What's "Generic volume shadow copy"?

But none can beat YOU for being a hooplehead, thick. If you're this lonely,
you need help you won't find around here!


In news:ichg6o$bhu$(E-Mail Removed),
Harden Thicke <(E-Mail Removed)> typed:
> "J. P. Gilliver (John)" <(E-Mail Removed)> wrote
> in message news:(E-Mail Removed)...
>> In message <icds4q$d39$(E-Mail Removed)>,
>> Harden Thicke <(E-Mail Removed)> writes:
>>> Avira forums, HoopleHead.
>>
>> 1. I don't do "forums".
>
> You're a lazy HoopleHead.
>
>> 2. This isn't just Avira.
>>>
>>> "J. P. Gilliver (John)" <(E-Mail Removed)> wrote
>>> in message news:(E-Mail Removed)...
>>>> In message <(E-Mail Removed)>, "J.
>>>> P. Gilliver (John)"
>>>> <(E-Mail Removed)> writes:
>>>>> I'm doing a complete system scan at the moment (AVIRA
>>>>> is my AV). I'm doing
>>>>> it after a restart, because my email-and-news software
>>>>> (Turnpike, quite old) behaved oddly once or twice.
>>>>>
>>>>> It may have nothing to do with that fact, but twice a
>>>>> "new hardware found"
>>>>> popup has appeared, and when I let it proceed to the
>>>>> point where it tells
>>>>> me what the new hardware actually is, it has said
>>>>> "Generic volume shadow copy". (I cancel it at that
>>>>> point.)
>> []
>> --
>> J. P. Gilliver. UMRA: 1960/<1985
>> MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf <Squawk> Pieces of eight!
>> <Squawk> Pieces of eight!
>> <Squawk> Pieces of nine!
>> <SYSTEM HALTED: parroty error!>

In news:(E-Mail Removed),
J. P. Gilliver (John) <(E-Mail Removed)> typed:
> I'm doing a complete system scan at the moment (AVIRA is my
> AV). I'm doing it after a restart, because my
> email-and-news software (Turnpike, quite old) behaved oddly
> once or twice.
> It may have nothing to do with that fact, but twice a "new
> hardware found" popup has appeared, and when I let it
> proceed to the point where it tells me what the new
> hardware actually is, it has said "Generic volume shadow
> copy". (I cancel it at that point.)
> I haven't added any new hardware (it's a netbook, with
> nothing plugged into it other than the power supply at the
> moment). I _have_ added a "subst" into my startup sequence,
> but that was a few days ago, and the popups have only
> appeared on this session.
> Any idea what it is? It _sounds_ as if it just might be
> malware, but I'm fairly careful, and have never had any in
> decades of computing. (Avira says it's done 41.3% - scanned
> 47215 objects - so far, and not found anything.)
>
> I'll just go to Google it ...

Have you tried any of the many spyware and malware programs around? Search
back on this group for recommendations or simply ask the question for whiich
ones people use.
Avira, IMO is only mediocre in itis reliability and tends to false
positives IME, which are still repeatable in my last testing of it. It wants
to delete a legtimate setup.exe which lives in an unexpected folder and
that's the ONLY reason it wants to delete it. I notified them, they agreed
wtih me, promised to fix it, and never did.
AVG or AVAST are a couple decent freebies you can try out for AV work
that's better than Avira. There are other freebie AV programs too and a good
chance some will pipe in to offer their suggestions, same as with malware
detectors.

Having read all your reponses to date here, it sounds very much like you
have malware aboard. Regardless of how "safe" you think you are with
surfing, there are just too many ways to become infected; safe hex alone
just won't do it. A good firewall (ZoneAlarm?), a good AV package (not
Avira) and good malware detectors are the "norm" for protection. Some will
claim that programs like Super AntiMalware & such are all that's needed;
don't beleive them. Many programs may catch many of them, but no single
program yet will catch all of them; there are just too many of them and
increasing every day.

