MSFN Forum: [Solved] Win 98/98SE System Restore - MSFN Forum

Jump to content


  • 3 Pages +
  • 1
  • 2
  • 3
  • You cannot start a new topic
  • You cannot reply to this topic

[Solved] Win 98/98SE System Restore How To From Windows ME CD? - Got it working! Rate Topic: -----

#21 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 26 February 2011 - 08:56 AM

View Postduffy98, on 26 February 2011 - 08:31 AM, said:

Well I installed SR on my third computer today and it was also a failure ... getting that Dec 30, 1899 date again. I'm not sure if I understand what you are saying about changing the date ... my date and time are correct, that's the first thing I checked in the lower right hand corner. I was hoping that would be the solution, somehow the date was out of sync but the date was just fine and when I do a restore point it will tell me the correct date and time when SR has completed doing the restore point ... that is all just fine but when I ask to see earlier restore points, it tells me there are no restore points available and there are none after Saturday, December 30, 1899. This was a Dell notebook and the other was an IBM Thinkpad that have the crazy 1899 date ... The Toshiba SR setup is just fine ... all computers are set up the same, the company drivers being different I guess ... but I have pretty much the same programs installed on each computer.

Try this link
http://support.microsoft.com/kb/275646

This post has been edited by PROBLEMCHYLD: 26 February 2011 - 09:01 AM



#22 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 26 February 2011 - 09:59 AM

You rock PROBLEMCHYLD ! ... there, gave it back to you ... that could be the solution, especially since it matches the exact 1899 date problem on my computer. I will try the registry fix out later today ... so there is still hope SR will work on those notebooks. I guess I should have thought to check that date thing out more on Google but I wanted to wait till I install SR on my NEC computer later today and see how that went. I just figured there must be a software conflict or something. Thanks again ... I will try it all out later today.


extra ... that registry fix also may solve another problem .... I didn't mention it earlier, went I went into the Help section to look for help on the date thing, the pages were blank and this information is added at the bottom of the link you provided:

The absent registry key may also cause blank pages to be displayed in Windows Me Help and Support. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

Q275651 Blank Pages in Windows Me Help and Support

This post has been edited by dencorso: 26 February 2011 - 12:31 PM


#23 User is offline   dencorso 

  • Adiuvat plus qui nihil obstat
  • Group: Super Moderator
  • Posts: 4,864
  • Joined: 07-April 07
  • OS:98SE
  • Country: Country Flag

Posted 26 February 2011 - 12:34 PM

View PostPROBLEMCHYLD, on 26 February 2011 - 08:56 AM, said:



If you decide to copy the text offered by MS and paste it to notepad, don't forget to add *two* blank lines at the end, before saving as a .reg and merging it to the registry.
It's a famous quirck of regedit.exe: the two blank lines at the end are a must... and people always forgets about them.
Adding more than two lines doesn't hurt any, too. It's two lines minimum. I've done it for you, this time, just as an example.
HTH. :)

Attached File(s)

  • Attached File  1899.zip (388bytes)
    Number of downloads: 11


#24 User is online   loblo 

  • Oldbie
  • PipPipPipPip
  • Group: Members
  • Posts: 679
  • Joined: 12-January 10
  • OS:ME
  • Country: Country Flag

Posted 26 February 2011 - 01:12 PM

One blank line at the end of a registry file always has been enough here... :w00t:

I am on Windows ME though.

Btw, whenever I (extremely rarely) install Windows ME, the first thing I do is get rid of that PC Health and System Restore. :thumbup

#25 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 26 February 2011 - 01:34 PM

Hello again ... SUCCESS !!! ... the registry fix did work on the notebook and 1899 is now gone ... there is a Restore Point dated for today and the Help Files are no longer blank pages.

Registry Fix:

REGEDIT4

[HKEY_CLASSES_ROOT\.htc]
"Content Type"="text/x-component"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/x-component]
"CLSID"="{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}"
"Extension"=".htc"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}]
@="Microsoft Html Component"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}\InProcServer32]
@="C:\WINDOWS\\SYSTEM\\MSHTML.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.htc]
"Content Type"="text/x-component"

-----------------------------------------------------------------------------------------------------------------------------------


Thanks dencorso for the advice on the blank lines ... I didn't see your post till after I ran the "fix" but luckly I had left two blank lines, I thought I had left only one, figured that was all that was needed. I did read to leave at least one blank line between REGEDIT4 and the registry fix.

Everybody Rocks !!!

loblo ... yes I know a lot of people seem to turn SR off or get rid of it, at least that's what I've read ... but this was a challenge and I wanted to see it through. I'll see if I get any benefits from using it and how it works.

