System Restore will not work

Hi, I hope someone can help me or point me in the right direction.

I'm trying to fix a PC for a friend of mine which runs Win ME.

The machine will start in both normal and safe modes, but the mouse won't
operate in normal mode, and it exhibits some strage behaviour.

So, I booted into safe mode, ran a virus scan / adaware and removed over 200
viruses and around 90 instances of spyware. Thinking that would solve it, I
rebooted but still no joy.

Then, I tried a system restore, but system restore says the machine needs to
be restarted before it can work - so I've looked this up in the KB and done
everything it says there - renamed the wininit.ini file to wininit.xxx, ran
scanreg /fix - but still nothing.

THe whole system basically locks up on normal boot, and just about works in
safe mode.

Of course, its not backed up and the USD ports wont work in safe mode so I
can't get any data off it - as I'm tempted to format the thing and start
afresh.

Any suggestions before I do that?

Mike
Fri Mar 18 08:33:54 CST 2005

Matt,

System Restore problem:

Check that you don't have a wininit.ini file in your Windows folder. If
you do, rename this to wininit.old and retry System Restore. If this works
then you possibly have a program that creates a wininit.ini file each time
you boot your system. One known example is tgcmd.exe, another is a
program called "ACCESS DENIED". If you have tgcmd.exe I understand that
disabling it in MSConfig | Startup will have no adverse effect on your
system but enable you to use System Restore. Likewise ACCESS DENIED
needs to be "switched off" whilst using SR to either create or restore to
a previous checkpoint. McAfee's Spam Killer also seems to create a new
wininit.ini file each time the system is booted. See also MS KB 274092 -
"Error Message: System Restore Cannot Run Until You Restart the Computer"
(http://support.microsoft.com/?kbid=274092).

If this isn't the reason for your problem then try running
SCANREG /FIX
from a command prompt such as Start | Run. Note that the system will
re-boot so don't have any applications open when doing this. I suggest
this because the same message is also displayed when the registry has been
corrupted in some way. scanreg /fix attempts to repair that damage.

Hopefully one or the other will solve your problem and allow you to create
a manual check point. If so then please continue with the rest of the
test.

If however you find that you keep getting a wininit.ini file created each
time you boot your system another known cause is due to having unwanted
malware but hopefully we won't have to go down that path.
--
Mike Maltby MS-MVP
mike.maltby@gmail.com


Matt <Matt@discussions.microsoft.com> wrote:

> Hi, I hope someone can help me or point me in the right direction.
>
> I'm trying to fix a PC for a friend of mine which runs Win ME.
>
> The machine will start in both normal and safe modes, but the mouse
> won't operate in normal mode, and it exhibits some strage behaviour.
>
> So, I booted into safe mode, ran a virus scan / adaware and removed
> over 200 viruses and around 90 instances of spyware. Thinking that
> would solve it, I rebooted but still no joy.
>
> Then, I tried a system restore, but system restore says the machine
> needs to be restarted before it can work - so I've looked this up in
> the KB and done everything it says there - renamed the wininit.ini
> file to wininit.xxx, ran scanreg /fix - but still nothing.
>
> THe whole system basically locks up on normal boot, and just about
> works in safe mode.
>
> Of course, its not backed up and the USD ports wont work in safe mode
> so I can't get any data off it - as I'm tempted to format the thing
> and start afresh.
>
> Any suggestions before I do that?

jakethegunner
Fri Mar 18 08:37:08 CST 2005




try downloading this patch (http://support.microsoft.com?kbid=290700).



"Matt" wrote:

> Hi, I hope someone can help me or point me in the right direction.
>
> I'm trying to fix a PC for a friend of mine which runs Win ME.
>
> The machine will start in both normal and safe modes, but the mouse won't
> operate in normal mode, and it exhibits some strage behaviour.
>
> So, I booted into safe mode, ran a virus scan / adaware and removed over 200
> viruses and around 90 instances of spyware. Thinking that would solve it, I
> rebooted but still no joy.
>
> Then, I tried a system restore, but system restore says the machine needs to
> be restarted before it can work - so I've looked this up in the KB and done
> everything it says there - renamed the wininit.ini file to wininit.xxx, ran
> scanreg /fix - but still nothing.
>
> THe whole system basically locks up on normal boot, and just about works in
> safe mode.
>
> Of course, its not backed up and the USD ports wont work in safe mode so I
> can't get any data off it - as I'm tempted to format the thing and start
> afresh.
>
> Any suggestions before I do that?

Mike
Fri Mar 18 09:25:23 CST 2005

Jake,

The patch you mention has nothing to do with the posters problem and the
error message he is seeing is not that generated when the 290700 patch was
not present when the checkpoint was made but instead that due to the
presence, real or otherwise, of a wininit.ini file.
--
Mike Maltby
MS-MVP Windows [2001-2005]
mike.maltby@gmail.com


jakethegunner <jakethegunner@discussions.microsoft.com> wrote:

> try downloading this patch
> (http://support.microsoft.com?kbid=290700).

Matt
Fri Mar 18 10:21:06 CST 2005

Thanks for your suggestions guys.