HTH,

Twayne`

In news:(E-Mail Removed),
J. P. Gilliver (John) <(E-Mail Removed)> typed:
> I'm doing a complete system scan at the moment (AVIRA is my
> AV). I'm doing it after a restart, because my
> email-and-news software (Turnpike, quite old) behaved oddly
> once or twice.
> It may have nothing to do with that fact, but twice a "new
> hardware found" popup has appeared, and when I let it
> proceed to the point where it tells me what the new
> hardware actually is, it has said "Generic volume shadow
> copy". (I cancel it at that point.)
> I haven't added any new hardware (it's a netbook, with
> nothing plugged into it other than the power supply at the
> moment). I _have_ added a "subst" into my startup sequence,
> but that was a few days ago, and the popups have only
> appeared on this session.
> Any idea what it is? It _sounds_ as if it just might be
> malware, but I'm fairly careful, and have never had any in
> decades of computing. (Avira says it's done 41.3% - scanned
> 47215 objects - so far, and not found anything.)
>
> I'll just go to Google it ...

Generic Volume Shadow Copy is a windows program that allows the backing
up/manipulation of files that are "in use" by taking a snapshot of them.
Most archiving, backup and imaging programs require it in order to work.
It is a service that should be started automatically every time you boot
up unless you are an expert at manipulating its use. Check to see if it's
set to "automatic" under Services.

Unless the file is a phony, no AV or malware program should find it. If
it's a phony, it was placed there by malware. Or the original file was
overwritten with the phony.

WinPatrol Says:
Manages and implements Volume Shadow Copies used for backup and other
purposes. If this service is stopped, shadow copies will be unavailable for
backup and the backup may fail. If this service is disabled, any services
that explicitly depend on it will fail to start.

and

the executable is at:
C:\WINDOWS\System32\vssvc.exe

.... Administrative Tools; Services will open a window in XP where you
can start/stop the service, and set whether it starts "automatic", "Manual"
or Never.
I don't give a path for the admin tools because the user can change it
after it's installed. Search your boot drive for vsssvc.exe if necessary.
Check to see that it's set to "automatc" and that the setting sticks
(stays after a Restart).

HTH,

Twayne`

In message <icja5l$r2n$(E-Mail Removed)>, Tim Meddick
<(E-Mail Removed)> writes:
>Ah, I understand you now..... I also have experienced this and similar
>sorts of behaviours. I'm afraid, again, I have no explanation at the
>moment for it.
>
>This is because it hadn't happened to me recently, and I have to be
>able to reproduce the sequence of events that lead to getting a
>particular errormessage in order for me to investigate it.
>
>This is so I can then query the system to which processes are involved
>and what software/hardware conflicts may be happening. I can only do
>such things while the error is "in progress".
>
>But I will certainly keep it in mind so that if it ever happens on my
>system again, I will attempt to identify it's cause for you.....
[]
Thanks. Don't go out of your way - I was just curious as to:
1. what it was (I know more or less now)
2. why it suddenly popped p as "new hardware found", despite the fact
that I already had several restore points so it must have already been
present to make them;
3. why, when it does pop up, the OS itself (not my AV) says it's not
"Microsoft signed" or whatever.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf

If vegetarians eat vegetables,..beware of humanitarians!

In message <icon34$ski$(E-Mail Removed)>, Twayne
<(E-Mail Removed)> writes:
[]
>Having read all your reponses to date here, it sounds very much like you

Are you sure you have done so, because:
1. it is not my AV, but the OS's own trap, that is objecting. You know
how when you add new hardware, and the system asks for a driver, and you
load the driver that came with it, as often as not you get a popup
warning you that said driver is not "Microsoft signed" or something like
that. What was happening was that - despite not having added any new
hardware - the "new hardware found" thing was popping up (saying the new
hardware was this "... shadow copy"), and when I let it find drivers for
it, the "not signed" box popped up.
2. I already had several restore points present; presumably the shadow
copy thing must have already been there in order to make those. So why
is it popping up again?
[]
>just won't do it. A good firewall (ZoneAlarm?), a good AV package (not

I have a firewall (plus what's in the routers of course).

>Avira) and good malware detectors are the "norm" for protection. Some will
>claim that programs like Super AntiMalware & such are all that's needed;
>don't beleive them. Many programs may catch many of them, but no single
>program yet will catch all of them; there are just too many of them and
>increasing every day.

