I have the system restore turned on. The space I've allowed for storage is 3% or 1075 MB.
But System Restore is only keeping one restore point. When it creates another automatically, it deletes the previous restore point, so basically, it's of no value right now. If I create a restore point manually, the previous restore point is kept.... at least right now I have two restore points from today, because I just created one. But when SR creates a new restore point automatically, all previous SR points will be deleted.
I've turned off System Restore, re-booted... then turned on System Restore and re-booted again. But it's still the same.
> I have the system restore turned on. The space I've allowed for > storage is 3% or 1075 MB.
> But System Restore is only keeping one restore point. When it creates > another automatically, it deletes the previous restore point, so > basically, it's of no value right now. If I create a restore point > manually, the previous restore point is kept.... at least right now I > have two restore points from today, because I just created one. But > when SR creates a new restore point automatically, all previous SR > points will be deleted.
> I've turned off System Restore, re-booted... then turned on System > Restore and re-booted again. But it's still the same.
> I'd sure appreciate any tips on this issue.
How much free space is on your drive? Assuming it's at least 30%, how about increasing your SR storage size to 10% to see what happens? BTW, turning off System Restore will delete restore points!
Thanks for the input Dave. My hard drive has 25 gig available out of 40. I knew that turning off SR would delete all but the last restore point, but since I only had one restore point.... nothing to lose. I'll try it by increasing the amount of space available once more, but I doubt that will work because even when I'd allocated 12% space (default) rather than 3% (which should be plenty), the same thing was happening.
Danno
"Daave" <dcwashNOS...@myrealboxXYZ.invalid> wrote in message
>> I have the system restore turned on. The space I've allowed for storage >> is 3% or 1075 MB.
>> But System Restore is only keeping one restore point. When it creates >> another automatically, it deletes the previous restore point, so >> basically, it's of no value right now. If I create a restore point >> manually, the previous restore point is kept.... at least right now I >> have two restore points from today, because I just created one. But when >> SR creates a new restore point automatically, all previous SR points will >> be deleted.
>> I've turned off System Restore, re-booted... then turned on System >> Restore and re-booted again. But it's still the same.
>> I'd sure appreciate any tips on this issue.
> How much free space is on your drive? Assuming it's at least 30%, how > about increasing your SR storage size to 10% to see what happens? BTW, > turning off System Restore will delete restore points!
Your original disk space setting for System Restore was OK and unlikely to be the cause of the problem. Turning off System Restore removes all restore points. Using the System Restore option on the More Options tab of Disk CleanUp removes all except the latest restore point.
What are your anti-virus and anti-spyware arrangements? Also what firewall are you using? These can interfere with System Restore.
Danno wrote: > Thanks for the input Dave. My hard drive has 25 gig available out of > 40. I knew that turning off SR would delete all but the last restore > point, but since I only had one restore point.... nothing to lose. > I'll try it by increasing the amount of space available once more, > but I doubt that will work because even when I'd allocated 12% space > (default) rather than 3% (which should be plenty), the same thing was > happening. > Danno
>>> I have the system restore turned on. The space I've allowed for >>> storage is 3% or 1075 MB.
>>> But System Restore is only keeping one restore point. When it >>> creates another automatically, it deletes the previous restore >>> point, so basically, it's of no value right now. If I create a >>> restore point manually, the previous restore point is kept.... at >>> least right now I have two restore points from today, because I >>> just created one. But when SR creates a new restore point >>> automatically, all previous SR points will be deleted.
>>> I've turned off System Restore, re-booted... then turned on System >>> Restore and re-booted again. But it's still the same.
>>> I'd sure appreciate any tips on this issue.
>> How much free space is on your drive? Assuming it's at least 30%, how >> about increasing your SR storage size to 10% to see what happens? >> BTW, turning off System Restore will delete restore points!
When I use Disk CleanUp, (which is seldom because I use CCleaner instead), I don't click the option to "remove all but the last restore point".
I have ZoneAlarm as the anti-spyware and anti-virus software, as well as ZoneAlarm's firewall.
I also have AVG installed, but I don't let it run while ZoneAlarm is active. I only fire up AVG once in a while but I disable ZoneAlarm before I do that.
I also have Spybot and AdAware, but they don't run in the background as far as I can tell. I only start them up once in a while as well.
I also have jv16powertools, but I only use that on its safest mode to clean the registry once in a while.
> Your original disk space setting for System Restore was OK and unlikely to > be the cause of the problem. Turning off System Restore removes all > restore points. Using the System Restore option on the More Options tab of > Disk CleanUp removes all except the latest restore point.
> What are your anti-virus and anti-spyware arrangements? Also what firewall > are you using? These can interfere with System Restore.
> Gerry > ~~~~ > FCA > Stourport, England > Enquire, plan and execute > ~~~~~~~~~~~~~~~~~~~ > Danno wrote: >> Thanks for the input Dave. My hard drive has 25 gig available out of >> 40. I knew that turning off SR would delete all but the last restore >> point, but since I only had one restore point.... nothing to lose. I'll >> try it by increasing the amount of space available once more, >> but I doubt that will work because even when I'd allocated 12% space >> (default) rather than 3% (which should be plenty), the same thing was >> happening. >> Danno
>>>> I have the system restore turned on. The space I've allowed for >>>> storage is 3% or 1075 MB.
>>>> But System Restore is only keeping one restore point. When it >>>> creates another automatically, it deletes the previous restore >>>> point, so basically, it's of no value right now. If I create a >>>> restore point manually, the previous restore point is kept.... at >>>> least right now I have two restore points from today, because I >>>> just created one. But when SR creates a new restore point >>>> automatically, all previous SR points will be deleted.
>>>> I've turned off System Restore, re-booted... then turned on System >>>> Restore and re-booted again. But it's still the same.
>>>> I'd sure appreciate any tips on this issue.
>>> How much free space is on your drive? Assuming it's at least 30%, how >>> about increasing your SR storage size to 10% to see what happens? >>> BTW, turning off System Restore will delete restore points!
> When I use Disk CleanUp, (which is seldom because I use CCleaner > instead), I don't click the option to "remove all but the last > restore point". > I have ZoneAlarm as the anti-spyware and anti-virus software, as well > as ZoneAlarm's firewall.
> I also have AVG installed, but I don't let it run while ZoneAlarm is > active. I only fire up AVG once in a while but I disable ZoneAlarm > before I do that. > I also have Spybot and AdAware, but they don't run in the background > as far as I can tell. I only start them up once in a while as well.
> I also have jv16powertools, but I only use that on its safest mode to > clean the registry once in a while.
>> Your original disk space setting for System Restore was OK and >> unlikely to be the cause of the problem. Turning off System Restore >> removes all restore points. Using the System Restore option on the >> More Options tab of Disk CleanUp removes all except the latest >> restore point. What are your anti-virus and anti-spyware >> arrangements? Also what >> firewall are you using? These can interfere with System Restore.
>> Gerry >> ~~~~ >> FCA >> Stourport, England >> Enquire, plan and execute >> ~~~~~~~~~~~~~~~~~~~ >> Danno wrote: >>> Thanks for the input Dave. My hard drive has 25 gig available out >>> of 40. I knew that turning off SR would delete all but the last >>> restore point, but since I only had one restore point.... nothing >>> to lose. I'll try it by increasing the amount of space available >>> once more, but I doubt that will work because even when I'd >>> allocated 12% space >>> (default) rather than 3% (which should be plenty), the same thing >>> was happening. >>> Danno
>>>>> I have the system restore turned on. The space I've allowed for >>>>> storage is 3% or 1075 MB.
>>>>> But System Restore is only keeping one restore point. When it >>>>> creates another automatically, it deletes the previous restore >>>>> point, so basically, it's of no value right now. If I create a >>>>> restore point manually, the previous restore point is kept.... at >>>>> least right now I have two restore points from today, because I >>>>> just created one. But when SR creates a new restore point >>>>> automatically, all previous SR points will be deleted.
>>>>> I've turned off System Restore, re-booted... then turned on System >>>>> Restore and re-booted again. But it's still the same.
>>>>> I'd sure appreciate any tips on this issue.
>>>> How much free space is on your drive? Assuming it's at least 30%, >>>> how about increasing your SR storage size to 10% to see what >>>> happens? BTW, turning off System Restore will delete restore >>>> points!
SR only monitors my internal C: drive. I didn't know it could monitor any other drive! I a new external DVD burner which is run by Nero. Is that what you were asking?
I've only used cCleaner to clean up my disc because it seems pretty thorough as you mentioned, but I never had any intentions of using it, nor any other method... to delete restore points. I didn't mind a dozen or more restore points in the past. It's just that now, when the computer is creating a new restore point and deletes the previous one(s). As of this moment, there are 3 restore points because I created 2 new ones today. I wanted to test if the system will delete those as well, when it sets a new restore point (probably sometime in the wee hours of tonight).
> What version of Zone Alarm do you have? There were problems with version > 6.5.
> What drives do you have System Restore set to monitor? Do you have an > external or removable drive?
> You cannot cCleaner to remove unwanted restore points. In other ways > cCleaner does a more thorough job than Disk CleanUp.
> --
> Hope this helps.
> Gerry > ~~~~ > FCA > Stourport, England > Enquire, plan and execute > ~~~~~~~~~~~~~~~~~~~
> Danno wrote: >> Thanks Gerry,
>> When I use Disk CleanUp, (which is seldom because I use CCleaner >> instead), I don't click the option to "remove all but the last >> restore point". >> I have ZoneAlarm as the anti-spyware and anti-virus software, as well >> as ZoneAlarm's firewall.
>> I also have AVG installed, but I don't let it run while ZoneAlarm is >> active. I only fire up AVG once in a while but I disable ZoneAlarm >> before I do that. >> I also have Spybot and AdAware, but they don't run in the background >> as far as I can tell. I only start them up once in a while as well.
>> I also have jv16powertools, but I only use that on its safest mode to >> clean the registry once in a while.
>>> Your original disk space setting for System Restore was OK and >>> unlikely to be the cause of the problem. Turning off System Restore >>> removes all restore points. Using the System Restore option on the >>> More Options tab of Disk CleanUp removes all except the latest >>> restore point. What are your anti-virus and anti-spyware arrangements? >>> Also what >>> firewall are you using? These can interfere with System Restore.
>>> Gerry >>> ~~~~ >>> FCA >>> Stourport, England >>> Enquire, plan and execute >>> ~~~~~~~~~~~~~~~~~~~ >>> Danno wrote: >>>> Thanks for the input Dave. My hard drive has 25 gig available out >>>> of 40. I knew that turning off SR would delete all but the last >>>> restore point, but since I only had one restore point.... nothing >>>> to lose. I'll try it by increasing the amount of space available >>>> once more, but I doubt that will work because even when I'd allocated >>>> 12% space >>>> (default) rather than 3% (which should be plenty), the same thing >>>> was happening. >>>> Danno
>>>>>> I have the system restore turned on. The space I've allowed for >>>>>> storage is 3% or 1075 MB.
>>>>>> But System Restore is only keeping one restore point. When it >>>>>> creates another automatically, it deletes the previous restore >>>>>> point, so basically, it's of no value right now. If I create a >>>>>> restore point manually, the previous restore point is kept.... at >>>>>> least right now I have two restore points from today, because I >>>>>> just created one. But when SR creates a new restore point >>>>>> automatically, all previous SR points will be deleted.
>>>>>> I've turned off System Restore, re-booted... then turned on System >>>>>> Restore and re-booted again. But it's still the same.
