Tweaking.com Support Forums
Main Forum => Tweaking.com Support & Help => Topic started by: lmitchell on May 05, 2016, 02:13:18 pm
-
I,ve been having some issues with my laptop crashing which I went into at length on another forum (http://forums.majorgeeks.com/index.php?threads/frequent-explorer-exe-crashing-then-opens-libraries-or-my-documents-windows-long.301020/). In light of getting no response and as a last-ditch effort to avoid a risky upgrade install, I decided to try th Tweaking.com utilty since I had success with it in the simpler previous version. I actually have great hopes it might help.
However, as mentioned in the MajorGeeks thread, partway through the MSI repair it bluescreened. By then this had been running nearly 32 hours and I was reluctant to just stop it fearing the consequences.
My worst fears were realized because now I can only boot to a black screen with moveable cursor, either regular or safe mode.
-
I have a recovery disk and a bootable usb install image. I've rooted around with the cmd in both Safe Mode and Recovery environments and even tried to start your app via command line.
I made registry and system restore backups through the program before running it and have no idea how to access either. Last, when the system disk is listed in recovery environment or Diskpart it's now appended with "/regserver". SFC doesnkt run due to a "pending repair". I've restarted multiple times.
I really need your timely help on this. I'm self-employed and have lost the last two weeks to the initial problem, now this. I have expenses piling up. I can't afford any more multi day scans (3 18-hour chkdsks in the last week). How do I restore my system to where it was when I started running the repair. Then I'll either skip step 2 (which took 24 hours) and maybe 5, or all just forget the whole thing and do an upgrade install
-
https://m.youtube.com/watch?v=VbN0eWR9HMs
Here is a video Shane made to restore with registry backup from a live cd
-
What about the fact that my hard drive got renamed from its original label to "/Regserver" ("Volume in drive D is /Regserver", according to cmd window in Recovery mode). Is that indicative of a bigger issue or something that needs to be resolved first, before I take the chance of bricking my OS? What about the "pending repair" (according to SFC) that won't go away? Are either of these preexisting conditions going to affect the success of the registry restore?
In the meantime I'll watch the video. I had to do manual reg restores frequently back when I had Windows 2000. It was really volatile and manually was the only way to fix it
-
Julian, thanks for the pointers to the video. I happen to have a Linux live CD but mentioned that I have a bootable Windows USB and a Windows repair CD.
Linux looks easier. I've watched the Linux and Windows videos. Problem is I only have use of a years old Android flip phone with a 3" screen and can't read the commands or file labels in the videos. I'm ready to restore pending if you can type out the folder/file names/commands and knowing that the issues I mentioned in my last post are't cause for concern.
-
I've watched the videos a few more times, can see what needs to be done and will run dos_restore.cmd in Windows. Just need to find out if those other issues might be a problem.
-
I restored the registry via Windows and the cmd file in the Regbackup subfolder. I'm still booting to a black screen with moveable cursor (where the login screen should be), both in Safe Mode and regular boot, my OS drive is still labelled "/Regserver".
Something is happening despite the black screen because I can hear the hard drive working and the cursor momentarily shows the green "wait" circle.
When I start in Safe Mode the list of loading drivers stops at classpnp.sys.before going to the black screen with cursor. I have no idea if more drivers are supposed to load.
Trying to run System File Checker in Recovery mode is still telling me there is a pending repair (even after attempting the fixes "dism.exe /image:d: /cleanup-image /revertpendingsactions" and "dism.exe /image:d: /scratchdir:d: /cleanup-image /revertpendingactions" - slashes are missing because they aren't on the phone keyboard).
What am I supposed to do now? The backup was made by TWR three days ago, just before running TWR and getting into this mess.
2
-
It's very disheartening to return to this forum after a sleepless night Googling every possible solution that I could find, only to see at least one thread with multiple pages of assistance while I've gotten one stock answer, Youtube video links with registry restore instructions.
Based on the problem I described in my first post, black screen / mouse cursor and being completely unable to see anything past boot except in Recovery Mode, that was the least of my problems.
Using an old Windows Boot Genius disk I renamed my hard drive back to its original label. I have no idea if that relabelling was evidence of a more sinister condition that might linger despite the correction.
