Tech Support Guy banner
Status
Not open for further replies.
1 - 20 of 20 Posts

·
Registered
Joined
·
45,855 Posts
See if this applies first >> http://bertk.mvps.org/html/eerrormsgsv.html#3

So you are getting that message whenever you try to create a manual restore point?

Are automatic points being created?

Does this error appear in the Event Viewer (run eventvwr.msc and copy/paste the details here if found.

You might try either booting in Safe Mode and testing -- or perhaps better trying clean boot troubleshooting >>

http://support.microsoft.com/kb/929135
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #3 ·
I tried the first link and unchecked the read-only box: no success, tried safe boot and clean boot: no success. No automatic points have been created. here is the event viewer error in the system restore

Log Name: Application
Source: System Restore
Date: 10/27/2007 7:45:26 PM
Event ID: 8193
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: LukeStonesif-PC
Description:
Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x80070005).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="System Restore" />
<EventID Qualifiers="0">8193</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-10-27T23:45:26.000Z" />
<EventRecordID>2963</EventRecordID>
<Channel>Application</Channel>
<Computer>LukeStonesif-PC</Computer>
<Security />
</System>
<EventData>
C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
Scheduled Checkpoint
0x80070005
<Binary>0500078002020000D60100000000000032CA19E58CAF4DCB010000000000000000000000</Binary>
</EventData>
</Event>

Thank You for all your help
 

·
Registered
Joined
·
45,855 Posts
If you run sysdm.cpl and select the System Protection tab, what drive(s) are selected there?

If the c: drive, how much free space remains on this drive?

And you say no restore points have been created at all? How long have you had the system?

You might try removing the check from the main drive (should be c: -- normally), disabling system restore per the link below and then re-enabling it after rebooting.

http://vistasupport.mvps.org/turn_off_system_restore.htm
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #5 ·
I tried each of my four drives and they all have the same problem. The root drive has 13.9 GB free of 37.7 GB. I tried disabling then restarting then re enabling system restore and it doesn't fix the error message. thanks again for all your help
 

·
Registered
Joined
·
45,855 Posts
There's not much to be found for this. In the Event Viewer are you seeing any other errors, perhaps referencing "Volsnap" (system log) or "VSS" (application log)?

Have you installed a non-Microsoft defrag utility by any chance?

In services.msc is the Volume Shadow Copy service present and set to "manual"? Same for " Windows Backup and Restore"

If you go to the Control Panel > Performance Information and Tools > Advanced and run a "system health diagnostic" -- what problems, if any, does it report?

Finally, if you have installed using a Microsoft Retail CD -- you qualify for free Microsoft support; if this is an out of the box OEM system -- you should contact them for warranty support if the problem cannot be resolved otherwise.

>> http://support.microsoft.com/contactussupport/?ws=support
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #7 ·
I see nothing from "Volsnap", but in the system log there are some warnings from "volmgr" saying that the system failed to flush data to the transaction log.
In the application log there were some "VSS" information logs saying that it is shutting down. Also there was one saying that "Volume Shadow Copy Service" attempted to subscribe during setup.

I have no third-party defragers.

"Volume Shadow Copy Service" is set to manual. There is a "Windows Backup" and it's set to manual, but I see nothing suggesting the "restore" part.

In "system health diagnostic" it says I have no anti-spyware or anti-virus, but i think they are just out-of-date. Also, It says that User Access Control is disabled, which i set.

I have had Vista for only a couple months.

Thanks again
 

·
Registered
Joined
·
45,855 Posts
UAC can be disabled, and "manual" is the default for VSS.

Do you have a sufficiently large 2nd drive or partition that would allow you to try a Full Drive Backup?

This is one of the options in Ultimate.

You should be able to do it on an external drive as well, of course.

Was this Vista system an upgrade from another or is it an off the shelf OEM system like HP or Dell?

If an upgrade that might explain having an out of date antivirus. As for "antispyware" -- Windows Defender should have come with it, and that qualifies.

