Unable to create Restore Points

[Journstyx]

Hello all,

I run Windows 7 (64 bit).
Since about 3 weeks I'm getting Blue Screens Of Death. When trying to restore to a previous point, using the Windows program it gave a pop up referring to a not properly functioning Volume Shadow Storage (error code: 0X8004231F). I looked around the internet and came across Restore Point Creator. I installed the program and the first time I ran it I was able to create restore points. After another BSOD, it started giving messages that 'a program crash that shouldn't happen on a proper working Windows installation did occur' and than it would open my browser. That opened up Tom's page with a message what could be the problem and I should install Windows Repair 3.4.3. I've done so and after installing, ran the program. I followed all the steps, including the step that creates a  Registry backup. By default it runs fallback backup. After adjusting the settings and chosing VSS_7-8-2008_2012_64.exe to have Volume Shadow Storage do the backup it comes back with a message 'failed'. It says 'VSS-7-8, etc' isn't running. Check Log_VSS.txt to view any errors. I looked at the topics on Volume Shadow and came across a lot of different issues. Since I'm not a big computer wizard, I'm not sure waht to do. I'm sure there are logs that I could include in my messages, but I first need to know where to look and find them. I appreciate your help. As the above refers to a log_vss. txt where do I find this? What other logs can I include for you guys to take a look at? The BSOD had several different causes; one of them being MyFilter.sys issues. In short I hope there's some of you out there that can help me get started in solving the problems and guide me through the process.  I look forward to your input. Journstyx

[Samson]

log_vss. txt will be in the registry backup folder for each backup made/ attempted.....Unless you have changed the location you will find them at C:\RegBackup   

[Boggin]

Can you download BlueScreenView and post its reports http://www.nirsoft.net/utils/blue_screen_view.html

Some more that may help with VSS -

http://blogs.technet.com/b/askcore/archive/2012/04/29/how-to-vss-tracing.aspx

https://msdn.microsoft.com/en-us/library/windows/desktop/dd765233(v=vs.85).aspx

Shane won't be back until at least Monday to help you with this problem.

[Journstyx]

Hello all, thanks for the first feedback.  I'll check your suggestions asap and hope to  post some results . Journstyx

[PeterPotus]

Windows Vista - 2.99 Meg RAM- MSI Laptop - Pentium 2 Dual T2410 2.0GHz
Yesterday I had a problem of Free Disc Space mysteriously disappearing.
So I bought Windows Repair Pro and ran it in Safe Mode. I ran only 13 of the repair items as recommended by Spybot.
Now I still have my original problem but I cannot work around it as I can no longer create a restore point and therefore cannot do a Disc Cleanup which I have been doing every few days for weeks.
Having bought the Pro edition I selected the 2 options to run after I did the 2nd Repair run.
The Pro Disc Cleanup inclusion promises a lot but I can't actually get it to do anything.
When I emailed Shane he said to do a full repair in safe mode. Sect 5 will not create a restore point so that is not an option.
Finally I gave up and did a restore of the registry back-up but I still cant create a restore point or do a disc cleanup.
I need help please.
Regards

[Boggin]

Windows Vista - 2.99 Meg RAM- MSI Laptop - Pentium 2 Dual T2410 2.0GHz
Yesterday I had a problem of Free Disc Space mysteriously disappearing.
So I bought Windows Repair Pro and ran it in Safe Mode. I ran only 13 of the repair items as recommended by Spybot.
Now I still have my original problem but I cannot work around it as I can no longer create a restore point and therefore cannot do a Disc Cleanup which I have been doing every few days for weeks.
Having bought the Pro edition I selected the 2 options to run after I did the 2nd Repair run.
The Pro Disc Cleanup inclusion promises a lot but I can't actually get it to do anything.
When I emailed Shane he said to do a full repair in safe mode. Sect 5 will not create a restore point so that is not an option.
Finally I gave up and did a restore of the registry back-up but I still cant create a restore point or do a disc cleanup.
I need help please.
Regards

It's best to open your own thread for your problems as the cause is different to the OP's because of his BSODs and different solutions will be required.

It's standard forum practice to open your own thread rather than hijack someone else's to avoid confusion as to the advice given and for who.

[Journstyx]

Hello Boggin, Samson and all,

Here's the Blue Screen Views file. It's strange that this latest BSOD log is dated August 12th, but I've experienced it various times after this date. Anyway..here's the file:

081215-66050-01.dmp   12-8-2015 17:33:01   PAGE_FAULT_IN_NONPAGED_AREA   0x00000050   fffff8a1`2833e689   00000000`00000000   fffff880`011ea678   00000000`00000005   ntoskrnl.exe   ntoskrnl.exe+748c0   NT Kernel & System   Microsoft® Windows® Operating System   Microsoft Corporation   6.1.7601.18933 (win7sp1_gdr.150715-0600)   x64   ntoskrnl.exe+748c0               C:\windows\Minidump\081215-66050-01.dmp   4   15   7601   280.440   12-8-2015 17:47:50   

Details:

Not sure how to copy the window below in the overview of Blue Screen View. There's several display options, but how do I copy those and paste them here?