Agreed. (How many of each [AV, firewall, detector] - and which ones - do
_you_ run?)
>
>HTH,
>
>Twayne`
>
>
>
>
>
(Why the lines at the end?)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf

If vegetarians eat vegetables,..beware of humanitarians!

It is possible that some sort of malware is un-registering the Volume
Shadow Copy service, and, as a matter of course, I would run both MRT.exe
and MalwareBytes (both "full" scan - not the "quick").

This would explain the behaviour.

What service pack are you running - if you have not already done so, would
you consider upgrading to service pack 3 ??......

Windows XP Service Pack 3 Network Installation Package for IT Professionals
and Developers (316.4MB)
http://www.microsoft.com/downloadS/d...displaylang=en

Windows XP Service Pack 3 - ISO-9660 CD Image File (544.9MB)
http://www.microsoft.com/downloads/d...displaylang=en

==

Cheers, Tim Meddick, Peckham, London. :-)




"J. P. Gilliver (John)" <(E-Mail Removed)> wrote in message
news:sTjPXcF8wh8MFw$(E-Mail Removed)...
> In message <icon34$ski$(E-Mail Removed)>, Twayne
> <(E-Mail Removed)> writes:
> []
>>Having read all your reponses to date here, it sounds very much like you
>
> Are you sure you have done so, because:
> 1. it is not my AV, but the OS's own trap, that is objecting. You know
> how when you add new hardware, and the system asks for a driver, and you
> load the driver that came with it, as often as not you get a popup
> warning you that said driver is not "Microsoft signed" or something like
> that. What was happening was that - despite not having added any new
> hardware - the "new hardware found" thing was popping up (saying the new
> hardware was this "... shadow copy"), and when I let it find drivers for
> it, the "not signed" box popped up.
> 2. I already had several restore points present; presumably the shadow
> copy thing must have already been there in order to make those. So why is
> it popping up again?
> []
>>just won't do it. A good firewall (ZoneAlarm?), a good AV package (not
>
> I have a firewall (plus what's in the routers of course).
>
>>Avira) and good malware detectors are the "norm" for protection. Some
>>will
>>claim that programs like Super AntiMalware & such are all that's needed;
>>don't beleive them. Many programs may catch many of them, but no single
>>program yet will catch all of them; there are just too many of them and
>>increasing every day.
>
> Agreed. (How many of each [AV, firewall, detector] - and which ones - do
> _you_ run?)
>>
>>HTH,
>>
>>Twayne`
>>
>>
>>
>>
>>
> (Why the lines at the end?)
> --
> J. P. Gilliver. UMRA: 1960/<1985
> MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf
>
> If vegetarians eat vegetables,..beware of humanitarians!

What I was saying was; that at times, when you A the "New Hardware
wizard" popping-up to re-install the service, could indicate that "Volume
Shadow Copy" had [at that point] been un-registered.
However, obviously, if you are using the System Restore or NT Backup
utilities normally, then the "Volume Shadow Copy" service is registered
properly.
Nonetheless, it could indicate some malware / virus on the system, even
if the I effect of having to re-install the service doesn't happen all the
time and is quite intermittent. I still recommend that you do a [full]
scan with MRT.exe and Malwarebytes as soon as is practicable

==

Cheers, Tim Meddick, Peckham, London. :-)




"J. P. Gilliver (John)" <(E-Mail Removed)> wrote in message
news:sTjPXcF8wh8MFw$(E-Mail Removed)...
> In message <icon34$ski$(E-Mail Removed)>, Twayne
> <(E-Mail Removed)> writes:
> []
>>Having read all your reponses to date here, it sounds very much like you
>
> Are you sure you have done so, because:
> 1. it is not my AV, but the OS's own trap, that is objecting. You know
> how when you add new hardware, and the system asks for a driver, and you
> load the driver that came with it, as often as not you get a popup
> warning you that said driver is not "Microsoft signed" or something like
> that. What was happening was that - despite not having added any new
> hardware - the "new hardware found" thing was popping up (saying the new
> hardware was this "... shadow copy"), and when I let it find drivers for
> it, the "not signed" box popped up.
> 2. I already had several restore points present; presumably the shadow
> copy thing must have already been there in order to make those. So why is
> it popping up again?
> []
>>just won't do it. A good firewall (ZoneAlarm?), a good AV package (not
>
> I have a firewall (plus what's in the routers of course).
>
>>Avira) and good malware detectors are the "norm" for protection. Some
>>will
>>claim that programs like Super AntiMalware & such are all that's needed;
>>don't beleive them. Many programs may catch many of them, but no single
>>program yet will catch all of them; there are just too many of them and
>>increasing every day.
>
> Agreed. (How many of each [AV, firewall, detector] - and which ones - do
> _you_ run?)
>>
>>HTH,
>>
>>Twayne`
>>
>>
>>
>>
>>
> (Why the lines at the end?)
> --
> J. P. Gilliver. UMRA: 1960/<1985
> MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf
>
> If vegetarians eat vegetables,..beware of humanitarians!