>> also can you use the 'copy' option to copy the "volsnap" error to the clipboard and paste it here. I need the event id, source and details to look into it further.
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #10 ·
I am not sure what you meant by post 8 and the first line of 9.

I could do a disk backup if absolute necessary, but i am sure it would take a while.

It is an OEM version that i installed on my custom pc.

It didn't see an error from "volsnap".

Also i have updated and ran AVG Anti-virus and spybot. AVG came up clean. Spybot detected some stuff and fixed it, but problem still remains
 

·
Registered
Joined
·
45,855 Posts
Post 8 was a duplicate that should have been deleted but wasn't entirely. In post 9 I am just saying that UAC would have no effect on the problem. I keep it disabled myself.

Was this a "clean" install or an upgrade?

Let's give this a shot: navigate to c:\windows\system32\rstrui.exe

Right click on rstrui.exe and select "run as administrator".

Any better luck that way?

If you look at the Security tab on the properties page, there should be checks for "read & execute" and "read" for "system", "administrators", and "Users"
 

·
Registered
Joined
·
45,855 Posts
What happens when you click "next"?

And what happens when you open "system protection" and click "create"?

Do you get the reported error for both immediately?

In "available disks" what is present, and what is currently checked.

I'm really in the dark here as much as you are, since there is little else on the web other than what I posted.

So if you don't have too much to lose, you might want to take the option of doing another clean install.

By the way, will chkdsk /r run on the drive? (requires a reboot and some patience). The log will be available in the Event Viewer > Applications > Wininit entry after reboot.
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #14 ·
The Next button is not click able. The only thing i can click takes me into system protection.

Clicking "create" on each of my drives brings up the error. I have tried them individually and all at once with same result. All 4 of my drives show up in "system protection".

I have so much software and i have tweaked vista so much that it would be a major undertaking to reinstall.

I will run that chkdsk and post back.
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #15 ·
Here is the log:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 10/5/2007 12:45:27 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: LukeStonesif-PC
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is Vista.

One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
69888 file records processed.

83 large file records processed.

0 bad file records processed.

2 EA records processed.

44 reparse records processed.

The multi-sector header signature for VCN 0x0 of index $I30
in file 0x5b9 is incorrect.
0b aa 00 19 00 0f 1e a5 00 11 00 0b 28 a7 00 09 ............(...
00 07 31 aa 00 00 00 0c 23 79 3c 00 00 0b 29 53 ..1.....#y<...)S
Correcting error in index $I30 for file 1465.
The index bitmap $I30 in file 0x5b9 is incorrect.
Correcting error in index $I30 for file 1465.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff 80 af 84 33 6a fe c6 01 ...........3j...
a3 88 c1 05 6a db c6 01 a4 83 55 7c e0 f7 c7 01 ....j.....U|....
Sorting index $I30 in file 1465.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x813 is incorrect.
0a 00 4d 00 53 00 49 00 20 00 28 00 73 00 29 00 ..M.S.I. .(.s.).
20 00 28 00 34 00 30 00 3a 00 30 00 30 00 29 00 .(.4.0.:.0.0.).
Correcting error in index $I30 for file 2067.
The index bitmap $I30 in file 0x813 is incorrect.
Correcting error in index $I30 for file 2067.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff fa 82 46 4d 5a fe c6 01 ..........FMZ...
c0 3b 36 b7 63 fe c6 01 08 1a 52 d0 e0 f7 c7 01 .;6.c.....R.....
Sorting index $I30 in file 2067.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x107df is incorrect.
44 42 50 46 01 00 00 00 01 00 00 00 00 00 00 00 DBPF............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Correcting error in index $I30 for file 67551.
The index bitmap $I30 in file 0x107df is incorrect.
Correcting error in index $I30 for file 67551.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff bb 58 dd 73 19 fe c7 01 .........X.s....
bb 58 dd 73 19 fe c7 01 bb 58 dd 73 19 fe c7 01 .X.s.....X.s....
Sorting index $I30 in file 67551.
Index entry l_000120.log of index $I30 in file 0x997d points to unused file 0x9a17.
Deleting index entry l_000120.log in index $I30 of file 39293.
262916 index entries processed.

