A few years ago, a friend of mine was having difficulty accessing system restore. Even if he did manage to get the program running, it would neither allow him to start the restoration process or create a system restore point. With the number of applications he was constantly installing and uninstalling, he enjoyed the luxury of always having a recent, clean record of his computer to revert back to if things went awry. Realizing that he was without that luxury, he became extremely wary of making any changes to his computer.
I went in to solve his problem with the assumption that the issue was caused by software he recently installed. Solving the problem would involve removing his applications one by one until the problem was resolved. All of this was accomplished in safe mode.
The first step was generating a list of applications that he’d installed since last creating a system restore point, which was two weeks earlier. I walked him through sorting the list of installed applications by accessing the Control Panel and selecting Add/Remove Programs. With the list generated, we had a very clear idea as t the most likely causes of the problem. Starting from the most recently installed programs, we uninstalled everything one by one. Following each, uninstallation, I had him restart his computer to insure that the uninstallation completed successfully. Once all the desired applications were successfully removed, I had him try using system restore again. To both of our dismays, the program still wouldn’t properly function. Slightly peeved, we tried a different approach. While we didn’t reinstall any of the programs removed (though we did keep a list of what he would need to reinstall), I suggested we block all startup programs that weren’t native to the system. From the command prompt, we typed “msconfig” to load the system configuration and selected “Diagnostic startup.” The next time we booted the computer, system restore worked perfectly. To diagnose the exact startup program that was interfering with system restore, we enabled each one by one until system restore once again no longer functioned.
As it happened, his malware protection software was incorrectly identifying system restore as making unauthorized registry changes. From there, it was safe to assume that the database for his protection software was either outdated or corrupted. Uninstalling and reinstalling the software eliminated the problem.
When system restore is compromised, I would suggest both removing recently installed applications and augmenting startup items. Also, look into software to clean your registry because corrupt files in that department can also cause your system to work incorrectly, though that was not the case here. In the most extreme cases, backup all of your files and wipe your hard drive. However, I wouldn’t recommend any last resort methods without a more professional examination.