System Restore Failed, BSOD

Hello! I am desperately trying to "train" my Windows 7 64-bit system to replace my aging (and last) XP system. It is giving me fits. I've been in here before describing how I gave up and reinstalled Windows (clean install) rather than "Update" because my SSD is too small to do the update.

Yesterday I installed and ran Driver Genius 9 Professional to see if doing so would resolve some conflicts for me. Probably not the wisest thing to do. But I set a system restore point (cleverly named "daves") prior to doing the deed. As I'm sure you could have predicted, things got worse. I started getting the BSOD. After the second occurrence of the BSOD I attempted to restore the system back to "daves". On reboot, Windows had a cheery message for me:

System restore did not complete successfully. Your computer system files and settings were not changed.
Details:
System restore failed to replace the file (C:\Windows) with its original copy from the restore point.
An unspecified error occurred during System Restore. (0x80071a90)
You can System Restore again and choose a different restore point. If you continue to see this error, you can try an advanced recovery method. For more information, see What is Recovery?

I noted that the advanced recovery options are:
* Restore files from a system image backup
* Return Windows or your computer to original settings

I tried to reset the system back to a more recent restore point and got the same restore failure.

This is what lead me to reinstall Windows a week or so ago. Obviously there is something wrong other than the Windows installation.

I ran Memtest86+ V4.10 for one full pass, about 45 minutes, with no errors. The video drivers are nVidia's modt recent.

Any suggestions what I should do now?

Thanks, - Dave

ASUS P7P55 Deluxe
PC Power & Cooling Silencer 750 Quad 750W, single 60A 12V rail
Intel Core i7 860
Corsair CMX8GX3M4A1600C9 (4 sticks x 2GB)
ZOTAC ZT-98GES3M-FSL GeForce 9800 GT 512MB 256-bit GDDR3 PCI Express 2.0 x16
Drive0 (OS) OCZ SSD Vertex 2 OCZSSD2-2VTX50G 50GB
Drive1 HITACHI UltraStar A7K2000 0F10452 2TB 7200 RPM 32MB Cache SATA 3.0Gb/s
Drive2 (Apps, pagefile, misc.) OCZ SSD Vertex 2 OCZSSD2-2VTX50G 50GB
1394 board Rosewill RC-502 NEC 3+1 1394a PCI
1394b board Koutech 4-port 1394a/b PCIe x1
DVD Drive Plextor PLX-850A-19 IDE S/N 310907400763
CF Reader FireWire Sandisk Extreme Pro ExpressCard Adapter
CF Card Sandisk Extreme IV 4GB 45MB/s UDMA
Monitor NEC LCD2190 UXi LCD 'twist' tech.
Microsoft Windows 7 Home Premium 64 bit

Hey Dave.

We can try to get this straightened out for ya. The first thing is that if you have any utilities or applications from ASUS, uninstall them.

You can post the actual crash dumps and this will go a long way to figuring out what problems are. To do so:

Go to C:\Windows\Minidump to copy and paste the files from there to any other folder. Then zip the files. Attach the the zip to a post using the paperclip above where you type, in advanced mode reply. We shall see what needs to be done.

And yes, driver update programs are always a bad idea.

Hi TorrentG,

Thanks for being there!! Here is the ZIPped-up Minidump files (3 in there). I ran HijackThis but it stopped with an error. A JPG of the error message is attached along with the partial log. I wanted to run the latest Housecall but its download stalled. I ran the latest Malwarebytes (v1.46, database 4363) which turned up no malicious items.

Um- I did uninstall Sunbelt Software CounterSpy from my main PC (that I'm desperate to replace) but it's still on the PC we're diagnosing now. I can uninstalled here as well.

Let me know what you find!

Thanks again, - Dave

Oh- and I think I already had all Asus apps/utilities off of this PC. I don't recognize any in the Programs and Features control panel. I got the Housecall scan done with no threats found.

- Dave

Hello and Welcome !

Seems like Zone Alarm is casing the problem. I would recommend to uninstall it and use the removal tool to clean the left over entries. You could install Microsoft security essentials instead.

BSOD vs. Internet Security !!