I finally managed to get SFC to run via Dism and offline switches.
The first registry restore did not change anything regarding login problem. I went back one further (made 10 minutes prior to the last from within TWR) and think that is what allowed Startup Repair to run. The errors if found could not all be corrected and I don't understand the log.
At this point I'd be happy to do the upgrade install that I was trying to avoid initially, but from waht I understand it can only be done from inside the user accounts? And shame on me to attempt to clear up a major annoyance before I backed
up the disk. I could not have anticipated this since I haven't had such catastrophic results from using a third-party program in my twenty years of owning computers.
Now I'm going to manually set permissions on all the system files and folders using online instructions since 8kve found threads where this is the cause of this problem, and TWR spent 20+ hours doing so in my 1Tb drive. This is my last resort barring any knowledgeable intervention from a moderator, before 8 have to spend another week or so to clean install and restore my system back to where it was so that just maybe I won't lose any more income.
-
Woah hold on a second im sorry I did not get back to you. Lets see im going to read everything you posted as I just got on the forums now. Give me a moment to reply.
-
Hmmm okay so explorer is crashing lets see can you make another user via recovery environment command should be net user /add username
Next command should be net localgroup administrators /add username
I want to see if its just your user profile corrupted. Next thing is if you can run chkdsk /f /r I want to see if it reports 0kb in bad sectors. Im currently away from my computer and im on my phone im sorry for the slow typing.
-
Oh almost forgot Can you get me that bluescreen log. I want to see what it says..
-
The problem with getting a log is that I'm working on an old feature phone. The Android version is too old to support the Google cloud apps and I can't update its browser.
If youtell me where to look, I can probably find the file but no way to send it. I'm not able to get into the safe modes because all the log in screens are black with the mouse cursor. So, Safe Mode with Networking is ruled out. If the file is not too big for Notepad to handle I'll have to just retype what seems relevant
-
Adding a user triggered the message:
"The user or group account specified cannot be found.
The user was successfully created but could not be added to the USERS local group.
More help is available...."
Adding an administrator (I used the same name as above) returned "5he command completed successfully."
I wasn't sure if the first task was to be checking for *my* account. I'm guessing it would say the user already exists if it hasn't been corrupted. And if that were confirmed, then add me as an admin? My main account is assigned admin priveleges, then there is Administrator and acouple of decoy Guest accounts for theft tracking apps.
Let me know if I need to do the tasks using my current user name.
-
I'm going to run chkdsk now. I know there are bad sectors, 16 or so. I think the data is not in there. I ran two chkdisks the past week, once on my own and once prompted by some other maintenance program. Everything has been happening too quickly to get another drive and move everything.
They take a long time for me - 1TB drive usually at least 90 full, and therecent sector problem equals about 16 - 18 hours. I'm hoping it'll be faster than usual if nothing gets in the way of my running it.
-
It's possible that your boot sector is in the bad sectors, but as you can get into the Recovery Environment - see if this Win 7 tutorial will help fix the MBR -
http://www.sevenforums.com/tutorials/20864-mbr-restore-windows-7-master-boot-record.html
If you are unable to read all of the bits on your phone, do you have access to another computer such as a friend, relative, library or internet café where you will be able to make notes or even print it out.
-
What users pop up when you type net users
-
It's 6:30PM EST and chkdsk has been running for about 1.5 - 2 hrs. Stage 4, Verifying File Data, has been running about an hour and is at 82percent, having started at 80percent. Judging by past experience it will be done between 10 PM - 2AM. There are about 3.3 million files to process and its currently at about 210 thousand.
No problems reported in the first three stages of the scan, just the usual processing. If it'll save time I can look up results of the last chkdsk, done Monday or so, if told where to find the file.
-
If the chkdsk displays anything but 0kb in bad sectors the hdd is dying because if windows sees it then yeah its dying...
-
Right now I'm seeing nothing about bad sectors. "CHKDSK is verifying file data (stage 4 of 5), xx percent completed." If a bad sector result was supposed to appear in the previous sections' results I,m clear so far, otherwise the other details don't appear until completion, correct?