>>>>>> I'd sure appreciate any tips on this issue.
>>>>> How much free space is on your drive? Assuming it's at least 30%, >>>>> how about increasing your SR storage size to 10% to see what >>>>> happens? BTW, turning off System Restore will delete restore >>>>> points!
Yesterday there was one restore point which had been created automatically by the system. That was the only restore point available. So I created two new restore points throughout the day, to see if the SR would delete all but the last restore point once again. Today, I updated a driver and at that point in time, SR created a restore point, and when it did that.... it deleted the last restore point which had been created automatically, and deleted one of my two test restore points. The net result today is that there are two restore points only.... one of my own points and an automatic restore point created when I updated the driver.
I'd sure appreciate any other suggestions or input.
> What version of Zone Alarm do you have? There were problems with version > 6.5.
> What drives do you have System Restore set to monitor? Do you have an > external or removable drive?
> You cannot cCleaner to remove unwanted restore points. In other ways > cCleaner does a more thorough job than Disk CleanUp.
> --
> Hope this helps.
> Gerry > ~~~~ > FCA > Stourport, England > Enquire, plan and execute > ~~~~~~~~~~~~~~~~~~~
> Danno wrote: >> Thanks Gerry,
>> When I use Disk CleanUp, (which is seldom because I use CCleaner >> instead), I don't click the option to "remove all but the last >> restore point". >> I have ZoneAlarm as the anti-spyware and anti-virus software, as well >> as ZoneAlarm's firewall.
>> I also have AVG installed, but I don't let it run while ZoneAlarm is >> active. I only fire up AVG once in a while but I disable ZoneAlarm >> before I do that. >> I also have Spybot and AdAware, but they don't run in the background >> as far as I can tell. I only start them up once in a while as well.
>> I also have jv16powertools, but I only use that on its safest mode to >> clean the registry once in a while.
>>> Your original disk space setting for System Restore was OK and >>> unlikely to be the cause of the problem. Turning off System Restore >>> removes all restore points. Using the System Restore option on the >>> More Options tab of Disk CleanUp removes all except the latest >>> restore point. What are your anti-virus and anti-spyware arrangements? >>> Also what >>> firewall are you using? These can interfere with System Restore.
>>> Gerry >>> ~~~~ >>> FCA >>> Stourport, England >>> Enquire, plan and execute >>> ~~~~~~~~~~~~~~~~~~~ >>> Danno wrote: >>>> Thanks for the input Dave. My hard drive has 25 gig available out >>>> of 40. I knew that turning off SR would delete all but the last >>>> restore point, but since I only had one restore point.... nothing >>>> to lose. I'll try it by increasing the amount of space available >>>> once more, but I doubt that will work because even when I'd allocated >>>> 12% space >>>> (default) rather than 3% (which should be plenty), the same thing >>>> was happening. >>>> Danno
>>>>>> I have the system restore turned on. The space I've allowed for >>>>>> storage is 3% or 1075 MB.
>>>>>> But System Restore is only keeping one restore point. When it >>>>>> creates another automatically, it deletes the previous restore >>>>>> point, so basically, it's of no value right now. If I create a >>>>>> restore point manually, the previous restore point is kept.... at >>>>>> least right now I have two restore points from today, because I >>>>>> just created one. But when SR creates a new restore point >>>>>> automatically, all previous SR points will be deleted.
>>>>>> I've turned off System Restore, re-booted... then turned on System >>>>>> Restore and re-booted again. But it's still the same.
>>>>>> I'd sure appreciate any tips on this issue.
>>>>> How much free space is on your drive? Assuming it's at least 30%, >>>>> how about increasing your SR storage size to 10% to see what >>>>> happens? BTW, turning off System Restore will delete restore >>>>> points!
This happened to me once because a granddaughter downloaded and installed a program after being told not to download anything. My approach to this is to clean out the startup folder. (start-- run --msconfig---and remove all checks in start up. Let the system load only Microsoft programs such as OE IE etc. Then add one or two programs back till you find the offending program. The offending program (in my case) was doing this to prevent uninstalling it. My granddaughter will never use my system again.
> Yesterday there was one restore point which had been created automatically > by the system. That was the only restore point available. So I created > two new restore points throughout the day, to see if the SR would delete > all but the last restore point once again. Today, I updated a driver and > at that point in time, SR created a restore point, and when it did > that.... it deleted the last restore point which had been created > automatically, and deleted one of my two test restore points. The net > result today is that there are two restore points only.... one of my own > points and an automatic restore point created when I updated the driver.
> I'd sure appreciate any other suggestions or input.
>> What version of Zone Alarm do you have? There were problems with version >> 6.5.
>> What drives do you have System Restore set to monitor? Do you have an >> external or removable drive?
>> You cannot cCleaner to remove unwanted restore points. In other ways >> cCleaner does a more thorough job than Disk CleanUp.
>> --
>> Hope this helps.
>> Gerry >> ~~~~ >> FCA >> Stourport, England >> Enquire, plan and execute >> ~~~~~~~~~~~~~~~~~~~
>> Danno wrote: >>> Thanks Gerry,
>>> When I use Disk CleanUp, (which is seldom because I use CCleaner >>> instead), I don't click the option to "remove all but the last >>> restore point". >>> I have ZoneAlarm as the anti-spyware and anti-virus software, as well >>> as ZoneAlarm's firewall.
>>> I also have AVG installed, but I don't let it run while ZoneAlarm is >>> active. I only fire up AVG once in a while but I disable ZoneAlarm >>> before I do that. >>> I also have Spybot and AdAware, but they don't run in the background >>> as far as I can tell. I only start them up once in a while as well.
>>> I also have jv16powertools, but I only use that on its safest mode to >>> clean the registry once in a while.
>>>> Your original disk space setting for System Restore was OK and >>>> unlikely to be the cause of the problem. Turning off System Restore >>>> removes all restore points. Using the System Restore option on the >>>> More Options tab of Disk CleanUp removes all except the latest >>>> restore point. What are your anti-virus and anti-spyware arrangements? >>>> Also what >>>> firewall are you using? These can interfere with System Restore.
>>>> Gerry >>>> ~~~~ >>>> FCA >>>> Stourport, England >>>> Enquire, plan and execute >>>> ~~~~~~~~~~~~~~~~~~~ >>>> Danno wrote: >>>>> Thanks for the input Dave. My hard drive has 25 gig available out >>>>> of 40. I knew that turning off SR would delete all but the last >>>>> restore point, but since I only had one restore point.... nothing >>>>> to lose. I'll try it by increasing the amount of space available >>>>> once more, but I doubt that will work because even when I'd allocated >>>>> 12% space >>>>> (default) rather than 3% (which should be plenty), the same thing >>>>> was happening. >>>>> Danno
>>>>>>> I have the system restore turned on. The space I've allowed for >>>>>>> storage is 3% or 1075 MB.
>>>>>>> But System Restore is only keeping one restore point. When it >>>>>>> creates another automatically, it deletes the previous restore >>>>>>> point, so basically, it's of no value right now. If I create a >>>>>>> restore point manually, the previous restore point is kept.... at >>>>>>> least right now I have two restore points from today, because I >>>>>>> just created one. But when SR creates a new restore point >>>>>>> automatically, all previous SR points will be deleted.
>>>>>>> I've turned off System Restore, re-booted... then turned on System >>>>>>> Restore and re-booted again. But it's still the same.
>>>>>>> I'd sure appreciate any tips on this issue.
>>>>>> How much free space is on your drive? Assuming it's at least 30%, >>>>>> how about increasing your SR storage size to 10% to see what >>>>>> happens? BTW, turning off System Restore will delete restore >>>>>> points!
> This happened to me once because a granddaughter downloaded and > installed a program after being told not to download anything. > My approach to this is to clean out the startup folder. (start-- > run --msconfig---and remove all checks in start up. > Let the system load only Microsoft programs such as OE IE etc. Then > add one or two programs back till you find the offending program. > The offending program (in my case) was doing this to prevent > uninstalling it.
> Yesterday there was one restore point which had been created > automatically by the system. That was the only restore point > available. So I created two new restore points throughout the day, > to see if the SR would delete all but the last restore point once > again. Today, I updated a driver and at that point in time, SR > created a restore point, and when it did that.... it deleted the last > restore point which had been created automatically, and deleted one > of my two test restore points. The net result today is that there > are two restore points only.... one of my own points and an automatic > restore point created when I updated the driver. > I'd sure appreciate any other suggestions or input.
>> What version of Zone Alarm do you have? There were problems with >> version 6.5.
>> What drives do you have System Restore set to monitor? Do you have an >> external or removable drive?
>> You cannot cCleaner to remove unwanted restore points. In other ways >> cCleaner does a more thorough job than Disk CleanUp.
>> --
>> Hope this helps.
>> Gerry >> ~~~~ >> FCA >> Stourport, England >> Enquire, plan and execute >> ~~~~~~~~~~~~~~~~~~~
>> Danno wrote: >>> Thanks Gerry,
>>> When I use Disk CleanUp, (which is seldom because I use CCleaner >>> instead), I don't click the option to "remove all but the last >>> restore point". >>> I have ZoneAlarm as the anti-spyware and anti-virus software, as >>> well as ZoneAlarm's firewall.
>>> I also have AVG installed, but I don't let it run while ZoneAlarm is >>> active. I only fire up AVG once in a while but I disable ZoneAlarm >>> before I do that. >>> I also have Spybot and AdAware, but they don't run in the background >>> as far as I can tell. I only start them up once in a while as well.
>>> I also have jv16powertools, but I only use that on its safest mode >>> to clean the registry once in a while.
>>>> Your original disk space setting for System Restore was OK and >>>> unlikely to be the cause of the problem. Turning off System Restore >>>> removes all restore points. Using the System Restore option on the >>>> More Options tab of Disk CleanUp removes all except the latest >>>> restore point. What are your anti-virus and anti-spyware >>>> arrangements? Also what >>>> firewall are you using? These can interfere with System Restore.
>>>> Gerry >>>> ~~~~ >>>> FCA >>>> Stourport, England >>>> Enquire, plan and execute >>>> ~~~~~~~~~~~~~~~~~~~ >>>> Danno wrote: >>>>> Thanks for the input Dave. My hard drive has 25 gig available out >>>>> of 40. I knew that turning off SR would delete all but the last >>>>> restore point, but since I only had one restore point.... nothing >>>>> to lose. I'll try it by increasing the amount of space available >>>>> once more, but I doubt that will work because even when I'd >>>>> allocated 12% space >>>>> (default) rather than 3% (which should be plenty), the same thing >>>>> was happening. >>>>> Danno
>>>>>>> I have the system restore turned on. The space I've allowed for >>>>>>> storage is 3% or 1075 MB.
>>>>>>> But System Restore is only keeping one restore point. When it >>>>>>> creates another automatically, it deletes the previous restore >>>>>>> point, so basically, it's of no value right now. If I create a >>>>>>> restore point manually, the previous restore point is kept.... >>>>>>> at least right now I have two restore points from today, >>>>>>> because I just created one. But when SR creates a new restore >>>>>>> point automatically, all previous SR points will be deleted.
>>>>>>> I've turned off System Restore, re-booted... then turned on >>>>>>> System Restore and re-booted again. But it's still the same.
>>>>>>> I'd sure appreciate any tips on this issue.
>>>>>> How much free space is on your drive? Assuming it's at least 30%, >>>>>> how about increasing your SR storage size to 10% to see what >>>>>> happens? BTW, turning off System Restore will delete restore >>>>>> points!