This post has been edited by duffy98: 26 February 2011 - 01:37 PM


#26 User is offline   dencorso 

  • Adiuvat plus qui nihil obstat
  • Group: Super Moderator
  • Posts: 4,864
  • Joined: 07-April 07
  • OS:98SE
  • Country: Country Flag

Posted 26 February 2011 - 02:29 PM

View Postloblo, on 26 February 2011 - 01:12 PM, said:

One blank line at the end of a registry file always has been enough here... :w00t:

One is usually enough. Two is bullet-proof!

View Postloblo, on 26 February 2011 - 01:12 PM, said:

Btw, whenever I (extremely rarely) install Windows ME, the first thing I do is get rid of that PC Health and System Restore. :thumbup

I do, too! On Win ME (with OPPCOMME) and on Win XP (together with WFP and DEP). (And I'm trying to find out how to do it on 7... But that's way off-topic! :blushing:) I consider SR a nuisance to be avoided (I do create system and data images regularly, as back-ups, obsessively, though), but grant it may be useful to some. And, yes, I do appreciate it was a worthy challenge to port it to Win 98 FE/SE, of course!

Now, credit where credit's due: although I did patch that one VxD at his request (and never touched it afterwards), System Restore on Win 98 FE/SE always was ProblemChyld's project, and it was only due to his research, persistence and hard work that it came int being. So all kudos ought to go to him. And to duffy98 who first tested it on various other machines, proving it's mature. This thread is now listed in the Important / "Stickified" / Pinned Windows 95/98/98 SP1/98 SE/ME Topics list, as warranted. :yes:

But now that things are working and the main issues identifyed and solved, I'd like to ask duffy98 to write a wrap-up post, a one-post how-to, to help other users who may be willing to try it on their systems. I reckon there are many important details scattered throughout this thread (and maybe the previous one quoted on post #1), so a wrap-up would be most helpful.

Later edit: Thanks a lot, duffy98, for providing the one-post how-to! :thumbup

#27 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 26 February 2011 - 10:33 PM

Getting System Restore To Work On Windows 98 / 98SE

When Windows Me came along there was a new program called System Restore that Microsoft included with the OS. System Restore can provide a way to "go back" or repair damage that has occurred from a bad software install or if you installed a program to try out and then decided to remove it. However, System Restore is not a 100% guarantee that everything will be the way it was when going back to an earlier Restore Point. It can be a "hit and miss" thing ... but it may be of use to some 98 users.

Thanks to some smart and crafty MSFN Forum people ... System Restore can now work (run) on Windows 98FE / 98SE. You will need a Windows Me Installation CD, the patched version of the "vxdmon file" and the 290700usam.exe from Microsoft.

vxdmon file (patched)

290700usam.exe



If all goes well then that may be all you really need, in my case I also needed some other files and a registry fix to get System Restore up and running.

First ... extract or copy "PCHealth.inf" from your WinMe CD to C:\Windows\Inf

Then run this command:

C:\windows\rundll.exe setupx.dll,InstallHinfSection PCHealth.Install 132 C:\WINDOWS\INF\PCHealth.inf

This is where the missing files may start showing up and you will have to have the WinMe CD handy ... it will be asking for the Windows 98SE Installation Disk but you will be using the WinMe CD instead. I had trouble with these two missing files ... checksr.bat + ebdundo.exe ... so I extracted them and put them in a folder to have handy. All the other missing files should be automatically found on the WinMe CD.

After the above command has finished running, then go to Windows\System\Vmm32 and remove the "vxdmon file" and replace it with the patched "vxdmon file".

Then install "290700usam.exe" and you should be good to go. I will add here that "290700usam.exe" would not install for me until I used KernelEx Final to change the compatibility to Windows Millennium. It then installed with no problem.

The System Restore tab will be in the Start\Programs\Accessories\System Tools area.

Now there could be another problem which may or may not show up when you open System Restore. When you open the earlier Restore Points area you should be seeing a newly created Restore Point only a few minutes old ... since you just installed the System Restore program. However, you might see no Restore Points and the date Saturday December 30, 1899. Also, if you click on the "Help" tab in the upper right area, you may see only blank white pages. If you are seeing the 1899 date and blank pages then you will have to do a quick registry fix that should correct the problem.

Back up your registry first if you have COP or some other registry backup program ... just to be on the safe side and then add this fix: Just what is between the lines ... dencorso also made a small registry fix download ... either will work.

