Jump to content
Piriform Community Forums
sethm1

System restore points are missing

Recommended Posts

Windows 10

CCleaner version 5.44.6675

I successfully create manual system restore points. I typically clean the PC with CCleaner (but not the registry cleaner feature).   But when I shut down and reboot the next day, they are gone.

Is there a setting in CCleaner I need to change?

Share this post


Link to post
Share on other sites

I’ve noticed it too.
There should be two listed but they aren’t.

Share this post


Link to post
Share on other sites

Hi sethm1:

After reading your post I checked and confirmed that all of my system restore points were recently deleted.  Note that my system normally retains around 10 restore points and the oldest usually dates back a few weeks.

I'm not sure which program is responsible since I ran both CCleaner Portable 5.44.6575 and a Malwarebytes Free v3.5.1 Threat Scan on 29-Jun-2018 around 4:20 PM, but every restore point created prior to that CCleaner disk clean and subsequent MB Threat Scan was wiped from my system.  My MB scan report for 29-Jun-2018 shows there were no threats detected.  My Norton Security antivirus automatically runs a background QuickScan each time my SDS (virus) definitions are updated but there's nothing in my Norton security history to indicate that the QuickScan that ran 29-Jun-2018 @ 10:45 AM detected anything.

5b3a32848b4a1_CCleaner5_44RestorePointsAfterMBPre-Restart02Jul2018.png.b8937543d7debc8d43d23d92da598a2a.png

Control Panel | System and Maintenance | System | System Protection | System Restore confirms I only have those two newer restore points, so it's not the CCleaner anomaly Andavari mentioned <here> regarding corrupted restore points.

5b3a326ca5be0_VistaSP2TwoSystemRestorePointsasof02Jul2018.png.07ea7d4ab1d22e05381644bdfed9af8e.png

I tried running both CCleaner and a MB Threat scan today (with re-boots after each program was run) and neither removed my two recently created restore points so I can't re-create whatever caused the deletion of all my restore points a few days ago.  I also had two Norton QuickScans run on 30-Jun-2018 and those QuickScans haven't touched either restore point.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575

Share this post


Link to post
Share on other sites

Do you have Win 10 1803? (or 1709?)

There was a new 'Storage Sense' feature introduced with 1709, and some of the features and settings changed with 1803.

That may be automatically cleaning your older restore points, among other things.

You can set it to clean daily, weekly, monthly, or when Windows decides.

It should be disabled by default, but may have been turned on during the update to 1803.

If it is on then you can change the settings, or turn it off again, in Settings>System>Storage.

Here's an article about it: https://www.guidingtech.com/windows-10-storage-sense-enable/

Share this post


Link to post
Share on other sites

I can rule out:

The registry cleaner.
The windows & applications cleaner.

 

Share this post


Link to post
Share on other sites

Oh well, at least it's ruled it out as a possible cause.

I've just checked, both in CC and in Windows, and I also currently only have 2 restore points, although one is almost a month old. (From when I uninstalled and reinstalled my word processor).

EDIT-

I decided to try some testing so made 3 new restore points by different methods.

One by a script I have, one by running JRT (which creates one automatically), and one through Windows.
All 3 were created sucessfully, giving me a total of 5 RP's.

Clipboard01.gif.1a6263605b243e6cdb2cc5703f078492.gif

To try and roughly recreate  what had been said above:
I ran CCleaner (v5.44 Free) - All 5 RP's were still showing in CCleaner after cleaning.
Checking in Windows System Restore only the 3 that I had just created were showing at first - until I checked the box for 'Show more restore points' at which time all 5 were shown.
I then ran a threat scan with MB3.5 free (v3.5.1.2522) - Again all 5 RP's were still there afterwards, both in CC and in Windows.
I did a restart of Windows, all 5 RP's are still there.

So it would seem that it's not CCleaner or Malwarebytes that are removing the old Restore Points. (And as you can see from the screenshot 2 of mine are a few weeks old).
Unless there is something strangely different between our version of these programmes?

 

Share this post


Link to post
Share on other sites

To be sure: you don't have wipe free space checked off in ccleaner's windows>Advanced

Share this post


Link to post
Share on other sites

Hi nukecad:

I saw your post # 11 in sethm1's thread System Restore Points are Missing in the Malwarebytes forum which stated "My feeling is that it's 1803 removing them in the background for some reason"  but my post above shows that I have a Vista SP2 OS.

My last MB Threat Scan was run yesterday (02-Jul-2018) @ 7:55 AM and when I opened CCleaner Portable v5.44 today (without running a disk clean) I saw that all but my most recent system restore point has been wiped.