ZoneAlarm version 7.0.743.000 may be the Freeware Firewall, but that's the version I got when I paid good money for it (about 6 weeks ago). The entire list of versions that came with ZA's suite are as follows:
ZoneAlarm Security Suite version:7.0.473.000 TrueVector version:7.0.473.000 Driver version:7.0.473.000 Anti-virus engine version:3 Anti-virus SDK version:5.0.1.85 Anti-virus signature DAT file version:951551049 Anti-spyware engine version:5.0.189.0 Anti-spyware signature DAT file version:01.200805.3945 AntiSpam version:5.0.6.8903
Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and use the built in Windows firewall... just to test if ZA is involved in any way with my dilemma.
p.s.: when you get time, get your butt over here to western Canada for a visit :-)
> You should not be using a registry cleaner. I would dump jv16powertools.
> ZoneAlarm 7.0.743.000 is the Freeware Firewall. What version is your > anti-spyware?
> --
> Hope this helps.
> Gerry > ~~~~ > FCA > Stourport, England > Enquire, plan and execute > ~~~~~~~~~~~~~~~~~~~
> Danno wrote: >> Dang... it did it again!
>> Yesterday there was one restore point which had been created >> automatically by the system. That was the only restore point >> available. So I created two new restore points throughout the day, >> to see if the SR would delete all but the last restore point once >> again. Today, I updated a driver and at that point in time, SR >> created a restore point, and when it did that.... it deleted the last >> restore point which had been created automatically, and deleted one >> of my two test restore points. The net result today is that there >> are two restore points only.... one of my own points and an automatic >> restore point created when I updated the driver. >> I'd sure appreciate any other suggestions or input.
>>> What version of Zone Alarm do you have? There were problems with >>> version 6.5.
>>> What drives do you have System Restore set to monitor? Do you have an >>> external or removable drive?
>>> You cannot cCleaner to remove unwanted restore points. In other ways >>> cCleaner does a more thorough job than Disk CleanUp.
>>> --
>>> Hope this helps.
>>> Gerry >>> ~~~~ >>> FCA >>> Stourport, England >>> Enquire, plan and execute >>> ~~~~~~~~~~~~~~~~~~~
>>> Danno wrote: >>>> Thanks Gerry,
>>>> When I use Disk CleanUp, (which is seldom because I use CCleaner >>>> instead), I don't click the option to "remove all but the last >>>> restore point". >>>> I have ZoneAlarm as the anti-spyware and anti-virus software, as >>>> well as ZoneAlarm's firewall.
>>>> I also have AVG installed, but I don't let it run while ZoneAlarm is >>>> active. I only fire up AVG once in a while but I disable ZoneAlarm >>>> before I do that. >>>> I also have Spybot and AdAware, but they don't run in the background >>>> as far as I can tell. I only start them up once in a while as well.
>>>> I also have jv16powertools, but I only use that on its safest mode >>>> to clean the registry once in a while.
>>>>> Your original disk space setting for System Restore was OK and >>>>> unlikely to be the cause of the problem. Turning off System Restore >>>>> removes all restore points. Using the System Restore option on the >>>>> More Options tab of Disk CleanUp removes all except the latest >>>>> restore point. What are your anti-virus and anti-spyware >>>>> arrangements? Also what >>>>> firewall are you using? These can interfere with System Restore.
>>>>> Gerry >>>>> ~~~~ >>>>> FCA >>>>> Stourport, England >>>>> Enquire, plan and execute >>>>> ~~~~~~~~~~~~~~~~~~~ >>>>> Danno wrote: >>>>>> Thanks for the input Dave. My hard drive has 25 gig available out >>>>>> of 40. I knew that turning off SR would delete all but the last >>>>>> restore point, but since I only had one restore point.... nothing >>>>>> to lose. I'll try it by increasing the amount of space available >>>>>> once more, but I doubt that will work because even when I'd >>>>>> allocated 12% space >>>>>> (default) rather than 3% (which should be plenty), the same thing >>>>>> was happening. >>>>>> Danno
>>>>>>>> I have the system restore turned on. The space I've allowed for >>>>>>>> storage is 3% or 1075 MB.
>>>>>>>> But System Restore is only keeping one restore point. When it >>>>>>>> creates another automatically, it deletes the previous restore >>>>>>>> point, so basically, it's of no value right now. If I create a >>>>>>>> restore point manually, the previous restore point is kept.... >>>>>>>> at least right now I have two restore points from today, >>>>>>>> because I just created one. But when SR creates a new restore >>>>>>>> point automatically, all previous SR points will be deleted.
>>>>>>>> I've turned off System Restore, re-booted... then turned on >>>>>>>> System Restore and re-booted again. But it's still the same.
>>>>>>>> I'd sure appreciate any tips on this issue.
>>>>>>> How much free space is on your drive? Assuming it's at least 30%, >>>>>>> how about increasing your SR storage size to 10% to see what >>>>>>> happens? BTW, turning off System Restore will delete restore >>>>>>> points!
> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and use the > built in Windows firewall... just to test if ZA is involved in any way with > my dilemma.
Very, very sensible approach; IMO, ZA is not worth having. I'd uninstall the entire ZA suite for good and ask for a refund. If uninstalling via the Add/Remove program does not work satisfactory then go to: http://zonealarm.donhoover.net/uninstall.html
Consider the following: For the average homeuser, the Windows Firewall in XP does a fantastic job at its core mission and is really all you need if you have an 'real-time' anti-virus program, [another firewall on your router or] other edge protection like SeconfigXP and practise safe-hex. The windows firewall deals with inbound protection and therefore does not give you a false sense of security. Best of all, it doesn't implement lots of nonsense like pretending that outbound traffic needs to be monitored.
Real-time AV applications - for viral malware. Do not utilize more than one (1) real-time anti-virus scanning engine! Disable the e-mail scanning function during installation (Custom Installation on some AV apps.) as it provides no additional protection.
Avira AntiVir® Personal - FREE Antivirus http://www.free-av.com/ You may wish to consider removing the 'AntiVir Nagscreen' http://www.elitekiller.com/files/disable_antivir_nag.htm or Free antivirus - avast! 4 Home Edition It includes ANTI-SPYWARE protection, certified by the West Coast Labs Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in class GMER technology. http://www.avast.com/eng/avast_4_home.html (Choose Custom Installation and under Resident Protection, uncheck: Internet Mail and Outlook/Exchange.) or AVG Anti-Virus Free Edition http://free.grisoft.com/ (Choose custom install and untick the email scanner plugin.)
A-S applications - for non-viral malware. The effectiveness of an individual A-S scanners can be wide-ranging and oftentimes a collection of scanners is best. There isn't one software that cleans and immunizes you against everything. That's why you need multiple products to do the job i.e. overlap their coverage - one may catch what another may miss, (grab'em all).
Tripe written by an ex-Microsoft puppet who was in charge of security when the Microsoft firewall was designed. Of course he wouldn't admit that his brain child lacked useful features so in true Microsoft fashion he insisted that he was right and that he knew what was best for the customers, but that isn't new at Microsoft where it's corporate culture to tell the customers to shut up because Microsoft knows what is best for everybody. Of course, the chief of security in charge of designing the firewall that lacked features wanted by the customers had to educate the customers by telling them that they were dumb to ask for outbound filtering and the way to prove his point was to embark on a mission to discredit all firewalls except his beloved creation. To paraphrase one MVP: "In its firewall Microsoft designed a shirt with no sleeves and when the customers told Microsoft they wanted sleeves Microsoft embarked on a mission to convince customers they didn't want or need sleeves."
Meanwhile, customers who knew that egress filtering was not necessarily meant to strictly or only be a security measure against malware were left a bit bemused by this new mantra at Microsoft. Customers who understood the importance of data protection and who understood the benefits of controlling which applications should be permitted to send traffic outside the network were told not to concern themselves with the security of their data, Microsoft had it all under control, there was no need at all to know which applications were sending data outside the network and there was even less need to stop any applications from sending data outside the network. Of course this suited Microsoft the most, without anyone knowing what was going on Microsoft could ensure that they could have more of their brain children like WGA, Media Player, DRM and what not spy on the customers and send data to outside entities without anyone knowing what was going on, or at least without anyone without egress detection knowing what was going on.
Although egress filtering should be applied at the perimeter of the network by way of routers and firewall appliances, detection and filtering applications at a software (personal) firewall can nonetheless be a very useful tool and a very useful part of your network or computer security. Those who know better and who know the place and importance of egress detection and egress filtering take appropriate measures to protect their data and their networks, the others, knowingly or not, listen to and propagate tripe from Microsoft and its puppets. No network administrator worth his salt would neglect the security risks posed by egress traffic, SOHO and home computer users would be well advised to do the same.
Of all the links and suggestions you offered, one of them might be surprisingly helpful. Not surprising that Kelly's Korner was helpful, but a surprise to me at the result.
On Kelly's Korner, I found the category discussing missing SR points, specifically this:
- Check the event logs to investigate System Restore service errors:
1. Click Start, click Control Panel, and then click "Performance and Maintenance". 2. Click Administrative Tools, click Computer Management, double-click Event Viewer, and then click System. 3. Click the Source tab to sort by name, and then look for "sr" or "srservice." Double-click each of these services, and then evaluate the event description for any indication of the cause of the problem.
I followed the advice and lo and behold, there were descriptions of events that happened with SR. None of the events actually showed up as "errors", but none-the-less they described that SR was "suspending" and then "resuming" due to lack of space allocated and then more space being re-allocated. I was convinced that 3% or 1076MB would be plenty of space, but apparently not. If I'm not mistaken though, even when I accidentally had 12% allocated, SR was still only allowing one restore point.
So I've now allocated 10% of disc space or 3700MB to see what happens. That is an outrageously huge amount of space to allow, but I have to do it for now.
I'll let you know. Thanks again!
Danno
"Kayman" <kaymanDeleteT...@operamail.com> wrote in message
>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and use the >> built in Windows firewall... just to test if ZA is involved in any way >> with >> my dilemma.
> Very, very sensible approach; IMO, ZA is not worth having. > I'd uninstall the entire ZA suite for good and ask for a refund. > If uninstalling via the Add/Remove program does not work satisfactory then > go to: > http://zonealarm.donhoover.net/uninstall.html
> Consider the following: > For the average homeuser, the Windows Firewall in XP does a fantastic job > at its core mission and is really all you need if you have an 'real-time' > anti-virus program, [another firewall on your router or] other edge > protection like SeconfigXP and practise safe-hex. > The windows firewall deals with inbound protection and therefore does not > give you a false sense of security. Best of all, it doesn't implement lots > of nonsense like pretending that outbound traffic needs to be monitored.
> Real-time AV applications - for viral malware. > Do not utilize more than one (1) real-time anti-virus scanning engine! > Disable the e-mail scanning function during installation (Custom > Installation on some AV apps.) as it provides no additional protection.
> Avira AntiVir® Personal - FREE Antivirus > http://www.free-av.com/ > You may wish to consider removing the 'AntiVir Nagscreen' > http://www.elitekiller.com/files/disable_antivir_nag.htm > or > Free antivirus - avast! 4 Home Edition > It includes ANTI-SPYWARE protection, certified by the West Coast Labs > Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in class > GMER technology. > http://www.avast.com/eng/avast_4_home.html > (Choose Custom Installation and under Resident > Protection, uncheck: Internet Mail and Outlook/Exchange.) > or > AVG Anti-Virus Free Edition > http://free.grisoft.com/ > (Choose custom install and untick the email scanner plugin.)
