[elton75]

Hello, I've got this problem : when I turn on System Restore (using the System Restore" tab on "System properties" panel) , my drives appear to be "monitored" again. I then use the Settings so that only my system C partition gets monitored (there's enough free space on C:) But when I reboot, or even when I just open "regedit" to check the register values and click "refresh", the "SystemRestore" tab on "System properties" panel has "Turn off system Restore on all drives" checked back again !
I tried with and without launching Kaspersky AV 2009 with no success. I scanned for malwares and virus, did a lot of the tips I found on various forums nothing works !
It seems that something is preventing the register keys to be permanently changed.
When I boot in safe mode, the System restore settings seem to be saved, so the problem appears in Normal mode only.

Any ideas ? System Restore did'nt help me much in the past, but this problem could hide another one, don't like that.
Thanks for any help

[Advertisements]

Is it possible that "disk space to use" was set to such a low level that the computer have no space to create restore points?

[The Skeptic]

Is it possible that "disk space to use" was set to such a low level that the computer have no space to create restore points?

[elton75]

Thanks for your help. No, I enter the setting of 9 to 12 % disk space for my sytem C: partition, which allocates about 2 Gbytes for system restore, should be enough ! C: has about 10 GB of free space. By the way, I could create a restore point booting in safe mode. So I guess there must be some kind of process in Normal mode that keeps me from enabling System Restore. I tried restarting in Normal mode after enabling System Restore for C drive, unchecking every startup program using msconfig, same problem : System Restore turned off !

[Rorschach112]

you cant create a system restore point in safe mode

does this work for you ?

Download SysRestorePoint to your desktop and unzip it to it's own folder.

• Double click SysRestorePoint.exe so that we can make a new system restore point.
• A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

[The Skeptic]

If all doesn't work then you can use an alternative registry backup tool like ERUNT. It's an excellent program that does a better job then Microsoft's restore. Erunt is a freeware and includes a comrehensive read file that tells you what it does.

[elton75]

Thanks to you all, I think I found the problem. I made a scan with Malwarebyte's in safe mode and it detected two instances of a rootkit agent, asc3550p.sys , that had not been detected in normal mode. After deleting them, seems that System Restore works back again.
I'll take a look at Erunt, thanks

[The Skeptic]

Thanks for letting us know.

[123Runner]

elton75,

Since you found a rootkit......

I suggest you go to the Malware Removal and Spyware Removal Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post the reguested logs in THAT forum. If you are unable to run any of the tools then start a new topic in the malware forum and put this in the subject line...I am unable to run any malware tools

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Add a link to this topic so that malware tech can see what steps have been taken here