CHKDSK is recovering lost files.
Recovering orphaned file channels (2068) into directory file 2067.
Recovering orphaned file identity (2070) into directory file 2067.
Recovering orphaned file issuance (2071) into directory file 2067.
Recovering orphaned file PKEYCO~1 (2072) into directory file 2067.
Recovering orphaned file pkeyconfig (2072) into directory file 2067.
Recovering orphaned file ppdlic (2073) into directory file 2067.
Recovering orphaned file skus (2074) into directory file 2067.
Recovering orphaned file cmiadapter.dll (15738) into directory file 1465.
Recovering orphaned file cmitrust.dll (15739) into directory file 1465.
Recovering orphaned file cmiv2.dll (15740) into directory file 1465.
Recovering orphaned file CntrtextInstaller.DLL (15742) into directory file 1465.
Recovering orphaned file helpcins.dll (15743) into directory file 1465.
Recovering orphaned file locdrv.dll (15744) into directory file 1465.
Recovering orphaned file OEMHelpIns.dll (15745) into directory file 1465.
Recovering orphaned file rescinst.dll (15746) into directory file 1465.
Recovering orphaned file slcinst.dll (56090) into directory file 67551.
Recovering orphaned file SLsvc.exe (67575) into directory file 67551.
Recovering orphaned file SECURI~1.XRM (67577) into directory file 67551.
Recovering orphaned file Security-Licensing-SLC-ppdlic.xrm-ms (67577) into directory file 67551.
22 unindexed files processed.

69888 security descriptors processed.

Cleaning up 171 unused index entries from index $SII of file 0x9.
Cleaning up 171 unused index entries from index $SDH of file 0x9.
Cleaning up 171 unused security descriptors.
11675 data files processed.

CHKDSK is verifying Usn Journal...
The remaining of an USN page at offset 0x2a013bc0 in file 0x9295
should be filled with zeros.
The USN Journal entry at offset 0x2a014000 and length 0xf3014048 crosses
the page boundary.
The USN Journal entry at offset 0x2a015000 and length 0x4f1f00a crosses
the page boundary.
The USN Journal entry at offset 0x2a016000 and length 0x457b815d crosses
the page boundary.
The USN Journal entry at offset 0x2a017000 and length 0x1e122e1 crosses
the page boundary.
The USN Journal entry at offset 0x2a018000 and length 0x3e75a0b crosses
the page boundary.
The USN Journal entry at offset 0x2a019000 and length 0xb0220048 crosses
the page boundary.
The USN Journal entry at offset 0x2a01a000 and length 0xcae7c0c crosses
the page boundary.
The USN Journal entry at offset 0x2a01b000 and length 0xf170aa06 crosses
the page boundary.
The USN Journal entry at offset 0x2a01c000 and length 0xfc0e01f1 crosses
the page boundary.
The USN Journal entry at offset 0x2a01d000 and length 0x1a516e0 crosses
the page boundary.
The USN Journal entry at offset 0x2a01e000 and length 0xe05f0206 crosses
the page boundary.
The USN Journal entry at offset 0x2a01f000 and length 0x1fb0285 crosses
the page boundary.
The USN Journal entry at offset 0x2a020000 and length 0xb03701 crosses
the page boundary.
The USN Journal entry at offset 0x2a021000 and length 0x17e605e3 crosses
the page boundary.
The USN Journal entry at offset 0x2a022000 and length 0x82a91787 crosses
the page boundary.
The USN Journal entry at offset 0x2a023000 and length 0xd562f701 crosses
the page boundary.
The USN Journal entry at offset 0x2a024000 and length 0x70543d90 crosses
the page boundary.
The USN Journal entry at offset 0x2a025000 and length 0x51209a23 crosses
the page boundary.
The USN Journal entry at offset 0x2a026000 and length 0x54b78432 crosses
the page boundary.
The USN Journal entry at offset 0x2a027000 and length 0xe76c29ec crosses
the page boundary.
The USN Journal entry at offset 0x2a028000 and length 0x15fc1eb2 crosses
the page boundary.
The USN Journal entry at offset 0x2a029000 and length 0x11e1e025 crosses
the page boundary.
The USN Journal entry at offset 0x2a02a000 and length 0x43cc6243 crosses
the page boundary.
The USN Journal entry at offset 0x2a02b000 and length 0x37aa0044 crosses
the page boundary.
The USN Journal entry at offset 0x2a02c000 and length 0xf103f200 crosses
the page boundary.
The USN Journal entry at offset 0x2a02d000 and length 0xd6143303 crosses
the page boundary.
The USN Journal entry at offset 0x2a02e000 and length 0xf15000f7 crosses
the page boundary.
The USN Journal entry at offset 0x2a02f000 and length 0x10eb5200 crosses
the page boundary.
The USN Journal entry at offset 0x2a030000 and length 0x58078150 crosses
the page boundary.
The USN Journal entry at offset 0x2a031000 and length 0x4682ad20 crosses
the page boundary.
The USN Journal entry at offset 0x2a032000 and length 0x19e29a05 crosses
the page boundary.
The USN Journal entry at offset 0x2a033000 and length 0xfc3612f5 crosses
the page boundary.
The USN Journal entry at offset 0x2a034000 and length 0x41eb2906 crosses
the page boundary.
Repairing Usn Journal file record segment.
33793504 USN bytes processed.

Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

39621928 KB total disk space.
19471992 KB in 54920 files.
28272 KB in 11676 indexes.
0 KB in bad sectors.
170176 KB in use by the system.
65536 KB occupied by the log file.
19951488 KB available on disk.

4096 bytes in each allocation unit.
9905482 total allocation units on disk.
4987872 allocation units available on disk.

Internal Info:
00 11 01 00 2f 04 01 00 e4 be 01 00 00 00 00 00 ..../...........
c7 06 00 00 2c 00 00 00 06 02 00 00 00 00 00 00 ....,...........
52 67 97 04 00 00 00 00 10 a7 de 0f 00 00 00 00 Rg..............
80 4a 5d 05 00 00 00 00 00 00 00 00 00 00 00 00 .J].............
00 00 00 00 00 00 00 00 ca b3 cd 22 00 00 00 00 ..........."....
99 9e 36 00 00 00 00 00 c0 1f e7 00 70 6f 26 00 ..6.........po&.
60 e6 2b 00 10 00 00 00 34 1d e7 00 b0 70 26 00 `.+.....4....p&.

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-10-05T16:45:27.000Z" />
<EventRecordID>1436</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>LukeStonesif-PC</Computer>
<Security />
</System>
<EventData>

Checking file system on C:
The type of the file system is NTFS.
Volume label is Vista.

One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
69888 file records processed.

83 large file records processed.

0 bad file records processed.

2 EA records processed.

44 reparse records processed.