5b3bb38dad9a1_CCleaner5_44RestorePointsAfterLaunch03Jul2018.png.0a02b55217a9c7d09501b45bc2e21a72.png

I still don't know why my system restore points are disappearing but it could be happening when:

  • I run a MB Free v3.5.1-1.0.365 Threat Scan
  • I re-boot and launch CCleaner Portable  v5.44
  • I go to Control Panel | System and Maintenance | System | System Protection | System Restore and cancel the System Restore after double-checking my available restore points.
  • Norton QuickScans or some other third-party automatic scan runs in background

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575

Share this post


Link to post
Share on other sites
52 minutes ago, Nergal said:

To be sure: you don't have wipe free space checked off in ccleaner's windows>Advanced

Hi Nergal:

That might the cause.  Both Wipe Free Space Drives (Local Disk C:) and Wipe MFT Free Space have been enabled in my CCleaner Portable  v5.44 at Option | Settings.  I'll disable those settings and post back if it makes any difference.

5b3bb62a19ed2_CCleaner5_44WipeFreeSpace03Jul2018.png.0d83df7d10895c2769662aeeca014558.png

I'm not sure how those settings were enabled.  I copied over my ccleaner.ini file I was using with CCleaner Portable v5.43 and I'm sure they were disabled before.  Is it even normal for Wipe MFT Free Space to delete older system restore points when this setting is enabled?

I also don't have active monitoring or scheduled scanning enabled and Run CCleaner when the computer starts is also disabled, so I'm not sure why simply launching CCleaner Portable v5.44 would wipe my old system restore points, regardless of whether Wipe MFT Free Space was enabled or not.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575

Edited by lmacri
Added comment RE: automatic CCleaner scanning

Share this post


Link to post
Share on other sites

I dont have the mft  ck’d.

I thought the problem of disappearing restore points caused by  3rd party program/scan - but i think its Windows.

last nite when i logged in I created a restore point. Then another hr later. Then another.  By 10 pm - all gone !

Share this post


Link to post
Share on other sites

- Run Antibody's Wiztree. The program can pull up the size of the folder called "System Volume Information" in which the data/info for the System Restore Points (SRP) are stored. Even if the user deletes all SRPs (with e.g. CCleaner) then this folder still can contain GBs worth of data. I have come across one example where this folder still contained over 60 GB of data.

- One also has to take into account that when the amount of of free disk space is too low for making a new SRP, then Windows will delete one or more or even all SRPs.

Share this post


Link to post
Share on other sites
1 hour ago, lmacri said:

Hi Nergal:

That might the cause.  Both Wipe Free Space Drives (Local Disk C:) and Wipe MFT Free Space have been enabled in my CCleaner Portable  v5.44 at Option | Settings.  I'll disable those settings and post back if it makes any difference.

5b3bb62a19ed2_CCleaner5_44WipeFreeSpace03Jul2018.png.0d83df7d10895c2769662aeeca014558.png

I'm not sure how those settings were enabled.  I copied over my ccleaner.ini file I was using with CCleaner Portable v5.43 and I'm sure they were disabled before.  Is it even normal for Wipe MFT Free Space to delete older system restore points when this setting is enabled?

I also don't have active monitoring or scheduled scanning enabled and Run CCleaner when the computer starts is also disabled, so I'm not sure why simply launching CCleaner Portable v5.44 would wipe my old system restore points, regardless of whether Wipe MFT Free Space was enabled or not.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575

I wasn't referring to the settings but instead in the cleaning tool on the windows tab under the heading advanced, is the checkmark in wipe free space.

Share this post


Link to post
Share on other sites
1 hour ago, Nergal said:

I wasn't referring to the settings but instead in the cleaning tool on the windows tab under the heading advanced, is the checkmark in wipe free space.

Hi Nergal:

Sorry for the misunderstanding.  No, Wipe Free Space and all my other Advanced items on the Cleaner | Windows tab are always disabled.

5b3be31cc3536_CCleaner5_44AdvancedWipeFreeSpaceDisabled03Jul2018.png.f8a79b9ce36472e6fc587443fc5dca2d.png

I have a 220 GB C:\ drive with over 130 GB of free disk space, and I use the Vista SP2 default which allocates a max of 15% or 33 GB (0.15* 220 GB) of disk space before it starts overwriting older system restore points.  I also have a small 12 GB D:\ drive on my HP computer that's only intended for emergency recovery / factory resets.