I'm saying there were "bad" sectors but it could have been something else, I can't remember the terminology but something not ordinary.
As far as users, I've opened a second cmd window and am being denied access to D: because the scan is running. X: shows Administrator, Guest and the new account I created. However, when logging in to the Recovery environment (remember, the only place I can see the logon), Administrator, Guest, HomeGroup and my regular (preexisting) account all show up in the dropdown. There are others (User, Default, and some system-created .NET related ones) that don,t show up anywhere except in the "Users" folder.
-
You won't be able to do this while chkdsk is running but for info - from the cmd prompt in the recovery environment enter eventvwr - that should take you to the Event Viewer.
Expand Windows Logs - click on the name Application/Action/Find then in the Find box type chkdsk or wininit and press enter.
Cancel the Find box and read the report in the scrollable window.
This will be academic though as by the time you will have access to the cmd prompt, the current chkdsk will have completed.
-
One last thing to mention is that I have permissions set so that users don't have to enter their user name to log on, just their password. Thus the logon windows shows four icons/avatars with user names - Administrator, two Guest accounts (decoys) and my user account (which has admin rights). *If* my user account were corrupted (and I won't be able to confirm until the D: drive scan is over) would that alone be enough to disrupt the logon screen common to all accounts?
I could probably open another cmd windows and work on the MBR (since it's on another partition) but will play itsafe and wait until chkdsk is done, as well as weigh in you thoughts on the scan results and bluescreen log (once I,m told where to find it).
-
I,ve read the MBR restore info and it's readable an understandable, but just to clarify --
As far as i can tell the system is booting. Where the logon screen is nothing but black and a mouse cursor. Moving the cursor sometimes.effects the black "brightness". I hear all the normal drive activity as if something is happening, just can't see anything. I've even blindly pushed the button sequence to select my user avatar, enter my password and logon. I hear the activity that is customary to my desktop loading, but still nothing but black and a cursor. I can even bring up the Sticky Keys prompt and the monitor selector in the customary places prior to logon.
By contrast, the true non-boot might be the black screen with the blinking line cursor in the upper left corner. This is defrinitely not that. I see the swirl startup, the goes to black screen where the intro screen and logon would normally come up.
Another reason I think the boot may be functional (although not visible) is because from the start Last Known Good Configuration has completed by going to the black / mouse cursor screen. If the boot was broken shouldn't LKGC be presenting a result different than what has already occured?
-
If the backlight or the inverter had gone, you wouldn't even see the white cursor.
The chkdsk x: /r will be scanning all of the disk which will include partitions.
When you have access to the cmd prompt again, enter eventvwr and check to see what Errors there are which may be able to ID what else is going on.
-
"Free space verification is complete.
CHJDSK discovered free spqce marked as allocated in the Master File Table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
(Then disk space stats, including
... total disk space
... in ... files
817564 kb in 345263 indexes
8 kb in bad sectors
... in use by the system
... occupied by the log file
3995956 kb available on the disk
4096 bytes in each allocation unit
... total allocation units on the disk
... allocation units available on the disk
Failed to transfer logged messages to the event log with status 50.
Sorry for the late reply. I fell asleep waiting for the scan to finish.
The lst line is new. I don't remember that result in orevious scans.
The bad sectors message is new. Now that I see the results I can recall that the previous message was not bad sectors but something about reallocation
-
Boggin, when I did chkdsk I had changed the prompt to D. I didn't know better. I'll scan the boot sector separately.
Julian, I've run net users from the D prompt. It shows the same results as from X, unless I'm doing something wrong:
User accounts for // (the slashes actually go the other way)
___________________________________________________
Administrator Guest (newly created user)
The command completed with one or more error.
So none of my preexisting users are showing. The same message shows whether I use X, C or D prompt.
-
I've just run chkdsk on C (the boot sector). It's clean, with 0 kb in bad sectors and no problems with the file system. The results has the same last line as the othe scan "Failed to transfer...".
-
From X:/Windows/System32
"Eventvwr is not recognized as an internal or external command, operable program or batch file"
From D:/Windows/System32 get "Error" window:
"The Event Viewer console file X:/windows/system32/eventvwr.msc cannot be found. Re-run Microsoft Windows setup."