> A-S applications - for non-viral malware. > The effectiveness of an individual A-S scanners can be wide-ranging and > oftentimes a collection of scanners is best. There isn't one software that > cleans and immunizes you against everything. That's why you need multiple > products to do the job i.e. overlap their coverage - one may catch what > another may miss, (grab'em all).
How many restore points are you keeping? How large are individual restore points? You should not need an allocation so large!
Can you please post a copy of the Event Viewer Information Report you refer to.
A tip for posting copies of Error Reports! Run Event Viewer and double click on the error you want to copy. In the window, which appears is a button resembling two pages. Click the button and close Event Viewer.Now start your message (email) and do a paste into the body of the message. Make sure this is the first paste after exiting from Event Viewer.
--
Hope this helps.
Gerry ~~~~ FCA Stourport, England Enquire, plan and execute ~~~~~~~~~~~~~~~~~~~
> Of all the links and suggestions you offered, one of them might be > surprisingly helpful. Not surprising that Kelly's Korner was > helpful, but a surprise to me at the result.
> On Kelly's Korner, I found the category discussing missing SR points, > specifically this:
> - Check the event logs to investigate System Restore service errors:
> 1. Click Start, click Control Panel, and then click "Performance and > Maintenance". > 2. Click Administrative Tools, click Computer Management, > double-click Event Viewer, and then click System. > 3. Click the Source tab to sort by name, and then look for "sr" or > "srservice." Double-click each of these services, and then evaluate > the event description for any indication of the cause of the problem.
> I followed the advice and lo and behold, there were descriptions of > events that happened with SR. None of the events actually showed up > as "errors", but none-the-less they described that SR was > "suspending" and then "resuming" due to lack of space allocated and > then more space being re-allocated. I was convinced that 3% or > 1076MB would be plenty of space, but apparently not. If I'm not > mistaken though, even when I accidentally had 12% allocated, SR was > still only allowing one restore point. > So I've now allocated 10% of disc space or 3700MB to see what > happens. That is an outrageously huge amount of space to allow, but > I have to do it for now.
>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>> use the built in Windows firewall... just to test if ZA is involved >>> in any way with >>> my dilemma.
>> Very, very sensible approach; IMO, ZA is not worth having. >> I'd uninstall the entire ZA suite for good and ask for a refund. >> If uninstalling via the Add/Remove program does not work >> satisfactory then go to: >> http://zonealarm.donhoover.net/uninstall.html
>> Consider the following: >> For the average homeuser, the Windows Firewall in XP does a >> fantastic job at its core mission and is really all you need if you >> have an 'real-time' anti-virus program, [another firewall on your >> router or] other edge protection like SeconfigXP and practise >> safe-hex. The windows firewall deals with inbound protection and >> therefore >> does not give you a false sense of security. Best of all, it doesn't >> implement lots of nonsense like pretending that outbound traffic >> needs to be monitored. Activate and utilize the Win XP built-in >> Firewall; Uncheck *all* >> Programs and Services under the Exception tab. >> Read through: >> Understanding Windows Firewall. >> http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintr... >> Using Windows Firewall. >> http://www.microsoft.com/windowsxp/using/networking/security/winfirew... >> Exploring the windows Firewall. >> http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirew... >> "Outbound protection is security theater-it's a gimmick that only >> gives the >> impression of improving your security without doing anything that >> actually does improve your security." >> In conjunction with WinXP Firewall use: >> Seconfig XP 1.0 >> http://seconfig.sytes.net/ >> (http://www.softpedia.com/progDownload/Seconfig-XP-Download-39707.html) >> Seconfig XP is able configure Windows not to use TCP/IP as transport >> protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, >> 137-139 and 445 (the most exploited Windows networking weak point) >> closed.) Real-time AV applications - for viral malware. >> Do not utilize more than one (1) real-time anti-virus scanning >> engine! Disable the e-mail scanning function during installation >> (Custom Installation on some AV apps.) as it provides no additional >> protection. Avira AntiVir® Personal - FREE Antivirus >> http://www.free-av.com/ >> You may wish to consider removing the 'AntiVir Nagscreen' >> http://www.elitekiller.com/files/disable_antivir_nag.htm >> or >> Free antivirus - avast! 4 Home Edition >> It includes ANTI-SPYWARE protection, certified by the West Coast Labs >> Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in >> class GMER technology. >> http://www.avast.com/eng/avast_4_home.html >> (Choose Custom Installation and under Resident >> Protection, uncheck: Internet Mail and Outlook/Exchange.) >> or >> AVG Anti-Virus Free Edition >> http://free.grisoft.com/ >> (Choose custom install and untick the email scanner plugin.)
>> A-S applications - for non-viral malware. >> The effectiveness of an individual A-S scanners can be wide-ranging >> and oftentimes a collection of scanners is best. There isn't one >> software that cleans and immunizes you against everything. That's >> why you need multiple products to do the job i.e. overlap their >> coverage - one may catch what another may miss, (grab'em all).
It's not really a matter of "how many restore points I'm keeping". It's more a case of my trying to keep more than just ONE restore point. At this moment, there are 4 restore points from yesterday, and that's it. None of those were created automatically by the system. As I mentioned, the event viewer is not actually cataloging any " errors" about system restore, but here are two examples of reports (not tagged as an "error") that are addressing what I'm experiencing:
Event Type: Information Event Source: SRService Event Category: None Event ID: 107 Date: 5/22/2008 Time: 3:37:36 AM User: N/A Computer: DANS-COMPUTER Description: The System Restore service has been suspended because there is not enough disk space available on the drive \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will automatically resume service once at least 200 MB of free disk space is available on the system drive.
Event Type: Information Event Source: SRService Event Category: None Event ID: 108 Date: 5/22/2008 Time: 4:41:13 AM User: N/A Computer: DANS-COMPUTER Description: The System Restore service has resumed monitoring due to space freed on the system drive.
For now, I've disabled ZoneAlarm and have increased the allocated disc space for SR to the maximum. As I mentioned before, I would have hoped that 3% or 1075 MB would have been plenty of space, but apparently not. Anyway, if the problem is corrected, I'd think I've probably narrowed it down to those two suspects. I'll consider the problem corrected if, two weeks from now, I can still see an available restore point that was recorded yesterday.
At your suggestion, I found the folders that hold the 4 volumes of SR points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb and 567Mb. My lord, two of those are way too big. What could be the reason for that? That would explain why 1075Mb isn't enough space to store very many SR points... if they're going to be that huge.
> How many restore points are you keeping? How large are individual restore > points? You should not need an allocation so large!
> Can you please post a copy of the Event Viewer Information Report you > refer to.
> A tip for posting copies of Error Reports! Run Event Viewer and double > click on the error you want to copy. In the window, which appears is a > button resembling two pages. Click the button and close Event > Viewer.Now start your message (email) and do a paste into the body of > the message. Make sure this is the first paste after exiting from > Event Viewer.
> --
> Hope this helps.
> Gerry > ~~~~ > FCA > Stourport, England > Enquire, plan and execute > ~~~~~~~~~~~~~~~~~~~
> Danno wrote: >> Thanks Kayman,
>> Of all the links and suggestions you offered, one of them might be >> surprisingly helpful. Not surprising that Kelly's Korner was >> helpful, but a surprise to me at the result.
>> On Kelly's Korner, I found the category discussing missing SR points, >> specifically this:
>> - Check the event logs to investigate System Restore service errors:
>> 1. Click Start, click Control Panel, and then click "Performance and >> Maintenance". >> 2. Click Administrative Tools, click Computer Management, >> double-click Event Viewer, and then click System. >> 3. Click the Source tab to sort by name, and then look for "sr" or >> "srservice." Double-click each of these services, and then evaluate >> the event description for any indication of the cause of the problem.
>> I followed the advice and lo and behold, there were descriptions of >> events that happened with SR. None of the events actually showed up >> as "errors", but none-the-less they described that SR was >> "suspending" and then "resuming" due to lack of space allocated and >> then more space being re-allocated. I was convinced that 3% or >> 1076MB would be plenty of space, but apparently not. If I'm not >> mistaken though, even when I accidentally had 12% allocated, SR was >> still only allowing one restore point. >> So I've now allocated 10% of disc space or 3700MB to see what >> happens. That is an outrageously huge amount of space to allow, but >> I have to do it for now.
>>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>>> use the built in Windows firewall... just to test if ZA is involved >>>> in any way with >>>> my dilemma.
>>> Very, very sensible approach; IMO, ZA is not worth having. >>> I'd uninstall the entire ZA suite for good and ask for a refund. >>> If uninstalling via the Add/Remove program does not work >>> satisfactory then go to: >>> http://zonealarm.donhoover.net/uninstall.html
>>> Consider the following: >>> For the average homeuser, the Windows Firewall in XP does a >>> fantastic job at its core mission and is really all you need if you >>> have an 'real-time' anti-virus program, [another firewall on your >>> router or] other edge protection like SeconfigXP and practise >>> safe-hex. The windows firewall deals with inbound protection and >>> therefore >>> does not give you a false sense of security. Best of all, it doesn't >>> implement lots of nonsense like pretending that outbound traffic >>> needs to be monitored. Activate and utilize the Win XP built-in >>> Firewall; Uncheck *all* >>> Programs and Services under the Exception tab. >>> Read through: >>> Understanding Windows Firewall. >>> http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintr... >>> Using Windows Firewall. >>> http://www.microsoft.com/windowsxp/using/networking/security/winfirew... >>> Exploring the windows Firewall. >>> http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirew... >>> "Outbound protection is security theater-it's a gimmick that only >>> gives the >>> impression of improving your security without doing anything that >>> actually does improve your security." >>> In conjunction with WinXP Firewall use: >>> Seconfig XP 1.0 >>> http://seconfig.sytes.net/ >>> (http://www.softpedia.com/progDownload/Seconfig-XP-Download-39707.html) >>> Seconfig XP is able configure Windows not to use TCP/IP as transport >>> protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, >>> 137-139 and 445 (the most exploited Windows networking weak point) >>> closed.) Real-time AV applications - for viral malware. >>> Do not utilize more than one (1) real-time anti-virus scanning >>> engine! Disable the e-mail scanning function during installation >>> (Custom Installation on some AV apps.) as it provides no additional >>> protection. Avira AntiVir® Personal - FREE Antivirus >>> http://www.free-av.com/ >>> You may wish to consider removing the 'AntiVir Nagscreen' >>> http://www.elitekiller.com/files/disable_antivir_nag.htm >>> or >>> Free antivirus - avast! 4 Home Edition >>> It includes ANTI-SPYWARE protection, certified by the West Coast Labs >>> Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in >>> class GMER technology. >>> http://www.avast.com/eng/avast_4_home.html >>> (Choose Custom Installation and under Resident >>> Protection, uncheck: Internet Mail and Outlook/Exchange.) >>> or >>> AVG Anti-Virus Free Edition >>> http://free.grisoft.com/ >>> (Choose custom install and untick the email scanner plugin.)
>>> A-S applications - for non-viral malware. >>> The effectiveness of an individual A-S scanners can be wide-ranging >>> and oftentimes a collection of scanners is best. There isn't one >>> software that cleans and immunizes you against everything. That's >>> why you need multiple products to do the job i.e. overlap their >>> coverage - one may catch what another may miss, (grab'em all).
Those two *extremely large* (600+MB) system restore points sound suspicious, just as you said. Why not clear them all out (by temporarily turning off System Restore), and then turn System Resore back on again (and create a good one) to start afresh?
And 3% should be adequate space, and would be, with good restore points (which are normally like 60 MB each - NOT 600+ MB).