The multi-sector header signature for VCN 0x0 of index $I30
in file 0x5b9 is incorrect.
0b aa 00 19 00 0f 1e a5 00 11 00 0b 28 a7 00 09 ............(...
00 07 31 aa 00 00 00 0c 23 79 3c 00 00 0b 29 53 ..1.....#y<...)S
Correcting error in index $I30 for file 1465.
The index bitmap $I30 in file 0x5b9 is incorrect.
Correcting error in index $I30 for file 1465.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff 80 af 84 33 6a fe c6 01 ...........3j...
a3 88 c1 05 6a db c6 01 a4 83 55 7c e0 f7 c7 01 ....j.....U|....
Sorting index $I30 in file 1465.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x813 is incorrect.
0a 00 4d 00 53 00 49 00 20 00 28 00 73 00 29 00 ..M.S.I. .(.s.).
20 00 28 00 34 00 30 00 3a 00 30 00 30 00 29 00 .(.4.0.:.0.0.).
Correcting error in index $I30 for file 2067.
The index bitmap $I30 in file 0x813 is incorrect.
Correcting error in index $I30 for file 2067.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff fa 82 46 4d 5a fe c6 01 ..........FMZ...
c0 3b 36 b7 63 fe c6 01 08 1a 52 d0 e0 f7 c7 01 .;6.c.....R.....
Sorting index $I30 in file 2067.
The multi-sector header signature for VCN 0x0 of index $I30
in file 0x107df is incorrect.
44 42 50 46 01 00 00 00 01 00 00 00 00 00 00 00 DBPF............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Correcting error in index $I30 for file 67551.
The index bitmap $I30 in file 0x107df is incorrect.
Correcting error in index $I30 for file 67551.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff bb 58 dd 73 19 fe c7 01 .........X.s....
bb 58 dd 73 19 fe c7 01 bb 58 dd 73 19 fe c7 01 .X.s.....X.s....
Sorting index $I30 in file 67551.
Index entry l_000120.log of index $I30 in file 0x997d points to unused file 0x9a17.
Deleting index entry l_000120.log in index $I30 of file 39293.
262916 index entries processed.

CHKDSK is recovering lost files.
Recovering orphaned file channels (2068) into directory file 2067.
Recovering orphaned file identity (2070) into directory file 2067.
Recovering orphaned file issuance (2071) into directory file 2067.
Recovering orphaned file PKEYCO~1 (2072) into directory file 2067.
Recovering orphaned file pkeyconfig (2072) into directory file 2067.
Recovering orphaned file ppdlic (2073) into directory file 2067.
Recovering orphaned file skus (2074) into directory file 2067.
Recovering orphaned file cmiadapter.dll (15738) into directory file 1465.
Recovering orphaned file cmitrust.dll (15739) into directory file 1465.
Recovering orphaned file cmiv2.dll (15740) into directory file 1465.
Recovering orphaned file CntrtextInstaller.DLL (15742) into directory file 1465.
Recovering orphaned file helpcins.dll (15743) into directory file 1465.
Recovering orphaned file locdrv.dll (15744) into directory file 1465.
Recovering orphaned file OEMHelpIns.dll (15745) into directory file 1465.
Recovering orphaned file rescinst.dll (15746) into directory file 1465.
Recovering orphaned file slcinst.dll (56090) into directory file 67551.
Recovering orphaned file SLsvc.exe (67575) into directory file 67551.
Recovering orphaned file SECURI~1.XRM (67577) into directory file 67551.
Recovering orphaned file Security-Licensing-SLC-ppdlic.xrm-ms (67577) into directory file 67551.
22 unindexed files processed.

69888 security descriptors processed.

Cleaning up 171 unused index entries from index $SII of file 0x9.
Cleaning up 171 unused index entries from index $SDH of file 0x9.
Cleaning up 171 unused security descriptors.
11675 data files processed.