Of course, when I run dir for the D drive, eventvwr.exe, eventvwr.msc and EventViewer_EventDetails.xsl are all there.
-
From what I've been reading 8kb in bad sectors can be portent of disaster or something that can be monitored. Pretty much everyone says that the second they see hint of deterioration they get a new hard drive and move evrything. A few state that that the fact that chkdsk mentions it means it's been flagged for nonuse and one can continue using the disk in the short term but is taking a risk.
If there's any chance function can be stored to my OS I have to put myself in the latter category.I'd like to confirm that this condition did or didn't exist before if you could point me to prior logs. I've hard restarted so many times in the past few days attempting to login and ahving no other way to shut down or log off when confronted with the black screen with mouse cursor that I have to wonder if that might be cause of some corruption.
I have five external hard disks if varying sizes, plugged into a 10-usb hub. One is a 1TB that I partitioned so that one partition is the size of the internal laptop hard drive, intending to do full image back ups onto it. Right now it has a few 100GB or data I was temporarily storing there. I can't move anything because the hub is not being seen in WinRe but can probably do so in Linux.
Next, even if I copy or image it may be a few days before I can get a new drive. My immediate issue is that I have work hanging and orders to fulfil from days ago. I can copy my data and will try to start pending hearing from you guys, but I have to get this operable and take my chances oending being able to get a new bootable (versus passive portable) drive up and running
-
The end of the last msg got messed up.
The inability to log in resulted from the TWR crash. At this point the preexisting problem (the browser crashing, which was an irritant) is workable. I'm less concerned with that and would welcome simply being able to get to the point of logging in again. Then I can take care of the obligations and, ideallly with new hard drive in hand within a few days, work on migrating to th enew drive. I fully accept any risks inherent in doing so.
Right now I'm going to putz around with one of my Linux disks and hope copying the files out doesn't take too much time.
-
Do you have that USB hub plugged in all of the time - even now when it is failing to boot ?
If so, unplug it and see if the machine will boot up normally.
-
No I didn't. I turned it off and unplugged it, as well as my Logitech mouse receiver. I've only just now plugged it in to copy files with Linux to clear the partition I had originally meant to use for the OS drive backup.
I made another attempt post chkdsk to boot prior to inserting and booting off the Linux disk. Still the same - black screen and mouse cursor.
The one time Startup Repair ran without reporting "no errors" it siad there was a "bad driver". I have to wonder since when the Safe Mode drivers load it stops at classpnp.sys (that may be normal for all I know). Once it went one driver further. I looked up the driver and it was a Toolwiz driver. I had a Toolwiz app installed but not one associated with that particular driver, which should not have been loading in safe mode. It may have been a fluke occurence. I ran multiple malware and virus scans earlier this week (5 or 6 different programs, including malwarebytes), before doing TWR. Everything came back clean.
-
I saw that you mentioned that you had tried LKGC from the advanced boot options - can you also get Safe Mode with or without Networking to see the screen using the on board VGA graphics ?
If you can get Safe Mode with Command Prompt or just Safe Mode to access the cmd prompt, enter eventvwr
I was in error before because that cmd isn't recognized from the recovery environment cmd prompt.
Where you would normally see Critical, Error etc. and clicking on each, the resultant pane may be empty but will populate when you click on View All Instances of This Event in the lower right pane.
We need to see what it has been recording.
If you can get Safe Mode with Networking then you can download Blue Screen View which will analyse the Memory Dump files as Windows doesn't have a default program to read those.
http://www.nirsoft.net/utils/blue_screen_view.html
If the cause is because of a driver conflict/corruption then the methods to repair the MBR may not work.
If you can access the cmd prompt without going into the recovery environment, I'm not sure if the cmd msinfo32 would work but there you can expand Components/Problem Devices to see if it snags anything.
If you can navigate using the cmd prompt then you may also be able to get devmgmt.msc to see if anything has an alert in Device Manager.
-
Its the same with networking, VGA and all the other safemode options, except the black screen occurs after the driver loading list. I went through every option on the page. Alway the sense that something is happening or there, just overlain with a black screen.