P.S. I also ran a program called Who Crashed. This program also reported August 12th as last BSOD, but it specifically named MPFilter,sys as the culprit module:

Its details:

crash dump file: C:\windows\Minidump\081215-66050-01.dmp
This was probably caused by the following module: mpfilter.sys (0xFFFFF880011EA678)
Bugcheck code: 0x50 (0xFFFFF8A12833E689, 0x0, 0xFFFFF880011EA678, 0x5)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\windows\system32\drivers\mpfilter.sys
product: Microsoft Malware Protection
company: Microsoft Corporation
description: Microsoft antimalware file system filter driver
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
 

I've also found the Regbackup files. Do you want me to include its latest findings in here as well?

Look forward to your input.
 
Journstyx

[Samson]

Attach the most recent log_vss. txt file if VSS is still failing, this will give Shane an idea of what is going on there. He will probably get back to you on the BSOD crashes too.

[Journstyx]

Thanks Samson. I've attached the log_vss.txt file. I'll await further feedback. Regards, Journstyx.

[Samson]

Thanks Samson. I've attached the log_vss.txt file. I'll await further feedback. Regards, Journstyx.

I have seen this error from VSS (using Macrium Reflect) on a friend's machine. Here is what Macrium said about it.

"The windows snapshot component VSS will fail if a disk with a non standard sector size is attached to your system, even if this disk is either being backed up or used to store the image files. This can be an internal disk or one connected by USB or eSata."

Run 'System Information' ('All Programs' > 'Accessories' > 'System Tools' > 'System Information').
Expand the Components->Storage->Disks node, and scroll down the list of disks, looking for any that have a Bytes/Sector value not equal to 512.

Instructions above are for XP, but should be similar location in Win 7.

[Journstyx]

Hello samson, I've got 2 external harddisks connected that can't be switched off. I'll check your suggestion to see what it says.  Maybe disconnecting the 2 harddisks and then try Vss again? I believe I already tried this, but I'll follow your instructions first. I'll report back soon. Journstyx.

[Journstyx]

Hello Samson, needed to do some digging as my program is in Dutch, but I found what you were referring to.
There are 4  USB related disks/usb storage devices that don't have the bytes/sector value of 512: see attached jpegs. What should I do next?

[Samson]

Those look like multi card readers. is that right?

How about the 2 external harddisks, can you find them and check Bytes/ Sector for each.

[Journstyx]

Hello Samson,

That's correct about the multicard readers. The 2 external hard disks attached have the Bytes/Sector 512.
What should I do next?

Journstyx

[Samson]

I had hoped that would have shown us the reason for the error, clearly not. 

Sit tight, Shane will be around either later today or tomorrow and he will be able to give some more help.
At least by doing all the above he will now have more info to work with 

He can also look into your BSOD crashes too.

[Journstyx]

Thanks Samson for your help sofar. It's much appreciated. I'll await feedback from Shane. Thanks! Journstyx 

[Journstyx]

Hello all,

Any suggestions yet, as what I can do next? I appreciate your input.
Reagrds, Journstyx

[Samson]

Shane is a busy guy, but he'll get back to you.

[Journstyx]

Hello all,

I'm still in the dark as to the BSOD and restore points. I appreciate hearing from Shane to see if he can help me out. Please advise,
Journstyx 

[Julian]

Hello all,

I'm still in the dark as to the BSOD and restore points. I appreciate hearing from Shane to see if he can help me out. Please advise,
Journstyx

hmmm so lets see on your restore point issue can you run in an elevated admin command prompt

Code: [Select]

vssadmin list providers and

Code: [Select]

vssadmin list writers i need to know what both of those commands say.
shoot while at it

Code: [Select]

vssadmin list shadows /for=c:
here this will show me the usage the allocation and the maximum of the storage:

Code: [Select]

vssadmin list shadowstorage /on=c:
now here is the big command to delete all your shadows at once instead of using disk cleanup.

Code: [Select]

vssadmin delete shadows /for=c:now if these shadow copies are getting out of hand and causing issues i want to really know the writers and providers.
let me know
thanks,
Julian

[Journstyx]

Hello Julian,

Thanks for getting back to me. I'm including a screen shot and results from the following:
vssadmin list providers
vssadmin list writers
vssadmin list shadows /for=c:
vssadmin list shadowstorage /on=c:

I haven't done the delete one yet, so you can see the results first.
Look forward to hearing from you again.
Journstyx

[Julian]

Turn off system restore then turn it back on your writers are gone.

[jraju]

Hi, Samson,
                        The use of the program of sys res creator, would be the cause in the first instant. I suppose, the issue is a memory related. Using of third party programs, without knowing what it does to the page system file may be the point to look at.
                                   Normally chkdsk /f/r would be ideal in case of BSOD from the disk ,in the command prompt.

[Journstyx]

Hello Julian,

I need to do that later tonight when I get back.
Do I need to exercise the vssadmin delete shadows /for=c: first and then turn off and on System Restore?
What do I do after this? Try creating a new restore point?
Journstyx

[Julian]

Hello Julian,

I need to do that later tonight when I get back.
Do I need to exercise the vssadmin delete shadows /for=c: first and then turn off and on System Restore?
What do I do after this? Try creating a new restore point?
Journstyx

you could and after yes create a restore point.