeared to be a problem.

Please post the HijackThis log.

 

[rocker11]

Here you go. Since I am a newby on this site, I am not allowed to post links. I have replaced the "http:" with "xhttpx".

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:03 AM, on 9/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SecCopy\SecCopy.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = xhttpx//my.earthlink.net/channel/START
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Second Copy 2000] "C:\Program Files\SecCopy\SecCopy.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - xhttpx//update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1249200515078
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - xhttpx//update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1249204197671
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - xhttpx//platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - xhttpsx//rsvpn.raytheon.com/dana-cached/setup/JuniperSetupSP1.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe


Thanks,

rocker11

 

[superty12]

You're right

You're right. Nothing out of the ordinary here. What have you done to your system?!!!! Post the recent changes you did before this problem started happening.

 

[rocker11]

There isn't a lot to say about recent history. I did a clean reinstall of the entire system on August 1, with the reinstallation of various applications occurring over the next few days. I have done clean reinstalls 8 to 10 times over the past 5 years, so I think I can do them correctly. But each one is always a bit different.

This last reinstall seemed to proceed according to plan, and I generated multiple restore points as I went along so that if one step went badly I wouldn't have to go all the way back to the beginning. As I did on the last few reinstalls, I changed the logical letters of some of my drives to be the same as they were prior to the reinstall, rather than using the drive letters that are assigned as the reinstall proceeds. This hasn't been a problem in the past, but there's always a first time. I always do all of the Microsoft updates to the system as well as Office as I do the reinstall, and that was also the case this time.

Nothing happened between the time of the reinstall and the day I first noticed the system restore problem. On that day I had tried to update my iTunes to the latest version. After downloading the software, the installation was taking a very long time, and Task Manager showed that the CPU utilization was 100 %. I waited and waited and finally decided to cancel the update.

Then I decided to do a restore, to get rid of whatever had been downloaded from Apple. I tried a restore to the preceding evening. The restore process appeared to proceed normally, as in other restores I had done in the past. But after restarting and reopening Windows and my desktop, a System Restore window appeared with the following message: “Restoration Incomplete. Your computer cannot be restored to: (it indicated the date and event I attempted to restore to). No changes have been made to your computer. To choose another restore point, restart System Restore.” I tried numerous restore points going back to August 5, which was just a few days after I did the complete system reinstall. The only restore points that existed at that time were the daily System Checkpoints. While I tried these various restores, occasionally, but not always, an error window appeared just before the computer shut down while it was doing the restore. This message appeared only for a second, so at first I wasn’t able to read it. I finally captured it with my digital camera. Here is what it said: “point32.exe – DLL Initialization Failed. The application failed to initialize because the window station is shutting down.”

So that's my story. Maybe the iTunes adventure was the problem. Otherwise, it must have been something in the reinstall.

Any suggestions?

Thanks again,

rocker11

 

[rf6647]

Computer shutdown is often caused by driver conflicts. However, point32.exe is most likely for the MS IntelliMouse - hard to implicate this as the faulty driver. Safe Mode does not load all the drivers and services that are used in normal mode. Ordinarily, the latest add to the hardware or software is most suspect.

In safe mode, RAM usage is different from normal Windoz. Memtest86 can be used to test RAM. One pass through the test is good enough by me, rather than the "7 times" saw.

Since you were able to turn off monitoring of the hard drives from System Restore, this forced a rebuild of the data base and removed corruption of this from the suspect list.

For the inability to gain access to control system restore, I used msconfig to clear the load system services which forced the monitor for hard drives to be turned off and all restore points were cleared. KB310560 source for this procedure.

 

[CAMusing]

Your antivirus running may prevent a system restore especially if you have Norton.

 

[LookinAround]

1) Check if your System Restore service is running during normal vs safemode startup
> Click Start->Run, enter services.msc
> Scroll down to System Restore. Is Status= Started???

2) Just what error message / what happens when you try running it in normal startup??