Hello,
Our mini filter contains an anti-tampering feature preventing access to our settings folder by filtering creates. This feature prevents system restore to complete successfully with the following message:
“System Restore could not access a file. This is probably because an anti-virus program is running on the computer. Temporarily disable your antivirus program and retry System Restore.”
We’ve seen that Symantec AV & Trend-Micro have this issue as well.
Does any one know a way to detect that a system restore is about to happen? (without, e.g., checking what process the create IRPs come from)
We’ve tried adding the folder to both FilesNotToBackup and FilesNotToSnapshot (in the Control\BackupRestore key), but it doesn’t seem to help.
Thanks!