Code:

fffff880`02f6ade8 fffff800`02ad7b69 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`02f6adf0 fffff800`02ad6032 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02f6af30 fffff800`02ae2af0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`02f6af30)
fffff880`02f86fe0 fffff800`02addca7 : fffff880`02f871a0 fffff880`02f871c0 00000000`00000001 00000000`00000000 : nt!SepMandatoryIntegrityCheck+0xf0
fffff880`02f87060 fffff800`02aa0f02 : fffffa80`0a5af970 00000000`00000001 00000000`00000000 fffffa80`07e897c8 : nt!SeAccessCheckWithHint+0x317
fffff880`02f87140 fffff880`01594c5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x102
fffff880`02f87830 fffff880`0159294f : 00000000`c0000022 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!CompareSecurityContexts+0x6a
fffff880`02f878a0 fffff880`015949b5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!MatchValues+0xef
fffff880`02f878f0 fffff880`01594845 : fffffa80`0a0c08f0 fffffa80`0a265540 fffff880`02f87b18 fffff880`02f88250 : NETIO!FilterMatch+0x95
fffff880`02f87940 fffff880`01595ccb : 00000000`00000000 00000000`00000000 fffff880`02f88250 fffff880`02f87b00 : NETIO!IndexListClassify+0x69
fffff880`02f879c0 fffff880`0163f4d0 : fffff880`02f88250 fffff880`02f87e98 fffff880`02f88bd0 fffffa80`09f91970 : NETIO!KfdClassify+0xa4e
fffff880`02f87d30 fffff880`0163877e : fffff880`01747690 00000000`00000000 fffffa80`09c300d0 00000000`00000000 : tcpip!WfpAleClassify+0x50
fffff880`02f87d70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x9

    Loaded symbol image file: NETIO.SYS
    Mapped memory image file: C:\Symbols\NETIO.SYS\4A5BC18A60000\NETIO.SYS
    Image path: \SystemRoot\system32\drivers\NETIO.SYS
    Image name: NETIO.SYS
    Timestamp:        Tue Jul 14 04:51:46 2009 (4A5BC18A)
    CheckSum:         0005F36C
    ImageSize:        00060000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     netio.sys
    OriginalFilename: netio.sys
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  Network I/O Subsystem
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Hope this helps,
Captain

Hello Captain Jack,

Thanks for your analysis and the resources. I'll be getting back to the miscreant tomorrow afternoon and will experiment. I did uninstall CounterSpy on the subject PC. Windows threw a fit saying it wanted a firewall (even though I have the venerable ZoneAlarm on the system) and offered Windows Defender. Now it is as happy as a clam. When I uninstall and remove all remnants of ZA-AV and install MSE do I then turn off Defender?

- Dave

Nope. Leave Windows Defender running. Also when on the services page, set Windows Firewall to automatic start.

Hi TorrentG,

I have Defender enabled. I don't see the Services page with an option to set Windows Firewall to automatic start. Gan you point me in the right direction?

The options in Windows Firewall are daunting! I'm under so much stress with two PC giving me fits that my brain is jello. I'm spoiled by the ZA firewall that offers to "learn" for a specified period then locks things down based on a couple of user-operated sliders. It gives me a warm and fuzzy "You are protected. You do not have to do anything" message. I clicked on a few help screens in Windows Firewall and felt as overwhelmed as I would be if I were responsible for knowing the meaning of everything in a prospectus for a family of mutual funds. Is there a simple step-by-step for the (nearly) brain dead?

I have ZA shut down and set to not start when Windows starts. Is the file I have attached the most recent procedure for completely wiping ZA off of a system?

(By the way, in the forum File Upload Manager, how do I delete old items from the Home pane?)

I am ready to install Microsoft Security Essentials. The EXE I downloaded is mssefullinstall-amd64fre-en-us-vista-win7.exe. Does that look right for an Intel-based system? The "amd64" part has me worried.

Thanks again, - Dave

The easiest way to remove ZA is with this tool: http://download.zonealarm.com/bin/fr...cpes_clean.exe

It does all that the document says automatically.

Hello!

Yesterday evening I was using Photoshop on the subject PC to retouch six files. When I finished I closed all apps preparing to shut down Windows. At that point I got a Blue Screen. Restarted the PC and chose the option to send the data to Microsoft. While the send was in progress I got the BSOD again and just shut down the computer. The minidumps are attached.

This morning I used cpes_clean.exe to completely remove Zone Alarm Anti Virus. When the PC was supposed to restart, Windows hung "Shutting Down". I did a hardware reset, chose Start Normally and got the expected challenge to allow the ZA cleaner to finish its job. I installed MSE, did a scan, and it is happily protecting the PC.

I ran HijackThis v2.0.4 successfully. The log is attached.

I'll appreciate any suggestions of what to look for next. In the meantime I have a Photoshop retouching job I will do on the subject PC and see how the system behaves.

Thanks, - Dave