In news:sTjPXcF8wh8MFw$(E-Mail Removed),
J. P. Gilliver (John) <(E-Mail Removed)> typed:
> In message <icon34$ski$(E-Mail Removed)>, Twayne
> <(E-Mail Removed)> writes:
> []
>> Having read all your reponses to date here, it sounds very
>> much like you
>
> Are you sure you have done so, because:
> 1. it is not my AV, but the OS's own trap, that is
> objecting. You know how when you add new hardware, and the
> system asks for a driver, and you load the driver that came
> with it, as often as not you get a popup warning you that
> said driver is not "Microsoft signed" or something like
> that. What was happening was that - despite not having
> added any new hardware - the "new hardware found" thing was
> popping up (saying the new hardware was this "... shadow
> copy"), and when I let it find drivers for it, the "not
> signed" box popped up. 2. I already had several restore points present;
> presumably
> the shadow copy thing must have already been there in order
> to make those. So why is it popping up again?
> []
>> just won't do it. A good firewall (ZoneAlarm?), a good AV
>> package (not
>
> I have a firewall (plus what's in the routers of course).
>
>> Avira) and good malware detectors are the "norm" for
>> protection. Some will claim that programs like Super
>> AntiMalware & such are all that's needed; don't beleive
>> them. Many programs may catch many of them, but no single
>> program yet will catch all of them; there are just too
>> many of them and increasing every day.
>
> Agreed. (How many of each [AV, firewall, detector] - and
> which ones - do _you_ run?)

Router Gateway: Westell 327W & comes with NAT - almost as good as a firewall

Firewall: Norton 2010

AV: Norton's AV (real time monitoring) and AVG (used separately, is NOT set
to real time monitor.

Backup: Norton Ghost 14: Full once/month, incrementals nightly.

Spyware/Malware: *WinPatrol;
SuperAnti Spyware; Spybot Search & Destroy; Norton Internet Security;
Adaware; Malware Bytes. Probably a couple others I've missed.
*WinPatrol isn't per sae a scanner, but it WILL stop ANY application it
hasn't seen before from running, so it needs a short training course as you
use your machine. It does so many other things too that I won't go into
them; see their web site if interested.

I run the malware detectors in the approximate sequence as listed, first
one first run. Unless I have a really nasty problem I stop after usinig
Norton Internet Security. I've had both Adaware and MalwareBytes catch
something all the others miss, but not very often. Thus, I keep them around.
I keep AVG around likewise; just a tool for comparisons sometimes but
Norton's AV always catches, historycally, everything and more than AVAST and
AVG. Its heuristics are better than any other I've tried, and their new,
smaller memory footprint makes them faster and useful for the smaller
machines that always had speed complaints.

A not on AV programs: If they find something and fix it for you, run them
again. There is a possibbility the removal may have exposed something else
that was previously hidden. Always run them until they find nothing.

My only claim to "success" with these applications are that I have not had a
viral infection in almost three years now so I'm doing something right. Ymmv
of course because different grographic areas get different knds of viruses
quite often. The last problem I had was a GAIN infection that I stupidly
downloaded myself in another application. I now check reputations for any
sites I haven't visited before and I also use Google's attributes about
various web sites.

HTH,

Twayne`

>>
>> HTH,
>>
>> Twayne`
>>
>>
>>
>>
>>
> (Why the lines at the end?)