Right, I've found another wininit.ini file in C:\WINDOWS, created at boot
time. There are also two other files of the same name in different
directories : C:\KHalid BAckup (spelt just like that - no idea what it is,
but there's only that file, a .bak .sav and .err files in the directory), and
C:\WUTemp, and that's the only file in that directory - but they're both much
older files, mid-2004 creation.

Syst. Restore still doesnt work tho, even when I rename one or all of these
files.

As I said, I've run a decent AV prog on there, and deleted all the viruses
it can find. I've also run AdAware and that deleted a bunch of reg keys and
some dialers, etc (over 90 of the little suckers).

Thanks for your help so far.... that format c: prompt is looking a little
closer... :-(

Mike
Fri Mar 18 10:31:04 CST 2005

Is a new wininit.ini file being created each time you boot? If yes, what
is its contents (it is a plain text file and can be opened using Notepad)?
The only legitimate location for a wininit.ini file is in the Windows
folder.

If after booting and renaming any wininit.ini file that might be present
have you tried my suggestion of running SCANREG /FIX? If not may I again
suggest that you do so.

A folder named C:\KHalid BAckup sounds most suspicious and I can think of
no good reason why it should contain copies of any wininit files unless it
was malicious. Similarly C:\WUTemp should not contain any wininit files,
this folder being used by Windows Update and Automatic Update.
--
http://www.microsoft.com/windowsxp/expertzone/meetexperts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP
mike.maltby@gmail.com


Matt <Matt@discussions.microsoft.com> wrote:

> Thanks for your suggestions guys.
>
> Right, I've found another wininit.ini file in C:\WINDOWS, created at
> boot time. There are also two other files of the same name in
> different directories : C:\KHalid BAckup (spelt just like that - no
> idea what it is, but there's only that file, a .bak .sav and .err
> files in the directory), and C:\WUTemp, and that's the only file in
> that directory - but they're both much older files, mid-2004 creation.
>
> Syst. Restore still doesnt work tho, even when I rename one or all of
> these files.
>
> As I said, I've run a decent AV prog on there, and deleted all the
> viruses it can find. I've also run AdAware and that deleted a bunch
> of reg keys and some dialers, etc (over 90 of the little suckers).
>
> Thanks for your help so far.... that format c: prompt is looking a
> little closer... :-(

Matt
Fri Mar 18 10:53:03 CST 2005

Hi, yes I'd tried scanreg /fix before and again just now - same results. No
joy.

All the wininit.ini files are 0kb in size, and don't display anything in
them when opened within Notepad - just empty.

A new wininit.ini is being created on every boot though - same file, every
time.

I've just run the virus/adaware again - still nothing on there.

Mike
Fri Mar 18 11:07:23 CST 2005

It really sounds as if you have unwanted malware on your system as you
shouldn't be seeing a wininit.ini file each time you boot your system
other than in special circumstances such as due to your using a utility to
delete index.dat files each time you boot your system or because you are
using McAfee's SpamKiller or one of the other products I mentioned in my
original reply. Until you fix this you will be unable to use system
restore.
--
http://www.microsoft.com/windowsxp/expertzone/meetexperts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP
mike.maltby@gmail.com

.
Matt <Matt@discussions.microsoft.com> wrote:

> Hi, yes I'd tried scanreg /fix before and again just now - same
> results. No joy.
>
> All the wininit.ini files are 0kb in size, and don't display anything
> in them when opened within Notepad - just empty.
>
> A new wininit.ini is being created on every boot though - same file,
> every time.
>
> I've just run the virus/adaware again - still nothing on there.

Matt
Fri Mar 18 11:27:02 CST 2005

Figures.

OK - one last question. Is there any way I can move the mouse cursor in
normal mode other than with the mouse (which won't operate in normal mode)?

What I'm trying to get at is that in safe mode I can't install some other
spyware tools I have available from the a USB device - same goes for the
CDROM drive.

So, if I can boot it in normal mode and then access USB/CDROM drive, I can
install some other bits and pieces I've got to try and flush the beast out.

Mike
Fri Mar 18 11:34:17 CST 2005

Try using alt tab to move between windows and alt to move around within a
window. See if you can manage to copy the required application to your
desktop from CD or USB in normal mode and then boot to Safe Mode to
install.

Best of luck and I hope you solve the problem quickly.
--
http://www.microsoft.com/windowsxp/expertzone/meetexperts/nichol.mspx
In memory of a very dear friend, Windows MVP Alex Nichol

Mike Maltby MS-MVP
mike.maltby@gmail.com


Matt <Matt@discussions.microsoft.com> wrote:

> Figures.
>
> OK - one last question. Is there any way I can move the mouse cursor
> in normal mode other than with the mouse (which won't operate in
> normal mode)?
>
> What I'm trying to get at is that in safe mode I can't install some
> other spyware tools I have available from the a USB device - same
> goes for the CDROM drive.
>
> So, if I can boot it in normal mode and then access USB/CDROM drive,
> I can install some other bits and pieces I've got to try and flush
> the beast out.