CHKDSK is verifying Usn Journal...
The remaining of an USN page at offset 0x2a013bc0 in file 0x9295
should be filled with zeros.
The USN Journal entry at offset 0x2a014000 and length 0xf3014048 crosses
the page boundary.
The USN Journal entry at offset 0x2a015000 and length 0x4f1f00a crosses
the page boundary.
The USN Journal entry at offset 0x2a016000 and length 0x457b815d crosses
the page boundary.
The USN Journal entry at offset 0x2a017000 and length 0x1e122e1 crosses
the page boundary.
The USN Journal entry at offset 0x2a018000 and length 0x3e75a0b crosses
the page boundary.
The USN Journal entry at offset 0x2a019000 and length 0xb0220048 crosses
the page boundary.
The USN Journal entry at offset 0x2a01a000 and length 0xcae7c0c crosses
the page boundary.
The USN Journal entry at offset 0x2a01b000 and length 0xf170aa06 crosses
the page boundary.
The USN Journal entry at offset 0x2a01c000 and length 0xfc0e01f1 crosses
the page boundary.
The USN Journal entry at offset 0x2a01d000 and length 0x1a516e0 crosses
the page boundary.
The USN Journal entry at offset 0x2a01e000 and length 0xe05f0206 crosses
the page boundary.
The USN Journal entry at offset 0x2a01f000 and length 0x1fb0285 crosses
the page boundary.
The USN Journal entry at offset 0x2a020000 and length 0xb03701 crosses
the page boundary.
The USN Journal entry at offset 0x2a021000 and length 0x17e605e3 crosses
the page boundary.
The USN Journal entry at offset 0x2a022000 and length 0x82a91787 crosses
the page boundary.
The USN Journal entry at offset 0x2a023000 and length 0xd562f701 crosses
the page boundary.
The USN Journal entry at offset 0x2a024000 and length 0x70543d90 crosses
the page boundary.
The USN Journal entry at offset 0x2a025000 and length 0x51209a23 crosses
the page boundary.
The USN Journal entry at offset 0x2a026000 and length 0x54b78432 crosses
the page boundary.
The USN Journal entry at offset 0x2a027000 and length 0xe76c29ec crosses
the page boundary.
The USN Journal entry at offset 0x2a028000 and length 0x15fc1eb2 crosses
the page boundary.
The USN Journal entry at offset 0x2a029000 and length 0x11e1e025 crosses
the page boundary.
The USN Journal entry at offset 0x2a02a000 and length 0x43cc6243 crosses
the page boundary.
The USN Journal entry at offset 0x2a02b000 and length 0x37aa0044 crosses
the page boundary.
The USN Journal entry at offset 0x2a02c000 and length 0xf103f200 crosses
the page boundary.
The USN Journal entry at offset 0x2a02d000 and length 0xd6143303 crosses
the page boundary.
The USN Journal entry at offset 0x2a02e000 and length 0xf15000f7 crosses
the page boundary.
The USN Journal entry at offset 0x2a02f000 and length 0x10eb5200 crosses
the page boundary.
The USN Journal entry at offset 0x2a030000 and length 0x58078150 crosses
the page boundary.
The USN Journal entry at offset 0x2a031000 and length 0x4682ad20 crosses
the page boundary.
The USN Journal entry at offset 0x2a032000 and length 0x19e29a05 crosses
the page boundary.
The USN Journal entry at offset 0x2a033000 and length 0xfc3612f5 crosses
the page boundary.
The USN Journal entry at offset 0x2a034000 and length 0x41eb2906 crosses
the page boundary.
Repairing Usn Journal file record segment.
33793504 USN bytes processed.

Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

39621928 KB total disk space.
19471992 KB in 54920 files.
28272 KB in 11676 indexes.
0 KB in bad sectors.
170176 KB in use by the system.
65536 KB occupied by the log file.
19951488 KB available on disk.

4096 bytes in each allocation unit.
9905482 total allocation units on disk.
4987872 allocation units available on disk.

Internal Info:
00 11 01 00 2f 04 01 00 e4 be 01 00 00 00 00 00 ..../...........
c7 06 00 00 2c 00 00 00 06 02 00 00 00 00 00 00 ....,...........
52 67 97 04 00 00 00 00 10 a7 de 0f 00 00 00 00 Rg..............
80 4a 5d 05 00 00 00 00 00 00 00 00 00 00 00 00 .J].............
00 00 00 00 00 00 00 00 ca b3 cd 22 00 00 00 00 ..........."....
99 9e 36 00 00 00 00 00 c0 1f e7 00 70 6f 26 00 ..6.........po&.
60 e6 2b 00 10 00 00 00 34 1d e7 00 b0 70 26 00 `.+.....4....p&.