1899 Registry fix

--------------------------------------------------------------------------------
REGEDIT4

[HKEY_CLASSES_ROOT\.htc]
"Content Type"="text/x-component"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/x-component]
"CLSID"="{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}"
"Extension"=".htc"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}]
@="Microsoft Html Component"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}\InProcServer32]
@="C:\WINDOWS\\SYSTEM\\MSHTML.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.htc]
"Content Type"="text/x-component"


--------------------------------------------------------------------------------

This procedure worked for me ... provided by PROBLEMCHYLD

PROBLEMCHYLD said this about dencorso: All credit goes to dencorso, without him patching the vxd file, we would not be running system restore on Win98SE.
Thanks dencorso.

... and dencorso said this about PROBLEMCHYLD: Now, credit where credit's due: although I did patch that one VxD at his request (and never touched it afterwards), System Restore on Win 98 FE/SE always was ProblemChyld's project, and it was only due to his research, persistence and hard work that it came into being. So all kudos ought to go to him.

So we can appreciate having the System Restore program for Windows 98FE / SE finally.

.... Some follow up information. I was wondering if after awhile the Restore Points would start to build up and a person might like to delete some of the older Restore Points eventually. Also can the disk space usage setting be adjusted from the MS default setting, if someone wanted to do this. I got this information from PROBLEMCHYLD:

In order to have the option (Disk Space Usage) in System Restore you will need 98SE2ME also in order to disable System Restore, which will then allow older points created to be deleted. You need 98SE2ME because it installs some system files. If you just want to create Restore Points + Restore them back, then 98SE2ME is not needed, but if you want those two options then 98SE2ME is needed.

This post has been edited by duffy98: 27 February 2011 - 12:30 PM


#28 User is offline   CharlotteTheHarlot 

  • MSFN Expert
  • PipPipPipPipPipPip
  • Group: Members
  • Posts: 1,161
  • Joined: 24-September 07
  • OS:none specified
  • Country: Country Flag

Posted 27 February 2011 - 03:01 AM

Just FYI, these two are the same thing ...

 
[HKEY_CLASSES_ROOT\.htc]
"Content Type"="text/x-component"

[HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.htc]
"Content Type"="text/x-component"
 


#29 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 27 February 2011 - 04:26 AM

Hi CharlotteTheHarlot ... I got that registry fix from the MS Support page .... so I just went with what they supplied ... if it can be altered or changed, I don't know. It's a bit over my head. They show a manual registry fix and then the REGEDIT4 fix, which I decided to use. There are two fixes in that REGEDIT4 ... the 1899 date fix and the blank Help pages fix, so that may have some bearing on why MS supplied that particular fix, I can't say for sure.

System Restore Shows Date of Saturday, December 30, 1899

http://support.microsoft.com/kb/275646


To merge all the information at one time, you can copy and paste the following text into Microsoft Notepad, and then save it as a .reg file:

REGEDIT4

[HKEY_CLASSES_ROOT\.htc]
"Content Type"="text/x-component"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\text/x-component]
"CLSID"="{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}"
"Extension"=".htc"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}]
@="Microsoft Html Component"

[HKEY_CLASSES_ROOT\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}\InProcServer32]
@="C:\WINDOWS\\SYSTEM\\MSHTML.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.htc]
"Content Type"="text/x-component"


-------------------------------------------------------------------------------------------------------------------------------------

This post has been edited by duffy98: 27 February 2011 - 05:15 AM


#30 User is offline   CharlotteTheHarlot 

  • MSFN Expert
  • PipPipPipPipPipPip
  • Group: Members
  • Posts: 1,161
  • Joined: 24-September 07
  • OS:none specified
  • Country: Country Flag

Posted 27 February 2011 - 11:58 AM

View Postduffy98, on 27 February 2011 - 04:26 AM, said:

Hi CharlotteTheHarlot ... I got that registry fix from the MS Support page .... so I just went with what they supplied ... if it can be altered or changed, I don't know. It's a bit over my head. They show a manual registry fix and then the REGEDIT4 fix, which I decided to use. There are two fixes in that REGEDIT4 ... the 1899 date fix and the blank Help pages fix, so that may have some bearing on why MS supplied that particular fix, I can't say for sure.


Understood. There is nothing wrong with what they did, you can put the identical entry in over and over, don't matter a wit.

It's just interesting that the last key is using HKLM but all previous were HKCR. The last one seems to have been tacked on later for some reason even though it needn't be there.

Just a curiosity, nothing more. Anyone else reading this intending to use the script can ignore this!