I'll back out of Linux now, unplug the hub and anything else, try all options again and report back soon.
-
Also, I already have Blue Screen View installed. I think I have the entire Nirsoft suite installed, but never needed to use it for anything serious.
-
Regular start and standard Safe Mode both went through to black screen with mouse cursor.
Safe Mode with Networking and Safe Mode with Command Prompt are both hanging on the Loading Windows Files page at classpnp.sys. I hope this is progress and not degradation.
I gave the former about 3 minutes before interrupting it to try the nest option. I'm going to interrupt the latter now and try VGA, etc just to eliminate the other scenarios.
-
VGA showed the Starting Windows swirl icon, then "One of your disks needs to be checked for consistency. You may cancel the disk check, but it is strongly recommended that you continue.
Windows will now check the disk."
So now I'm being run through chkdsk again, less than 10 hours after the last one ended. I doubt these hard shutdowns are good for the system but it's the only way to restart when confronted by the black screen. I hope this doesnt turn out to be another 8 - 10 hour scan.
-
Regarding devices, I removed everything I was able in sequence, with corresponding restarts, prior to contacting you: the battery, the hard drive, the wireless card and the memory sticks. I also had removed the battery and power adapter, held down the power button for 30 seconds, reassemble and restart after 20 minutes, which has worked with the black screen with blinking line cursor problem sometimes.
As an absolute last resort I can open the whole thing up, disattach the monitor from the motherboard, restart, reassemble etc, but considering how problematic that will be I don't want to deal with it until eveything else has been eliminated. I've completely disassembled this many times to clean, replace fan, replace thermal paste and other stuff so it's not a big deal for me to open it up.
-
I've been researching the classpnp.sys hang and it definitely seems to be related to the HDD which is probably why a chkdsk has been initiated.
Some have found that booting up into the BIOS and swapping the SATA to IDE from AHCI and back after a reboot has worked for them , but as you know you already have 8 KB of bad sectors then that may be where the problem is.
BTW - I've seen a chkdsk /r reported as running for a lot longer than 10hrs - just to cheer you up :)
When you get the new HDD how do you intend to reinstall the OS ?
-
I've ssen the reported success with the BIOS but the one in this HP Pavilion is relatively crude and doesn't offer a lot of fine-tuned options. The Dell desktop I had prior to this was more traditional and had all the options.
I have my Windows version imaged on a bootable USB. I'll just have to clean reinstall, copy my documents in and start from scratch. I'd reallyn really prefer to get back in this one, image my hard drive, possibly then try a last-ditch upgrade install to stabilze the crashing (which I know was due in part to browser plug-ins), then image the stable version and ditch this drive.
Right now the chkdsk is at 57percent complete and reported recovering orphaned files into directory files (3 of them) and Lrepairing the security file record segment". 10 index entries from the same file were deleted ("(eleting an index entry with Id xxxxx from index ?SII of file 9").
Well, it completed while I was typing that. Jumped back into regular startup, Starting Windows, back at the black screen with cursor, and even hearing that sound it makes when theinternal usb or wireless card or whatever activates.
Now I'm going to hard restart again to create more index error and try VGA safe mode one last time.
-
When I had just a black screen with the cursor, I was unable to boot up with anything except the recovery disks to factory reset it and then restored it with a system image - but mine wasn't because of hardware problems.
-
Classpnp has been coming up over and over as I've attempted safe mode. Some sites state that it isn't the last driver that shows that is the problem, but the one that comes after it. For all I know and the others know it's supposed to be the last one. Does anyone even pay attention before there's a problem?
I have a couple of external nonpowered enclosures? Is there anything to be gained from putting the internal drive into one and trying to boot, or would that driver conflict still likely occur? Would an external boot be possible without external power to the drive?
-
Does the enclosure plug into a USB port ?
-
I just rooted around in the BIOS to make absolutely sure I,m overlooking nothing, even though I've been in scores of times before. No way to reset any hard drive options as you've decribed.
I also took the opportunity to run a quick HP diagnostic on the drive. This panel is oonly for memory and hard drive. The comprehensive panel disappeared when I updated the BIOS months ago.