Windows has finished checking your disk.
Please wait while your computer restarts.

</EventData>
</Event>
 

·
Registered
Joined
·
45,855 Posts
Ok, there doesn't seem to be any serious issues with chkdsk that I think would affect System Restore -- but it runs out of Windows, on reboot.

Can you use the Backup and Restore utility to backup an individual directory such as My Documents or a class of files -- I forget exactly how it works -- I really didn't find it useful, but it's worth trying as part of a troubleshooting routine to see if this involves Volume Shadow Copy generally. You can also try setting a scheduled backup, which some report generates the kind of error you have been getting from System Restore if the Task Scheduler does not have correct permissions.

And how about trying a defrag, which will run in Windows, and see if that will run. We are looking for any issues with programs that are locking the drives.

Also, just for the record, post a HijackThis scanlog >>

Download and install HijackThis using the "self extractor". Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

edit -- hold on, here's a somewhat remote possiblity I should have thought of earlier:

run gpedit.msc and navigate thusly:

Computer Configuration/Administrative Templates/System/System Restore

Is "turn off System Restore" configured? In theory this should only apply to XP -- but still exists in the template. Don't know what would happen if it were actually set in Vista.
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #17 ·
I will try the other suggestions, but here is the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:44:25 PM, on 10/30/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\JetAudio\JetAudio.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\sdclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Luke Stonesifer\AppData\Local\Temp\HijackThis.exe
C:\Windows\system32\WerCon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
O4 - HKUS\S-1-5-21-77514179-2536043480-3607079759-1000\..\Run: [Aim6] (User '?')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: COWON Media Center - jetAudio - Copy.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 5763 bytes
 

·
Registered
Joined
·
278 Posts
Discussion Starter · #18 ·
Here is a Windows backup error:

Log Name: Application
Source: Windows Backup
Date: 10/27/2007 9:42:19 AM
Event ID: 4100
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: LukeStonesif-PC
Description:
File backup failed because a shadow copy could not be created. The system might be low on resources. The error is: Access is denied. (0x80070005).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Backup" />
<EventID Qualifiers="0">4100</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-10-27T13:42:19.000Z" />
<EventRecordID>2787</EventRecordID>
<Channel>Application</Channel>
<Computer>LukeStonesif-PC</Computer>
<Security />
</System>
<EventData>
Access is denied. (0x80070005)
<Binary>05000780C0040000EC06000008070000420ED1665C2BEE174B64529CB14610EA71000000</Binary>
</EventData>
</Event>
 

·
Registered
Joined
·
45,855 Posts
Well there are a few Microsoft processes running that I wouldn't normally expect to see, but are probably the result of your having tested the Backup and Restore feature and gotten an error. I don't expect they would be there after a reboot.

Two other things that might be worth looking into are Utorrent -- which could be uploading from the drive and Acronis. Is the version of Acronis you are using the latest and certified to be Vista compatible? What is it scheduled to do and where?

>> you continue to get these Volume Shadow copy errors.

Right Click on your command prompt entry in the Accessories folder (or start menu if you have a shortcut there) and select "run as administrator".

enter:

vssadmin list shadowstorage

What does it return?

Can you use the vssadmin resize shadowstorage described in the link below to increase the size ?

http://blogs.technet.com/filecab/ar...used-for-restore-points-in-windows-vista.aspx

The error code is again covered here:

http://blogs.technet.com/filecab/pa...-restore-and-complete-pc-backup-problems.aspx

File Backup fails with the following error:

Access is denied. (0x80070005)
This error occurs because the recovery partition is enabled for File Backup or System Restore and is almost full. To work around this, do not select D:\ as a backup source. Also, go to System Protection in Control Panel and make sure that D:\ is not enabled for restore points.
 

Attachments

1 - 20 of 20 Posts
Status
Not open for further replies.
Top