5b3be3519e9a5_CCleaner5_44CDriveFreeSpace03Jul2018.png.77a472b8658d8fe01a4dad93db831f7c.png

5b3be352bca1d_CCleaner5_44CDriveAllocatedShadowcopyStorage03Jul2018.png.6c643d7772751989b835ae40efdcf201.png

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575

Share this post


Link to post
Share on other sites

@LMacri:Wiztree-SRPs.thumb.PNG.8ea50d63a9ba87bd65ce69d35035f891.PNG

- When there's too little free diskspace then Windows will delete - AFAIK - all SRPs.

- Please do run Antibody's WIZTREE as well (tree view) and make a screenshot of the treeview.

- I have 6 SRPs on my Win 7 system but I see no relationship between the 6 SRPs and the amount of subfolders in "System Volume Information". See picture attached.

- As said before sometimes when I delete all SRPs then that one folder can still contain GBs of data.

 

Share this post


Link to post
Share on other sites
31 minutes ago, Willy2 said:

...Please do run Antibody's WIZTREE as well (tree view) and make a screenshot of the treeview...

Hi Willy2:

I normally use the portable version of Jam Software's TreeSize Free - hope that's OK.  I already checked my System Volume Information folder with that utility and didn't notice anything unusual (besides the fact that it only uses 1.8 GB and I only have the one restore point created 02-Jul-2018 shown <here> instead of my usual 10 or so).

5b3c0c22031de_CCleaner5_44TreeSizeSystemVolumeInformation03Jul2018.thumb.png.5142d961d3bf433c9a44ffb8d5b78ed4.png

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Share this post


Link to post
Share on other sites

I found some recent recent volsnap errors logged in my Windows Event Viewer, and according to the StackExchange SuperUser thread volsnap: The shadow copies of volume C: were aborted because of an IO failure on volume C: these Event 14 errors occur when there is no space left for shadow copies to function correctly (i.e., current usage has exceeded the maximum space allocated for system restore points).

I also noticed that my recent volsnap errors occurred if my system was trying to automatically create a system restore point on the same dates that I ran a CCleaner disk clean followed by a Malwarebytes Threat Scan.  That still points to a problem with either CCleaner v5.44 or MB Free v3.5.1 (or some odd combination of both), but I've been running those two programs in tandem while troubleshooting this past week so I'll have to do more testing to see if I can isolate which program is causing the problem.  It still seems more likely to me that there's a glitch in my CCleaner Portable  - perhaps a corrupted cleaner.ini file that causes CCleaner to run a Wipe Free Space on my hard drive even when the configuration setting is disabled.

5b3cc5ff95fb3_VistaSP2EventViewerVolsnapError14Edited02Jul2018.png.e765bd674cd98bb8cf53c01d868e7a4f.png

5b3cc626a9989_MBv3_5_1RecentThreatScansasof04Jul2018.png.7e2b11bd12dea1e9d33a584e2a74e1fe.png

-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Share this post


Link to post
Share on other sites

I removed Malwarebytes but still have the problem.  I have not yet removed Ccleaner.

An odd thing is that yesterday a short day at work, so came home and began toying with the PC. Created a manual restore point and all seemed fine until the evening. So IS something on the system wiping points out after 6pm or just a big coincidence?

anything noticble from my Wiztree scan?

Share this post


Link to post
Share on other sites
1 hour ago, sethm1 said:

I removed Malwarebytes but still have the problem.  I have not yet removed Ccleaner....Created a manual restore point and all seemed fine until the evening. So IS something on the system wiping points out after 6pm or just a big coincidence?

Hi sethm1:

On my system it looks like the restore points are being wiped out the first time my Vista SP2 OS tries to automatically create a scheduled restore point after CCleaner (or Malwarebytes, if it's involved somehow) runs a scan.  The creation of that new restore point (and deletion of the older restore points) could happen several hours after CCleaner runs a scan  (note the time gaps between my CCleaner/Malwarebytes scans and the volsnap errors in my images <above>).  I assume that's why I can still see my old restore points immediately after I've run CCleaner and/or Malwarebytes - because the older restore points aren't purged until my system runs an automated task that tries to create a new restore point. I haven't determined yet if the creation of the new restore point is enough to trigger the deletion of my older restore points or if my system also requires a re-boot before the older restore points are purged to free up allocated disk space.

One question for you.  Further to your recent thread Help removing all of Norton I.S. in the Norton forum, did you install a different antivirus recently, and if so do you know know if it has built-in disk cleaning or if the antivirus installer came bundled with some utility like AVG PC Tune-up? The automated reply in post # 2 of your Malwarebytes thread has instructions on how to collected diagnostic logs using the Malwarebytes Support Tool (expand the section titled "If you are having technical issues...") and it would be helpful if you could post the requested mbst-grab-results.zip file in your Malwarebytes thread.  I'm subscribed to that Malwarebytes thread so I'll know when you post there, and the Farbar (FRST) diagnostic logs inside that zipped file will show us some of the other third-party software installed on your computer.