Itks only a quick test but the SMART test is reporting as PASSED and the Short DST as passed. HDD Sentinel and Ashampoo HD monitor both reported the disk as healthy when I was last able to check. I keep them running in startup. The latter recognized probelms (two abnormal resulst in the 50 or so parameters) but stated they were not yet significant.
Despite the crashing problem I had, triggered in part by Firefox loading certain pqages, and probably some software conflict with the 25 or so startup programs (which has been okay up to now), *everything* was fine until TWR crashed to blue screen in safe mode with networking (where I was running the scan, as recommended) and I signed back in and was confronted by the black screen and cursor. Cause and effect. That 8kb bad sector is a problem that needs to be dealth with and heeded, but is not the cause his issue.I,ve had dying drives before and the behavior is not so predictable.
I'll try whatevr is recommended next but cannot automatically agree that this has originated *because of* these bad (bypassed, no?) sectors, which may have come about because of multiple hard restarts over the last 2-1/2 days.
-
All the external drives are USB. Three are WD 1TB. Two are 2.5" laptop drives in Orico nonpowered enclosures.
-
Let's see if your restore points will do anything then.
Get yourself back into the recovery environment to select Command Prompt and enter rstrui.exe
-
Our last posts crossed, except mine didn't post. I,ll try to be brief (impossible for me, I know) repeating it -
A few posts I found mentioned the black screen / mouse cursor as being caused by file permissions and resolved by successfully resetting to defaults. That seemed plausible to me considering TWR spent hours changing them during stage 2, probably 80percent of the time it was running. I wanted to do so (for all maybe, not just the syste m) but the instructions online were confusing and/or not formatted well. Probably better to not have taken the chance.
I also remembered that I made a restore point from within TWR along with the registry backups. Where is it and is it acceptable to and usable by Windows System Restore? I've had Volume Shadow Copy and System Restore always active but its been hit or miss whether restore points are in the panel when I need them. Sometimes there have been none.
I would have tried it already if theire were useable points. There are three from 2014 and those were long gone sequential backups to an internal drive. I probably made one othe restore point from within a program when I was doing scans. No idea which program, where it is or even if can be restored external to the program that created it.
So am back in restrui and only the same three two-year old points are showing there.
-
I can't believe you still have restore points that old.
If they hang then you would have no option but to power shutdown, which was the cause of my black screen with cursor.
They could also be corrupt.
Hang on, I'm going to see if I can activate my WR from a cmd prompt with its .exe, but not sure it will work from the recovery environment.
-
No it doesn't although it has to be run from within Windows and the only .exe I can find is Repair_Windows.exe which isn't even recognised in a normal cmd prompt.
As you don't have any restore points that you can rely on, I can't think of any other way to get you back to before you ran WR or to get out of this black screen, other than what you doing by backing up your files in preparation to installing a new HDD.
It's possible that WR in carrying out its repairs hit a tender spot on the HDD, but for me, as you have nothing else to lose - I would try the MBR repairs, but back up your files first should that cause even more to hit the fan.
I'm going to have to shoot off now but will be back in about 3hrs.
-
I don't think those points actually exist. I think they're from external backups done with Macrium or EaseUS that were somehow not deleted from whereever backups are listed.
Occassionally I,ve done Disk Cleanup and have selected the "Delet All But Most Recent Backup" to regain drive space. I did so as recently as last week. But I've also installed updates since then.Windows is supposed to make backups before updates, but I can't count how many times I've checked that restore is activated (System -- Advanced Options) yet it shows 0MB restore points. Should have been a clue to keep better backups, but I don't trust Windows restore options and EaseUS and Macrium frequently fail partway through or during verification, so I've done it less and less frequently.
-
Okay. I opened explorer via notepad via command line. There are some accessible txt logs - ntbtlo from today, bcdlog from a couple of weeks ago, Tweaking.com repair set up log from Monday. They may be of limited used considering nothing can be run to force corrections from the state I,m stuck in.
-
Yes, I have restore points listed in mine which relate to external system images, but I've found Windows own works just fine for me.