#31 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 27 February 2011 - 12:20 PM

CharlotteTheHarlot ... understand ... I know how to add, change and delete items in the registry but as to what should actually be in the registry or how it should be there ... I wouldn't have a clue. I just follow what you and others suggest for this or that. I remember some time back you and others posted about deleting some "unnecessary" registry entries, I did follow what was posted but there is no way I could ever look in the registry and make that call. ... thanks.

... just would like to add about the System Restore guide that I posted. I covered everything that I had knowledge of ... if someone has further questions or runs into any "new" problems during the install or afterwards, please post for PROBLEMCHYLD to be of help to you. It's his project, glad he took it on. I tried fooling around with System Restore right after Windows Me first came out ... wanted to see if I could get it to work in 98SE ... like I said, I just fooled around, I wasn't even close to getting anything to work on 98SE ... thanks for taking the interest and making the program work for those that might like to use it.

This post has been edited by duffy98: 27 February 2011 - 12:25 PM


#32 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 06 March 2011 - 02:50 PM

I got a System Restore update from PROBLEMCHYLD ... he has put everything in a nice step by step set of instructions.
This should be the final say I guess ...

You might want to revise the instructions as I have done so below.

1. Create a folder and name it System Restore.

2. Download the patched VXDMON.VXD and copy it to the System Restore folder.

3. Download the update 290700USAM.EXE then extract the files to the System Restore folder.

4. Extract the Pchealth.inf from PRECOPY1.CAB and copy it to the C:\Windows\Inf folder.

5. Extract these 3 files from BASE2.CAB to the System Restore folder.
CHECKSR.BAT
EBD.CAB
EBDUNDO.EXE

6. Copy the whole Win9X folder to the C:\directory. (You must have a WinME CD for the necessary files.)

7. Copy everything from inside the System Restore folder to the Win9X folder.

8. Run this command:
C:\windows\rundll.exe setupx.dll,InstallHinfSection PCHealth.Install 132 C:\WINDOWS\INF\PCHealth.inf

9. When asked for any files, point to the Win9X folder in C:\directory where all the updated files are.

10.Now copy the patched VXDMON.VXD from the System Restore folder to the C:\Windows\System\Vmm32 folder.
Restart computer.

11. Now run the 290700UP.INF, restart when done.

12. After running all above instructions you should get a successful installation of System Restore for Win98\98SE which will lead to a successful restoration and no problems or errors.

13. You will need 98SE2ME for two reasons:
-to have the options (Disk Space Usage) in System Restore to configure the settings
-to disable System Restore, which will then allow older restore points created to be deleted
because it installs some system files that are needed.
If you just want to create Restore Points + Restore them back,
then 98SE2ME is not needed, but if you want those two options then 98SE2ME is needed.

If you followed all instructions step by step, you shouldn't have any problems. I just did all of these steps
and got a successful restoration.

Thanks to dencorso for patching the VXDMON.VXD.

I'll add ... thanks to PROBLEMCHYLD for figuring it all out.

This post has been edited by duffy98: 06 March 2011 - 03:23 PM


#33 User is offline   dencorso 

  • Adiuvat plus qui nihil obstat
  • Group: Super Moderator
  • Posts: 4,864
  • Joined: 07-April 07
  • OS:98SE
  • Country: Country Flag

Posted 06 March 2011 - 09:00 PM

By

View Postduffy98, on 06 March 2011 - 02:50 PM, said:

11. Now run the 290700UP.INF, restart when done.

do you mean...

11. Run this command:
C:\windows\rundll.exe setupx.dll,InstallHinfSection DefaultInstall 132 C:\System Restore\290700UP.INF

? Posted Image

#34 User is offline   duffy98 

  • Senior Member
  • Group: Supreme Sponsor
  • Posts: 506
  • Joined: 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag

Posted 07 March 2011 - 04:11 AM

I sent a message to PROBLEMCHYLD about your question ... either he will read that or see your question here. I was confused about that earlier also ... I asked him about that in Post #11 and never got a clear answer so I just ran 290700USAM.EXE and did nothing else, from what I remember. The SR program was working for me ... I just assumed that running 290700USAM.EXE installed 290700UP.INF or took care of that step. I have SR installed on one computer to test ...but that was using the last set of instructions that I posted in post #27. I had SR installed on two computers but I had to redo a computer with my Ghost backup because of another problem (not SR related) and I decided to put PowerQuest Second Chance v2.07 on that computer ... I always liked that backup-restore program, I read that some people think the whole idea of SR came from the PowerQuest Second Chance program, I don't know ... but I wanted to fool around with it again along with testing SR.