> It's not really a matter of "how many restore points I'm keeping". It's > more a case of my trying to keep more than just ONE restore point. At > this > moment, there are 4 restore points from yesterday, and that's it. None of > those were created automatically by the system. As I mentioned, the event > viewer is not actually cataloging any " errors" about system restore, but > here are two examples of reports (not tagged as an "error") that are > addressing what I'm experiencing:
> Event Type: Information > Event Source: SRService > Event Category: None > Event ID: 107 > Date: 5/22/2008 > Time: 3:37:36 AM > User: N/A > Computer: DANS-COMPUTER > Description: > The System Restore service has been suspended because there is not enough > disk space available on the drive > \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will > automatically resume service once at least 200 MB of free disk space is > available on the system drive.
> Event Type: Information > Event Source: SRService > Event Category: None > Event ID: 108 > Date: 5/22/2008 > Time: 4:41:13 AM > User: N/A > Computer: DANS-COMPUTER > Description: > The System Restore service has resumed monitoring due to space freed on > the > system drive.
> For now, I've disabled ZoneAlarm and have increased the allocated disc > space > for SR to the maximum. As I mentioned before, I would have hoped that 3% > or > 1075 MB would have been plenty of space, but apparently not. Anyway, if > the > problem is corrected, I'd think I've probably narrowed it down to those > two > suspects. I'll consider the problem corrected if, two weeks from now, I > can > still see an available restore point that was recorded yesterday.
> At your suggestion, I found the folders that hold the 4 volumes of SR > points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb and > 567Mb. My lord, two of those are way too big. What could be the reason > for > that? That would explain why 1075Mb isn't enough space to store very many > SR points... if they're going to be that huge.
>> How many restore points are you keeping? How large are individual restore >> points? You should not need an allocation so large!
>> Can you please post a copy of the Event Viewer Information Report you >> refer to.
>> A tip for posting copies of Error Reports! Run Event Viewer and double >> click on the error you want to copy. In the window, which appears is a >> button resembling two pages. Click the button and close Event >> Viewer.Now start your message (email) and do a paste into the body of >> the message. Make sure this is the first paste after exiting from >> Event Viewer.
>> --
>> Hope this helps.
>> Gerry >> ~~~~ >> FCA >> Stourport, England >> Enquire, plan and execute >> ~~~~~~~~~~~~~~~~~~~
>> Danno wrote: >>> Thanks Kayman,
>>> Of all the links and suggestions you offered, one of them might be >>> surprisingly helpful. Not surprising that Kelly's Korner was >>> helpful, but a surprise to me at the result.
>>> On Kelly's Korner, I found the category discussing missing SR points, >>> specifically this:
>>> - Check the event logs to investigate System Restore service errors:
>>> 1. Click Start, click Control Panel, and then click "Performance and >>> Maintenance". >>> 2. Click Administrative Tools, click Computer Management, >>> double-click Event Viewer, and then click System. >>> 3. Click the Source tab to sort by name, and then look for "sr" or >>> "srservice." Double-click each of these services, and then evaluate >>> the event description for any indication of the cause of the problem.
>>> I followed the advice and lo and behold, there were descriptions of >>> events that happened with SR. None of the events actually showed up >>> as "errors", but none-the-less they described that SR was >>> "suspending" and then "resuming" due to lack of space allocated and >>> then more space being re-allocated. I was convinced that 3% or >>> 1076MB would be plenty of space, but apparently not. If I'm not >>> mistaken though, even when I accidentally had 12% allocated, SR was >>> still only allowing one restore point. >>> So I've now allocated 10% of disc space or 3700MB to see what >>> happens. That is an outrageously huge amount of space to allow, but >>> I have to do it for now.
>>>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>>>> use the built in Windows firewall... just to test if ZA is involved >>>>> in any way with >>>>> my dilemma.
>>>> Very, very sensible approach; IMO, ZA is not worth having. >>>> I'd uninstall the entire ZA suite for good and ask for a refund. >>>> If uninstalling via the Add/Remove program does not work >>>> satisfactory then go to: >>>> http://zonealarm.donhoover.net/uninstall.html
>>>> Consider the following: >>>> For the average homeuser, the Windows Firewall in XP does a >>>> fantastic job at its core mission and is really all you need if you >>>> have an 'real-time' anti-virus program, [another firewall on your >>>> router or] other edge protection like SeconfigXP and practise >>>> safe-hex. The windows firewall deals with inbound protection and >>>> therefore >>>> does not give you a false sense of security. Best of all, it doesn't >>>> implement lots of nonsense like pretending that outbound traffic >>>> needs to be monitored. Activate and utilize the Win XP built-in >>>> Firewall; Uncheck *all* >>>> Programs and Services under the Exception tab. >>>> Read through: >>>> Understanding Windows Firewall. >>>> http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintr... >>>> Using Windows Firewall. >>>> http://www.microsoft.com/windowsxp/using/networking/security/winfirew... >>>> Exploring the windows Firewall. >>>> http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirew... >>>> "Outbound protection is security theater-it's a gimmick that only >>>> gives the >>>> impression of improving your security without doing anything that >>>> actually does improve your security." >>>> In conjunction with WinXP Firewall use: >>>> Seconfig XP 1.0 >>>> http://seconfig.sytes.net/ >>>> (http://www.softpedia.com/progDownload/Seconfig-XP-Download-39707.html) >>>> Seconfig XP is able configure Windows not to use TCP/IP as transport >>>> protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, >>>> 137-139 and 445 (the most exploited Windows networking weak point) >>>> closed.) Real-time AV applications - for viral malware. >>>> Do not utilize more than one (1) real-time anti-virus scanning >>>> engine! Disable the e-mail scanning function during installation >>>> (Custom Installation on some AV apps.) as it provides no additional >>>> protection. Avira AntiVir® Personal - FREE Antivirus >>>> http://www.free-av.com/ >>>> You may wish to consider removing the 'AntiVir Nagscreen' >>>> http://www.elitekiller.com/files/disable_antivir_nag.htm >>>> or >>>> Free antivirus - avast! 4 Home Edition >>>> It includes ANTI-SPYWARE protection, certified by the West Coast Labs >>>> Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in >>>> class GMER technology. >>>> http://www.avast.com/eng/avast_4_home.html >>>> (Choose Custom Installation and under Resident >>>> Protection, uncheck: Internet Mail and Outlook/Exchange.) >>>> or >>>> AVG Anti-Virus Free Edition >>>> http://free.grisoft.com/ >>>> (Choose custom install and untick the email scanner plugin.)
>>>> A-S applications - for non-viral malware. >>>> The effectiveness of an individual A-S scanners can be wide-ranging >>>> and oftentimes a collection of scanners is best. There isn't one >>>> software that cleans and immunizes you against everything. That's >>>> why you need multiple products to do the job i.e. overlap their >>>> coverage - one may catch what another may miss, (grab'em all).
Yeah, those two huge SR files are ginormous. I'm really interested in two things here:
First, what in hell would cause SR to store files that big?
Secondly, since I've found those files, would I be asking for trouble to delete them manually? My guess is yes, so obviously I wouldn't do that (even if I got the green light from experts. I'd just get rid of them using SR itself). It's more a case of just wanting to know if that would be OK, or would that completely screw up the registry. I wouldn't be tempted to do it... it's just that I'm on a learning curve here. Those files are hidden for a reason, and I'm guessing it's to keep monkeys like me from playing with them.
But ultimately, I'd like to know what's in those files to make them so big.
> Those two *extremely large* (600+MB) system restore points sound > suspicious, just as you said. Why not clear them all out (by > temporarily turning off System Restore), and then turn System Resore back > on again (and create a good one) to start afresh?
> And 3% should be adequate space, and would be, with good restore points > (which are normally like 60 MB each - NOT 600+ MB).
> Danno wrote: >> Hi Gerry,
>> It's not really a matter of "how many restore points I'm keeping". It's >> more a case of my trying to keep more than just ONE restore point. At >> this >> moment, there are 4 restore points from yesterday, and that's it. None >> of >> those were created automatically by the system. As I mentioned, the >> event >> viewer is not actually cataloging any " errors" about system restore, but >> here are two examples of reports (not tagged as an "error") that are >> addressing what I'm experiencing:
>> Event Type: Information >> Event Source: SRService >> Event Category: None >> Event ID: 107 >> Date: 5/22/2008 >> Time: 3:37:36 AM >> User: N/A >> Computer: DANS-COMPUTER >> Description: >> The System Restore service has been suspended because there is not enough >> disk space available on the drive >> \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will >> automatically resume service once at least 200 MB of free disk space is >> available on the system drive.
>> Event Type: Information >> Event Source: SRService >> Event Category: None >> Event ID: 108 >> Date: 5/22/2008 >> Time: 4:41:13 AM >> User: N/A >> Computer: DANS-COMPUTER >> Description: >> The System Restore service has resumed monitoring due to space freed on >> the >> system drive.
>> For now, I've disabled ZoneAlarm and have increased the allocated disc >> space >> for SR to the maximum. As I mentioned before, I would have hoped that 3% >> or >> 1075 MB would have been plenty of space, but apparently not. Anyway, if >> the >> problem is corrected, I'd think I've probably narrowed it down to those >> two >> suspects. I'll consider the problem corrected if, two weeks from now, I >> can >> still see an available restore point that was recorded yesterday.
>> At your suggestion, I found the folders that hold the 4 volumes of SR >> points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb and >> 567Mb. My lord, two of those are way too big. What could be the reason >> for >> that? That would explain why 1075Mb isn't enough space to store very >> many >> SR points... if they're going to be that huge.
>>> How many restore points are you keeping? How large are individual >>> restore >>> points? You should not need an allocation so large!
>>> Can you please post a copy of the Event Viewer Information Report you >>> refer to.
>>> A tip for posting copies of Error Reports! Run Event Viewer and double >>> click on the error you want to copy. In the window, which appears is a >>> button resembling two pages. Click the button and close Event >>> Viewer.Now start your message (email) and do a paste into the body of >>> the message. Make sure this is the first paste after exiting from >>> Event Viewer.
>>> --
>>> Hope this helps.
>>> Gerry >>> ~~~~ >>> FCA >>> Stourport, England >>> Enquire, plan and execute >>> ~~~~~~~~~~~~~~~~~~~
>>> Danno wrote: >>>> Thanks Kayman,
>>>> Of all the links and suggestions you offered, one of them might be >>>> surprisingly helpful. Not surprising that Kelly's Korner was >>>> helpful, but a surprise to me at the result.
>>>> On Kelly's Korner, I found the category discussing missing SR points, >>>> specifically this:
>>>> - Check the event logs to investigate System Restore service errors:
>>>> 1. Click Start, click Control Panel, and then click "Performance and >>>> Maintenance". >>>> 2. Click Administrative Tools, click Computer Management, >>>> double-click Event Viewer, and then click System. >>>> 3. Click the Source tab to sort by name, and then look for "sr" or >>>> "srservice." Double-click each of these services, and then evaluate >>>> the event description for any indication of the cause of the problem.
>>>> I followed the advice and lo and behold, there were descriptions of >>>> events that happened with SR. None of the events actually showed up >>>> as "errors", but none-the-less they described that SR was >>>> "suspending" and then "resuming" due to lack of space allocated and >>>> then more space being re-allocated. I was convinced that 3% or >>>> 1076MB would be plenty of space, but apparently not. If I'm not >>>> mistaken though, even when I accidentally had 12% allocated, SR was >>>> still only allowing one restore point. >>>> So I've now allocated 10% of disc space or 3700MB to see what >>>> happens. That is an outrageously huge amount of space to allow, but >>>> I have to do it for now.