EDIT:

...and since you've been running Malwarebytes and SuperAntiSpyware scans recently, do you have any reason to believe that you might have malware on your system that could be deleting your restore points?
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Edited by lmacri
Added question RE: possible malware infection

Share this post


Link to post
Share on other sites

Attaching the log.  And regarding the mention of the tool in that #2 post you mentioned. I thought it was part of an add, so I overlooked it.

Also including Webroot system scan.  (only one issue found - something about explorer.exe - but not clear what exactly).

I am about to uninstall CCleaner.  The manual restore points from this am are gone already so the mention above about 6pm not a factor or a clue.  And I got rid of Norton as it was causing a lot of other issues.  And not sure if restore points missing then as was not paying attention. Also since then, one of the microsoft solutios was to turn off the System Restore Point feature - so of course any old ones I had are long gone.  Now using Webroot Secure Anyware - as it came with the Best Buy Geek squad 1 yr protection.  If after removing CCleaner my just now created restore point is missing in 2 hrs, then I'll remove Webroot and use the Windows Defender. If still then same restore problem with Defender - then this must be a Windows OS issue.  I may not be back on the forum for another 2 yrs...

mbst-clean-results.txt

SysAnalyzerLog-Wed_2018-07-04_12-59-56.log

Edited by sethm1
added a 2nd log

Share this post


Link to post
Share on other sites
1 hour ago, sethm1 said:

...Now using Webroot Secure Anyware - as it came with the Best Buy Geek squad 1 yr protection..

Hi sethm1:

The Malwarebytes mbst-clean-results.txt file wasn't the log I was looking for - it looks like you used the Malwarebytes Support Tool to remove Malwarebytes (the Clean button) instead of gathering diagnostic logs (the Gather button). They probably won't be able to do much to help you over in the Malwarebytes forum if you uninstalled their product before gathering Malwarebytes / Farbar Recovery Scan Tool (FRST) diagnostic logs with the Malwarebytes Support Tool but I wouldn't worry about it unless someone in that forum asks for new set of diagnostic logs.  I'm not a certified MSCE technician but I'll take a quick look through the system information log you provided above and post back if I notice anything that's an obvious concern.

I don't know much about Webroot SecureAnywhere but the home page at https://www.webroot.com/ca/en/home/products/complete does mention that it comes with a feature called System Optimizer that "also reclaims hard drive space and improves performance by deleting unnecessary files" .  You might want to check through your Webroot System Optimizer settings (Advanced Settings | System Optimizer) and then see if you have any Webroot System Optimizer disk cleans scheduled to run automatically (Advanced Settings |  Scheduler | System Optimizer or Utilities | System Optimizer | Schedule) that could be wiping your older restore points.

Just an FYI that I visited the FileHippo site today and https://filehippo.com/download_ccleaner/ shows that a new CCleaner v5.44.6577 was released today (04-Jul-2018), but when I checked the official CCleaner release history at http://www.ccleaner.com/ccleaner/version-history it still lists v5.44.6575 (released 26-Jun-2018) as the latest available version.  I haven't seen any information yet on why a new v5.44.6577 installer was posted on the Avast/Piriform FTP servers or if the newer version includes a minor bug fix.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Share this post


Link to post
Share on other sites
On 7/2/2018 at 10:17, nukecad said:

...There was a new 'Storage Sense' feature introduced with 1709, and some of the features and settings changed with 1803.  That may be automatically cleaning your older restore points, among other things....It should be disabled by default, but may have been turned on during the update to 1803...

If it is on then you can change the settings, or turn it off again, in Settings>System>Storage.

Here's an article about it: https://www.guidingtech.com/windows-10-storage-sense-enable/

HI sethm1:

...and further to nukecad's 02-Jul-2018 comment, did you ever confirm that your Win 10 Storage Sense feature is disabled?  Version updates in Win 10 (e.g., 1709 to 1803) are especially notorious for changing configuration settings without the users knowledge.  Win 8.x and Win 10 users posting in the Norton forum are frequently asked to disable the Fast Startup feature because this hybrid shutdown / boot feature can interfere with the loading of Norton services at boot-up and causes all sorts of odd glitches with Norton security programs (and many other third-party software programs), and it's not unusual for Fast Startup to re-enable itself after a major Win 10 update.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.14.2.13 * Malwarebytes v3.5.1-1.0.365 * CCleaner Portable 5.44.6575 * TreeSize Free Portable v4.1.2.407

Edited by lmacri
Added link to Fast Startup information

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×