This post has been edited by duffy98: 07 March 2011 - 09:13 AM


#35 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 07 March 2011 - 09:42 AM

View Postdencorso, on 06 March 2011 - 09:00 PM, said:

11. Run this command:
C:\windows\rundll.exe setupx.dll,InstallHinfSection DefaultInstall 132 C:\System Restore\290700UP.INF

If this is how you run the command line for the 290700UP.INF and everything installs correctly, then yes your are right.
I have never ran it like this because I don't know command switches that well. I always ran it manually.
But thanks for shedding some light outr way as usual.

#36 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 21 November 2012 - 10:59 AM

Here is System Restore on my hybrid system. It witness the same bug as in WinME and WinXP with the infamous restoration was unsuccessful :} I'm going to invest some time into this to prevent the bug altogether. Sometimes it works sometimes it don't. I also want to strip it down to core files only. There is no need for Help and Support center. One fix at a time :thumbup

This post has been edited by PROBLEMCHYLD: 21 November 2012 - 11:26 AM


#37 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 22 November 2012 - 11:50 AM

After doing hours of searching, I think that most of the time System Restore doesn't work is because restore points get corrupted. And if one restore point get corrupted, then all of the points get corrupted. This is what causes the restoration was unsuccessful. If we can figure out why and how restore points get corrupted, we can come up with a solution.

This post has been edited by PROBLEMCHYLD: 22 November 2012 - 11:50 AM


#38 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 27 November 2012 - 10:20 AM

Does anyone know of a tool that will monitor System Restore actions?

#39 User is offline   CharlotteTheHarlot 

  • MSFN Expert
  • PipPipPipPipPipPip
  • Group: Members
  • Posts: 1,161
  • Joined: 24-September 07
  • OS:none specified
  • Country: Country Flag

Posted 27 November 2012 - 11:52 AM

View PostPROBLEMCHYLD, on 27 November 2012 - 10:20 AM, said:

Does anyone know of a tool that will monitor System Restore actions?

I seem to remember Mark Russinovich saying something about Win9x call-hooking being unreliable, and this was the reason that ProcMon only worked on NT, and that FileMon and RegMon didn't capture 100% of the events or allow boot logging.

This is why long ago I decided to skip attempts at realtime capture ( Win9x really doesn't need another destabilizing variable :lol: ) and just do before and after logs.

Save a complete Registry Export and also a complete FileList ( DIR C:\ /a /s >FILELIST.TXT ). The FileList should be done using a patched COMMAND.COM naturally. See here and here.

Then you can WinDiff them at your leisure later rather than the substantial risk of a realtime monitor which by design must use a custom driver VXD. Risking a BSOD during a System Restore is a nomination for a Darwin Award! Just my IMHO.

#40 User is online   PROBLEMCHYLD 

  • The Resurrector for old Windows OS
  • PipPipPipPipPipPipPipPip
  • Group: Members
  • Posts: 2,470
  • Joined: 07-October 05
  • OS:98SE
  • Country: Country Flag

Posted 04 December 2012 - 11:52 AM

View PostCharlotteTheHarlot, on 27 November 2012 - 11:52 AM, said:

View PostPROBLEMCHYLD, on 27 November 2012 - 10:20 AM, said:

Does anyone know of a tool that will monitor System Restore actions?

I seem to remember Mark Russinovich saying something about Win9x call-hooking being unreliable, and this was the reason that ProcMon only worked on NT, and that FileMon and RegMon didn't capture 100% of the events or allow boot logging.

This is why long ago I decided to skip attempts at realtime capture ( Win9x really doesn't need another destabilizing variable :lol: ) and just do before and after logs.

Save a complete Registry Export and also a complete FileList ( DIR C:\ /a /s >FILELIST.TXT ). The FileList should be done using a patched COMMAND.COM naturally. See here and here.

Then you can WinDiff them at your leisure later rather than the substantial risk of a realtime monitor which by design must use a custom driver VXD. Risking a BSOD during a System Restore is a nomination for a Darwin Award! Just my IMHO.
I have already patched the COMMAND.COM in Win98 and already included them in the SP. I will follows your method and report back after I release 3.12. Thanks CTH :yes:

Share this topic:


  • 3 Pages +
  • 1
  • 2
  • 3
  • You cannot start a new topic
  • You cannot reply to this topic

2 User(s) are reading this topic
0 members, 2 guests, 0 anonymous users



All trademarks mentioned on this page are the property of their respective owners
Copyright © 2001 - 2013 msfn.org
Privacy Policy