>>>>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>>>>> use the built in Windows firewall... just to test if ZA is involved >>>>>> in any way with >>>>>> my dilemma.
>>>>> Very, very sensible approach; IMO, ZA is not worth having. >>>>> I'd uninstall the entire ZA suite for good and ask for a refund. >>>>> If uninstalling via the Add/Remove program does not work >>>>> satisfactory then go to: >>>>> http://zonealarm.donhoover.net/uninstall.html
>>>>> Consider the following: >>>>> For the average homeuser, the Windows Firewall in XP does a >>>>> fantastic job at its core mission and is really all you need if you >>>>> have an 'real-time' anti-virus program, [another firewall on your >>>>> router or] other edge protection like SeconfigXP and practise >>>>> safe-hex. The windows firewall deals with inbound protection and >>>>> therefore >>>>> does not give you a false sense of security. Best of all, it doesn't >>>>> implement lots of nonsense like pretending that outbound traffic >>>>> needs to be monitored. Activate and utilize the Win XP built-in >>>>> Firewall; Uncheck *all* >>>>> Programs and Services under the Exception tab. >>>>> Read through: >>>>> Understanding Windows Firewall. >>>>> http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintr... >>>>> Using Windows Firewall. >>>>> http://www.microsoft.com/windowsxp/using/networking/security/winfirew... >>>>> Exploring the windows Firewall. >>>>> http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirew... >>>>> "Outbound protection is security theater-it's a gimmick that only >>>>> gives the >>>>> impression of improving your security without doing anything that >>>>> actually does improve your security." >>>>> In conjunction with WinXP Firewall use: >>>>> Seconfig XP 1.0 >>>>> http://seconfig.sytes.net/ >>>>> (http://www.softpedia.com/progDownload/Seconfig-XP-Download-39707.html) >>>>> Seconfig XP is able configure Windows not to use TCP/IP as transport >>>>> protocol for NetBIOS, SMB and RPC, thus leaving TCP/UDP ports 135, >>>>> 137-139 and 445 (the most exploited Windows networking weak point) >>>>> closed.) Real-time AV applications - for viral malware. >>>>> Do not utilize more than one (1) real-time anti-virus scanning >>>>> engine! Disable the e-mail scanning function during installation >>>>> (Custom Installation on some AV apps.) as it provides no additional >>>>> protection. Avira AntiVir® Personal - FREE Antivirus >>>>> http://www.free-av.com/ >>>>> You may wish to consider removing the 'AntiVir Nagscreen' >>>>> http://www.elitekiller.com/files/disable_antivir_nag.htm >>>>> or >>>>> Free antivirus - avast! 4 Home Edition >>>>> It includes ANTI-SPYWARE protection, certified by the West Coast Labs >>>>> Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in >>>>> class GMER technology. >>>>> http://www.avast.com/eng/avast_4_home.html >>>>> (Choose Custom Installation and under Resident >>>>> Protection, uncheck: Internet Mail and Outlook/Exchange.) >>>>> or >>>>> AVG Anti-Virus Free Edition >>>>> http://free.grisoft.com/ >>>>> (Choose custom install and untick the email scanner plugin.)
> Yeah, those two huge SR files are ginormous. I'm really interested in two > things here:
> First, what in hell would cause SR to store files that big?
Either something bad happened during the creation of those restore points (like some other task was running, that screwed it up, in process), OR (and this I think is a long shot - it was that large because of some HUGE amount of registry and file changes that were made since the previous restore point, and it needed that amount of disk space (but I really doubt this possibility). Well, those are the two possible explanations that come to mind for me, anyways.
> Secondly, since I've found those files, would I be asking for trouble to > delete them manually? My guess is yes, so obviously I wouldn't do that > (even if I got the green light from experts. I'd just get rid of them > using > SR itself).
Do it that way (not manually). Your hunch is right - let System Restore remove them properly (like by the way I mentioned previously), and it will do the necessary housekeeping for System Restore and its bookmarking. Don't do it manually.
> It's more a case of just wanting to know if that would be OK, > or would that completely screw up the registry. I wouldn't be tempted to > do > it... it's just that I'm on a learning curve here. Those files are hidden > for a reason, and I'm guessing it's to keep monkeys like me from playing > with them.
As I said, I would NOT do it manually. Yes, there is a chance it could work, but I sure wound NOT bank on it! (I think that could and probably would present problems for using the existing restore points that are left)
> But ultimately, I'd like to know what's in those files to make them so > big.
Outside of what I mentioned, I don't know. I suppose you could check the date-time stamps of those two bogus system restore points, and then search around on your hard drive for any suspicious file or folder activity around those dates (like the date stamps on files or folders that had changed somewhere around those dates), to see if something suspicious shows up. Kind of a long shot, however.
> "Bill in Co." <not_really_h...@earthlink.net> wrote in message > news:utqNOsevIHA.4952@TK2MSFTNGP05.phx.gbl... >> Those two *extremely large* (600+MB) system restore points sound >> suspicious, just as you said. Why not clear them all out (by >> temporarily turning off System Restore), and then turn System Resore back >> on again (and create a good one) to start afresh?
>> And 3% should be adequate space, and would be, with good restore points >> (which are normally like 60 MB each - NOT 600+ MB).
>> Danno wrote: >>> Hi Gerry,
>>> It's not really a matter of "how many restore points I'm keeping". It's >>> more a case of my trying to keep more than just ONE restore point. At >>> this >>> moment, there are 4 restore points from yesterday, and that's it. None >>> of >>> those were created automatically by the system. As I mentioned, the >>> event >>> viewer is not actually cataloging any " errors" about system restore, >>> but >>> here are two examples of reports (not tagged as an "error") that are >>> addressing what I'm experiencing:
>>> Event Type: Information >>> Event Source: SRService >>> Event Category: None >>> Event ID: 107 >>> Date: 5/22/2008 >>> Time: 3:37:36 AM >>> User: N/A >>> Computer: DANS-COMPUTER >>> Description: >>> The System Restore service has been suspended because there is not >>> enough >>> disk space available on the drive >>> \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will >>> automatically resume service once at least 200 MB of free disk space is >>> available on the system drive.
>>> Event Type: Information >>> Event Source: SRService >>> Event Category: None >>> Event ID: 108 >>> Date: 5/22/2008 >>> Time: 4:41:13 AM >>> User: N/A >>> Computer: DANS-COMPUTER >>> Description: >>> The System Restore service has resumed monitoring due to space freed on >>> the >>> system drive.
>>> For now, I've disabled ZoneAlarm and have increased the allocated disc >>> space >>> for SR to the maximum. As I mentioned before, I would have hoped that 3% >>> or >>> 1075 MB would have been plenty of space, but apparently not. Anyway, if >>> the >>> problem is corrected, I'd think I've probably narrowed it down to those >>> two >>> suspects. I'll consider the problem corrected if, two weeks from now, I >>> can >>> still see an available restore point that was recorded yesterday.
>>> At your suggestion, I found the folders that hold the 4 volumes of SR >>> points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb and >>> 567Mb. My lord, two of those are way too big. What could be the reason >>> for >>> that? That would explain why 1075Mb isn't enough space to store very >>> many >>> SR points... if they're going to be that huge.
>>>> How many restore points are you keeping? How large are individual >>>> restore >>>> points? You should not need an allocation so large!
>>>> Can you please post a copy of the Event Viewer Information Report you >>>> refer to.
>>>> A tip for posting copies of Error Reports! Run Event Viewer and double >>>> click on the error you want to copy. In the window, which appears is a >>>> button resembling two pages. Click the button and close Event >>>> Viewer.Now start your message (email) and do a paste into the body of >>>> the message. Make sure this is the first paste after exiting from >>>> Event Viewer.
>>>> --
>>>> Hope this helps.
>>>> Gerry >>>> ~~~~ >>>> FCA >>>> Stourport, England >>>> Enquire, plan and execute >>>> ~~~~~~~~~~~~~~~~~~~
>>>> Danno wrote: >>>>> Thanks Kayman,
>>>>> Of all the links and suggestions you offered, one of them might be >>>>> surprisingly helpful. Not surprising that Kelly's Korner was >>>>> helpful, but a surprise to me at the result.
>>>>> On Kelly's Korner, I found the category discussing missing SR points, >>>>> specifically this:
>>>>> - Check the event logs to investigate System Restore service errors:
>>>>> 1. Click Start, click Control Panel, and then click "Performance and >>>>> Maintenance". >>>>> 2. Click Administrative Tools, click Computer Management, >>>>> double-click Event Viewer, and then click System. >>>>> 3. Click the Source tab to sort by name, and then look for "sr" or >>>>> "srservice." Double-click each of these services, and then evaluate >>>>> the event description for any indication of the cause of the problem.
>>>>> I followed the advice and lo and behold, there were descriptions of >>>>> events that happened with SR. None of the events actually showed up >>>>> as "errors", but none-the-less they described that SR was >>>>> "suspending" and then "resuming" due to lack of space allocated and >>>>> then more space being re-allocated. I was convinced that 3% or >>>>> 1076MB would be plenty of space, but apparently not. If I'm not >>>>> mistaken though, even when I accidentally had 12% allocated, SR was >>>>> still only allowing one restore point. >>>>> So I've now allocated 10% of disc space or 3700MB to see what >>>>> happens. That is an outrageously huge amount of space to allow, but >>>>> I have to do it for now.
>>>>>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>>>>>> use the built in Windows firewall... just to test if ZA is involved >>>>>>> in any way with >>>>>>> my dilemma.
>>>>>> Very, very sensible approach; IMO, ZA is not worth having. >>>>>> I'd uninstall the entire ZA suite for good and ask for a refund. >>>>>> If uninstalling via the Add/Remove program does not work >>>>>> satisfactory then go to: >>>>>> http://zonealarm.donhoover.net/uninstall.html
>>>>>> Consider the following: >>>>>> For the average homeuser, the Windows Firewall in XP does a >>>>>> fantastic job at its core mission and is really all you need if you >>>>>> have an 'real-time' anti-virus program, [another firewall on your >>>>>> router or] other edge protection like SeconfigXP and practise >>>>>> safe-hex. The windows firewall deals with inbound protection and >>>>>> therefore >>>>>> does not give you a false sense of security. Best of all, it doesn't >>>>>> implement lots of nonsense like pretending that outbound traffic >>>>>> needs to be monitored. Activate and utilize the Win XP built-in >>>>>> Firewall; Uncheck *all* >>>>>> Programs and Services under the Exception tab. >>>>>> Read through: >>>>>> Understanding Windows Firewall. >>>>>> http://www.microsoft.com/windowsxp/using/security/internet/sp2_wfintr... >>>>>> Using Windows Firewall. >>>>>> http://www.microsoft.com/windowsxp/using/networking/security/winfirew... >>>>>> Exploring the windows Firewall. >>>>>> http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirew... >>>>>> "Outbound protection is security theater-it's a gimmick that only >>>>>> gives the >>>>>> impression of improving your security without doing anything that >>>>>> actually does improve your security." >>>>>> In conjunction with WinXP Firewall use:
I opened those enormous SR restore point files and in one of them I found 190 .RDB files, each being 2.84Mb (all the same size).
And in the other huge SR file, I found 212 .RDB files and they were all the same size, also at 2.84 Mb each.
I've been searching on the net to find out what .RDB files are and to be quite honest, I'm none the wiser.
