trying to run system restore it fails with error code 0x80071ab0

Richard Yonker 0 Reputation points
2025-08-18T20:03:31.5133333+00:00

I have apparent malware on computer. In an effort to keep from doing a clean install I am first trying to recover from an earlier restore point. I have tried several different restore points and each has failed with the error code 0x80071ab0. It says that system is unable to delete a file named "cross device service.exe". I have changed the permission for the file to myself from "System" but am hesitant to delete the file before running the restore point.

Windows for home | Windows 11 | Input and language
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Jeronimo Fuerte 16,785 Reputation points Independent Advisor
    2025-08-18T20:46:33.0633333+00:00

    Hi! The error 0x80071ab0 usually means System Restore can’t finish because a file is locked or in use, in your case, "cross device service.exe", which strongly suggests malware interference. Since you’re trying to avoid a clean install, the first step is to boot into Safe Mode and retry System Restore, because Safe Mode loads only essential services and may free the file.

    If the error persists, the best approach is to neutralize the file that’s blocking the restore. From Safe Mode, locate cross device service.exe and rename it (e.g., cross device service.exe.old) instead of deleting it immediately, which prevents potential dependency issues while still disabling it. Once renamed, try running System Restore again. Running a Windows Defender Offline Scan or a trusted tool like Malwarebytes is also recommended to detect and quarantine related malware before attempting restoration.

    Finally, if System Restore continues to fail, repair system files with sfc/scannow and DISM/RestoreHealth from an elevated Command Prompt. If none of these steps succeed, you may need to fall back to the Reset this PC option while keeping personal files, or ultimately perform a clean install. Because the file in question is almost certainly malicious, isolating or renaming it first is the safest way to give System Restore a chance to succeed.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.