Anyway, I assume this wasn't supposed to happen? I wonder if it will happen again, next time the system automatically creates a restore point. By that I mean, next time the system creates a restore point automatically and not as a result of my causing it by downloading something... for example.
Can anybody tell me what an .RDB file is and why System Restore included them in those two huge restore point files... both on the same day? Just as an added point of interest, any defrag analysis I do always shows SR as the most fragmented files on my computer. Is this normal?
In all fairness to ZoneAlarm, I now doubt ZoneAlarm has anything to do with this.
>> Yeah, those two huge SR files are ginormous. I'm really interested in >> two >> things here:
>> First, what in hell would cause SR to store files that big?
> Either something bad happened during the creation of those restore points > (like some other task was running, that screwed it up, in process), OR > (and this I think is a long shot - it was that large because of some HUGE > amount of registry and file changes that were made since the previous > restore point, and it needed that amount of disk space (but I really doubt > this possibility). Well, those are the two possible explanations that > come to mind for me, anyways.
>> Secondly, since I've found those files, would I be asking for trouble to >> delete them manually? My guess is yes, so obviously I wouldn't do that >> (even if I got the green light from experts. I'd just get rid of them >> using >> SR itself).
> Do it that way (not manually). Your hunch is right - let System Restore > remove them properly (like by the way I mentioned previously), and it will > do the necessary housekeeping for System Restore and its bookmarking. > Don't do it manually.
>> It's more a case of just wanting to know if that would be OK, >> or would that completely screw up the registry. I wouldn't be tempted to >> do >> it... it's just that I'm on a learning curve here. Those files are >> hidden >> for a reason, and I'm guessing it's to keep monkeys like me from playing >> with them.
> As I said, I would NOT do it manually. Yes, there is a chance it could > work, but I sure wound NOT bank on it! (I think that could and probably > would present problems for using the existing restore points that are > left)
>> But ultimately, I'd like to know what's in those files to make them so >> big.
> Outside of what I mentioned, I don't know. I suppose you could check > the date-time stamps of those two bogus system restore points, and then > search around on your hard drive for any suspicious file or folder > activity around those dates (like the date stamps on files or folders that > had changed somewhere around those dates), to see if something suspicious > shows up. Kind of a long shot, however.
>> Dan
>> "Bill in Co." <not_really_h...@earthlink.net> wrote in message >> news:utqNOsevIHA.4952@TK2MSFTNGP05.phx.gbl... >>> Those two *extremely large* (600+MB) system restore points sound >>> suspicious, just as you said. Why not clear them all out (by >>> temporarily turning off System Restore), and then turn System Resore >>> back >>> on again (and create a good one) to start afresh?
>>> And 3% should be adequate space, and would be, with good restore points >>> (which are normally like 60 MB each - NOT 600+ MB).
>>> Danno wrote: >>>> Hi Gerry,
>>>> It's not really a matter of "how many restore points I'm keeping". >>>> It's >>>> more a case of my trying to keep more than just ONE restore point. At >>>> this >>>> moment, there are 4 restore points from yesterday, and that's it. None >>>> of >>>> those were created automatically by the system. As I mentioned, the >>>> event >>>> viewer is not actually cataloging any " errors" about system restore, >>>> but >>>> here are two examples of reports (not tagged as an "error") that are >>>> addressing what I'm experiencing:
>>>> Event Type: Information >>>> Event Source: SRService >>>> Event Category: None >>>> Event ID: 107 >>>> Date: 5/22/2008 >>>> Time: 3:37:36 AM >>>> User: N/A >>>> Computer: DANS-COMPUTER >>>> Description: >>>> The System Restore service has been suspended because there is not >>>> enough >>>> disk space available on the drive >>>> \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will >>>> automatically resume service once at least 200 MB of free disk space is >>>> available on the system drive.
>>>> Event Type: Information >>>> Event Source: SRService >>>> Event Category: None >>>> Event ID: 108 >>>> Date: 5/22/2008 >>>> Time: 4:41:13 AM >>>> User: N/A >>>> Computer: DANS-COMPUTER >>>> Description: >>>> The System Restore service has resumed monitoring due to space freed on >>>> the >>>> system drive.
>>>> For now, I've disabled ZoneAlarm and have increased the allocated disc >>>> space >>>> for SR to the maximum. As I mentioned before, I would have hoped that >>>> 3% >>>> or >>>> 1075 MB would have been plenty of space, but apparently not. Anyway, >>>> if >>>> the >>>> problem is corrected, I'd think I've probably narrowed it down to those >>>> two >>>> suspects. I'll consider the problem corrected if, two weeks from now, >>>> I >>>> can >>>> still see an available restore point that was recorded yesterday.
>>>> At your suggestion, I found the folders that hold the 4 volumes of SR >>>> points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb >>>> and >>>> 567Mb. My lord, two of those are way too big. What could be the >>>> reason >>>> for >>>> that? That would explain why 1075Mb isn't enough space to store very >>>> many >>>> SR points... if they're going to be that huge.
>>>>> How many restore points are you keeping? How large are individual >>>>> restore >>>>> points? You should not need an allocation so large!
>>>>> Can you please post a copy of the Event Viewer Information Report you >>>>> refer to.
>>>>> A tip for posting copies of Error Reports! Run Event Viewer and double >>>>> click on the error you want to copy. In the window, which appears is a >>>>> button resembling two pages. Click the button and close Event >>>>> Viewer.Now start your message (email) and do a paste into the body of >>>>> the message. Make sure this is the first paste after exiting from >>>>> Event Viewer.
>>>>> --
>>>>> Hope this helps.
>>>>> Gerry >>>>> ~~~~ >>>>> FCA >>>>> Stourport, England >>>>> Enquire, plan and execute >>>>> ~~~~~~~~~~~~~~~~~~~
>>>>> Danno wrote: >>>>>> Thanks Kayman,
>>>>>> Of all the links and suggestions you offered, one of them might be >>>>>> surprisingly helpful. Not surprising that Kelly's Korner was >>>>>> helpful, but a surprise to me at the result.
>>>>>> On Kelly's Korner, I found the category discussing missing SR points, >>>>>> specifically this:
>>>>>> - Check the event logs to investigate System Restore service errors:
>>>>>> 1. Click Start, click Control Panel, and then click "Performance and >>>>>> Maintenance". >>>>>> 2. Click Administrative Tools, click Computer Management, >>>>>> double-click Event Viewer, and then click System. >>>>>> 3. Click the Source tab to sort by name, and then look for "sr" or >>>>>> "srservice." Double-click each of these services, and then evaluate >>>>>> the event description for any indication of the cause of the problem.
>>>>>> I followed the advice and lo and behold, there were descriptions of >>>>>> events that happened with SR. None of the events actually showed up >>>>>> as "errors", but none-the-less they described that SR was >>>>>> "suspending" and then "resuming" due to lack of space allocated and >>>>>> then more space being re-allocated. I was convinced that 3% or >>>>>> 1076MB would be plenty of space, but apparently not. If I'm not >>>>>> mistaken though, even when I accidentally had 12% allocated, SR was >>>>>> still only allowing one restore point. >>>>>> So I've now allocated 10% of disc space or 3700MB to see what >>>>>> happens. That is an outrageously huge amount of space to allow, but >>>>>> I have to do it for now.
>>>>>>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and >>>>>>>> use the built in Windows firewall... just to test if ZA is involved >>>>>>>> in any way with >>>>>>>> my dilemma.
>>>>>>> Very, very sensible approach; IMO, ZA is not worth having. >>>>>>> I'd uninstall the entire ZA suite for good and ask for a refund. >>>>>>> If uninstalling via the Add/Remove program does not work >>>>>>> satisfactory then go to: >>>>>>> http://zonealarm.donhoover.net/uninstall.html
On Sat, 24 May 2008 16:09:10 GMT, Danno wrote: > Thanks Kayman,
> Of all the links and suggestions you offered, one of them might be > surprisingly helpful. Not surprising that Kelly's Korner was helpful, but a > surprise to me at the result.
> On Kelly's Korner, I found the category discussing missing SR points, > specifically this:
> - Check the event logs to investigate System Restore service errors:
> 1. Click Start, click Control Panel, and then click "Performance and > Maintenance". > 2. Click Administrative Tools, click Computer Management, double-click Event > Viewer, and then click System. > 3. Click the Source tab to sort by name, and then look for "sr" or > "srservice." Double-click each of these services, and then evaluate the > event description for any indication of the cause of the problem.
> I followed the advice and lo and behold, there were descriptions of events > that happened with SR. None of the events actually showed up as "errors", > but none-the-less they described that SR was "suspending" and then > "resuming" due to lack of space allocated and then more space being > re-allocated. I was convinced that 3% or 1076MB would be plenty of space, > but apparently not. If I'm not mistaken though, even when I accidentally > had 12% allocated, SR was still only allowing one restore point.
> So I've now allocated 10% of disc space or 3700MB to see what happens. That > is an outrageously huge amount of space to allow, but I have to do it for > now.
>>> Maybe I should disable ZoneAlarm altogether for 3 or 4 days, and use the >>> built in Windows firewall... just to test if ZA is involved in any way >>> with >>> my dilemma.
>> Very, very sensible approach; IMO, ZA is not worth having. >> I'd uninstall the entire ZA suite for good and ask for a refund. >> If uninstalling via the Add/Remove program does not work satisfactory then >> go to: >> http://zonealarm.donhoover.net/uninstall.html
>> Consider the following: >> For the average homeuser, the Windows Firewall in XP does a fantastic job >> at its core mission and is really all you need if you have an 'real-time' >> anti-virus program, [another firewall on your router or] other edge >> protection like SeconfigXP and practise safe-hex. >> The windows firewall deals with inbound protection and therefore does not >> give you a false sense of security. Best of all, it doesn't implement lots >> of nonsense like pretending that outbound traffic needs to be monitored.
>> Real-time AV applications - for viral malware. >> Do not utilize more than one (1) real-time anti-virus scanning engine! >> Disable the e-mail scanning function during installation (Custom >> Installation on some AV apps.) as it provides no additional protection.
>> Avira AntiVir® Personal - FREE Antivirus >> http://www.free-av.com/ >> You may wish to consider removing the 'AntiVir Nagscreen' >> http://www.elitekiller.com/files/disable_antivir_nag.htm >> or >> Free antivirus - avast! 4 Home Edition >> It includes ANTI-SPYWARE protection, certified by the West Coast Labs >> Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in class >> GMER technology. >> http://www.avast.com/eng/avast_4_home.html >> (Choose Custom Installation and under Resident >> Protection, uncheck: Internet Mail and Outlook/Exchange.) >> or >> AVG Anti-Virus Free Edition >> http://free.grisoft.com/ >> (Choose custom install and untick the email scanner plugin.)
>> A-S applications - for non-viral malware. >> The effectiveness of an individual A-S scanners can be wide-ranging and >> oftentimes a collection of scanners is best. There isn't one software that >> cleans and immunizes you against everything. That's why you need multiple >> products to do the job i.e. overlap their coverage - one may catch what >> another may miss, (grab'em all).
Danno, Prior flushing the System Restore cache download and execute David Lipman's Multi-AV as suggested in my previous post. After you completed the av scans with all 4 scanning tools in safe mode, reboot, in normal mode flush System Restore cache and reboot again. Good luck.
...and follow all the hype created by Sunbelt's *Marketing Department*.
[quote] Still use the free Windows XP firewall? Unfortunately, this gives you a false sense of security. It only protects incoming traffic. But outgoing traffic, with your credit card info, social security number, bank accounts, passwords and other confidential information is not protected. The WinXP firewall will let it all go out. But... SPF will block that data if you buy the FULL version! You absolutely need a better, commercial-grade firewall. [/quote]
...a more realistic view which obviously was drafted by the head of Sunbelt's *Operations Department*.
Sunbelt Software - the vendor of Sunbelt Kerio Personal Firewall
2007-08-07: Here is the response we have received from this vendor:
[quote] Sunbelt Software is committed to providing the strongest possible security products to its customers, and we will be working to correct demonstrable issues in the Sunbelt Personal Firewall. Users can expect these and other continuing enhancements for the Sunbelt Personal Firewall in the near future.
However, we have some reservations about personal firewall "leak testing" in general. While we appreciate and support the unique value of independent security testing, we are admittedly skeptical as to just how meaningful these leak tests really are, especially as they reflect real-world environments.
The key assumption of "leak testing" -- namely, that it is somehow useful to measure the outbound protection provided by personal firewalls in cases where malware has already executed on the test box -- strikes us as a questionable basis on which to build a security assessment. Today's malware is so malicious and cleverly designed that it is often safest to regard PCs as so thoroughly compromised that nothing on the box can be trusted once the malware executes. In short, "leak testing" starts after the game is already lost, as the malware has already gotten past the inbound firewall protection.
Moreover, "leak testing" is predicated on the further assumption that personal firewalls should warn users about outbound connections even when the involved code components are not demonstrably malicious or suspicious (as is the case with the simulator programs used for "leak testing"). In fact, this kind of program design risks pop-up fatigue in users, effectively lowering the overall security of the system -- the reason developers are increasingly shunning this design for security applications.
Finally, leak testing typically relies on simulator programs, the use of which is widely discredited among respected anti-malware researchers -- and for good reason. Simulators simply cannot approximate the actual behavior of real malware in real world conditions. Furthermore, when simulators are used for anti-malware testing, the testing process is almost unavoidably tailored to fit the limitations of simulator instead of the complexity of real world conditions. What gets lost is a sense for how the tested products actually perform against live, kicking malware that exhibits behavior too complex to be captured in narrowly designed simulators. [/quote]
This (realistic) admission couldn't be more refreshing!
This is pretty eye-opening as well:
Firewall LeakTesting. Excerpts: Leo Laporte: "So the leaktest is kind of pointless." Steve Gibson: "Well,yes,... Leo: "So are you saying that there's no point in doing a leaktest anymore?" Steve: "Well, it's why I have not taken the trouble to update mine, because you..." Leo: "You can't test enough". Steve: "Well, yeah. Leo: "Right. Very interesting stuff. I guess that - my sense is, if you can't test for leaks, a software-based firewall is kind of essentially worthless."
Danno wrote: > I opened those enormous SR restore point files and in one of them I found > 190 .RDB files, each being 2.84Mb (all the same size).
> And in the other huge SR file, I found 212 .RDB files and they were all > the > same size, also at 2.84 Mb each.
> I've been searching on the net to find out what .RDB files are and to be > quite honest, I'm none the wiser.
Perhaps just for registry database (RDB) (wild guess)? What are the extensions on the other (normal) ones? Are they similar?
> Anyway, I assume this wasn't supposed to happen? I wonder if it will > happen > again, next time the system automatically creates a restore point. By > that > I mean, next time the system creates a restore point automatically and not > as a result of my causing it by downloading something... for example.
System Restore will normally create a checkpoint if you don't (and don't install anything to force one), typically in 24 hours, or so. So if you really want to know, just use your computer as normal, turn if off at night, turn it back on the next day, use it, off again that night, and see if one has been created by then.
> Can anybody tell me what an .RDB file is and why System Restore included > them in those two huge restore point files... both on the same day? Just > as > an added point of interest, any defrag analysis I do always shows SR as > the > most fragmented files on my computer. Is this normal?
I believe I recall seeing something similar, so I expect that is within the norm. Keep in mind it's around 60 MB, which uses a significant amount of clusters and sectors, so it's not all that surprising.
>>> Yeah, those two huge SR files are ginormous. I'm really interested in >>> two >>> things here:
>>> First, what in hell would cause SR to store files that big?
>> Either something bad happened during the creation of those restore points >> (like some other task was running, that screwed it up, in process), OR >> (and this I think is a long shot - it was that large because of some HUGE >> amount of registry and file changes that were made since the previous >> restore point, and it needed that amount of disk space (but I really >> doubt >> this possibility). Well, those are the two possible explanations that >> come to mind for me, anyways.
>>> Secondly, since I've found those files, would I be asking for trouble to >>> delete them manually? My guess is yes, so obviously I wouldn't do that >>> (even if I got the green light from experts. I'd just get rid of them >>> using >>> SR itself).
>> Do it that way (not manually). Your hunch is right - let System >> Restore >> remove them properly (like by the way I mentioned previously), and it >> will >> do the necessary housekeeping for System Restore and its bookmarking. >> Don't do it manually.
>>> It's more a case of just wanting to know if that would be OK, >>> or would that completely screw up the registry. I wouldn't be tempted >>> to >>> do >>> it... it's just that I'm on a learning curve here. Those files are >>> hidden >>> for a reason, and I'm guessing it's to keep monkeys like me from playing >>> with them.
>> As I said, I would NOT do it manually. Yes, there is a chance it could >> work, but I sure wound NOT bank on it! (I think that could and >> probably >> would present problems for using the existing restore points that are >> left)
>>> But ultimately, I'd like to know what's in those files to make them so >>> big.
>> Outside of what I mentioned, I don't know. I suppose you could check >> the date-time stamps of those two bogus system restore points, and then >> search around on your hard drive for any suspicious file or folder >> activity around those dates (like the date stamps on files or folders >> that >> had changed somewhere around those dates), to see if something suspicious >> shows up. Kind of a long shot, however.
>>> Dan
>>> "Bill in Co." <not_really_h...@earthlink.net> wrote in message >>> news:utqNOsevIHA.4952@TK2MSFTNGP05.phx.gbl... >>>> Those two *extremely large* (600+MB) system restore points sound >>>> suspicious, just as you said. Why not clear them all out (by >>>> temporarily turning off System Restore), and then turn System Resore >>>> back >>>> on again (and create a good one) to start afresh?
>>>> And 3% should be adequate space, and would be, with good restore points >>>> (which are normally like 60 MB each - NOT 600+ MB).
>>>> Danno wrote: >>>>> Hi Gerry,
>>>>> It's not really a matter of "how many restore points I'm keeping". >>>>> It's >>>>> more a case of my trying to keep more than just ONE restore point. At >>>>> this >>>>> moment, there are 4 restore points from yesterday, and that's it. >>>>> None >>>>> of >>>>> those were created automatically by the system. As I mentioned, the >>>>> event >>>>> viewer is not actually cataloging any " errors" about system restore, >>>>> but >>>>> here are two examples of reports (not tagged as an "error") that are >>>>> addressing what I'm experiencing:
>>>>> Event Type: Information >>>>> Event Source: SRService >>>>> Event Category: None >>>>> Event ID: 107 >>>>> Date: 5/22/2008 >>>>> Time: 3:37:36 AM >>>>> User: N/A >>>>> Computer: DANS-COMPUTER >>>>> Description: >>>>> The System Restore service has been suspended because there is not >>>>> enough >>>>> disk space available on the drive >>>>> \\?\Volume{95e0434a-0fff-11dd-8ae4-806d6172696f}\. System Restore will >>>>> automatically resume service once at least 200 MB of free disk space >>>>> is >>>>> available on the system drive.
>>>>> Event Type: Information >>>>> Event Source: SRService >>>>> Event Category: None >>>>> Event ID: 108 >>>>> Date: 5/22/2008 >>>>> Time: 4:41:13 AM >>>>> User: N/A >>>>> Computer: DANS-COMPUTER >>>>> Description: >>>>> The System Restore service has resumed monitoring due to space freed >>>>> on >>>>> the >>>>> system drive.
>>>>> For now, I've disabled ZoneAlarm and have increased the allocated disc >>>>> space >>>>> for SR to the maximum. As I mentioned before, I would have hoped that >>>>> 3% >>>>> or >>>>> 1075 MB would have been plenty of space, but apparently not. Anyway, >>>>> if >>>>> the >>>>> problem is corrected, I'd think I've probably narrowed it down to >>>>> those >>>>> two >>>>> suspects. I'll consider the problem corrected if, two weeks from now, >>>>> I >>>>> can >>>>> still see an available restore point that was recorded yesterday.
>>>>> At your suggestion, I found the folders that hold the 4 volumes of SR >>>>> points. Apparently they are the following sizes: 627Mb, 52MB, 52Mb >>>>> and >>>>> 567Mb. My lord, two of those are way too big. What could be the >>>>> reason >>>>> for >>>>> that? That would explain why 1075Mb isn't enough space to store very >>>>> many >>>>> SR points... if they're going to be that huge.
>>>>>> How many restore points are you keeping? How large are individual >>>>>> restore >>>>>> points? You should not need an allocation so large!
>>>>>> Can you please post a copy of the Event Viewer Information Report you >>>>>> refer to.
>>>>>> A tip for posting copies of Error Reports! Run Event Viewer and >>>>>> double >>>>>> click on the error you want to copy. In the window, which appears is >>>>>> a >>>>>> button resembling two pages. Click the button and close Event >>>>>> Viewer.Now start your message (email) and do a paste into the body of >>>>>> the message. Make sure this is the first paste after exiting from >>>>>> Event Viewer.
>>>>>> --
>>>>>> Hope this helps.
>>>>>> Gerry >>>>>> ~~~~ >>>>>> FCA >>>>>> Stourport, England >>>>>> Enquire, plan and execute >>>>>> ~~~~~~~~~~~~~~~~~~~
>>>>>> Danno wrote: >>>>>>> Thanks Kayman,
>>>>>>> Of all the links and suggestions you offered, one of them might be >>>>>>> surprisingly helpful. Not surprising that Kelly's Korner was >>>>>>> helpful, but a surprise to me at the result.
>>>>>>> On Kelly's Korner, I found the category discussing missing SR >>>>>>> points, >>>>>>> specifically this:
>>>>>>> - Check the event logs to investigate System Restore service errors:
>>>>>>> 1. Click Start, click Control Panel, and then click "Performance and >>>>>>> Maintenance". >>>>>>> 2. Click Administrative Tools, click Computer Management, >>>>>>> double-click Event Viewer, and then click System. >>>>>>> 3. Click the Source tab to sort by name, and then look for "sr" or >>>>>>> "srservice." Double-click each of these services, and then evaluate >>>>>>> the event description for any indication of the cause of the >>>>>>> problem.
>>>>>>> I followed the advice and lo and behold, there were descriptions of >>>>>>> events that happened with SR. None of the events actually showed up >>>>>>> as "errors", but none-the-less they described that SR was >>>>>>> "suspending" and then "resuming" due to lack of space allocated and >>>>>>> then more space being re-allocated. I was convinced that 3% or >>>>>>> 1076MB would be plenty of space, but apparently not. If I'm not >>>>>>> mistaken though, even when I accidentally had 12% allocated, SR was >>>>>>> still only allowing one restore point. >>>>>>> So I've now
Good question! The other two SR points which seem to be a normal size also contain .RDB files. One of those normal SR points contains a single .RDB file and the other normal SR point contains 3 .RDB files. All 4 of them are the same size at 2.84Mb each.... same size as the 400 .RDB files in the two enormous folders.
|
