Tweaking.com Support Forums
Main Forum => General Computer Support => Topic started by: FreeCat on August 06, 2017, 11:34:38 am
-
Sorry that this is in all caps here, but wrote it on friend's laptop that kept going into CAPS.
SEQUENCE OF EVENTS 2017 08 05:
WINDOWS 7 PRO ULTIMATE RUNNING ON A DELL T7500
WITH 64 GB RAM AND TWO AMD W7000 GRAPHICS CARDS
UPDATES AVAILABLE - SEVERAL ESSENTIAL AND 2 .NET
.NET UPDATE DID NOT TAKE THE UPDATE BUT NEEDED A REBOOT TO APPLY THEM
SHUT DOWN MACHINE FOR REBOOT - LET LATENT CHARGE OUT OF MACHINE
AFTER THIS REBOOT: BLUE SCREEN
LET LATENT CHARGE OUT OF MACHINE
THEN WENT TO SAFE MODE
UPDATED TWEAKING.COM FOR V4 PRO
TURNED OFF MACHINE TO DRAIN LATENT CHARGE AGAIN
STARTED TWEAKING
RAN PRESCAN - FOUND SOME THINGS =- MOSTLY WITH LOGMEIN - WHICH I NO LONGER USE AND DELETED OVER A YEAR AGO
CHCKDSK BEGAN BUT FOUND ERRORS BUT I WANTED TO USE /F OR /R AND SAW IT DID NOT APPLY /F /R
LET LATENT CHARGE OUT OF MACHINE
I SET CHKDSK UP FOR /R AT REBOOT AND REBOOTED FROM TWEAKING
BUT WHEN MACHINE CAME UP IN SAFE MODE CHKDSK WAS NOT RUNNING
LET LATENT CHARGE OUT OF MACHINE
BEGAN TWEAKING AGAIN SETUP FOR SAFE MODE REBOOT WITH CHKDSK AT /R
ON REBOOT SAFE MODE CAM UP AGAIN BUT THERE WAS NO CHKDSK RUNNING
THEN WENT TO COMMAND MODE AND RAN CHKDSK WITH THE /R OPTIONS
CHCKDSK RAN FOR HOURS AND STILL RUNNING AT BEDTIME
THEN, IN THE MORNING BLUE SCREEN
TURNED OFF MACHINE TO DRAIN LATENT CHARGE
TRIED TO START IN SAFE MODE
LEFT FOR HOURS, SAFE MODE NEVER LOADS
AND THE LAST LINE LOADED IS AMBAKDRV.SYS
TURNED OFF MACHINE TO DRAIN LATENT CHARGE
TRIED TO BOOT SAFE MODE
LEFT FOR HOURS, SAFE MODE NEVER LOADS
AND THE LAST LINE LOADED IS AMBAKDRV.SYS
TURNED OFF MACHINE TO DRAIN LATENT CHARGE
TRIED TO BOOT SAFE MODE
LEFT FOR HOURS, SAFE MODE NEVER LOADS
AND THE LAST LINE LOADED IS AMBAKDRV.SYS
TRIED BOOT WITH LAST KNOW GOOD CONFIG
HERE IS THE TECH INFO:
*** STOP: OXOOOOOO1E (0XFFFFFFFFC000001D,0XFFFFF800042DC35F, 0X000000000000000000, 0XFFFFFA9073F88000)
AFTER THIS ON TRYING TO SAFE BOOT AGAIN "LAST KNOW GOOD CONFIG" WAS NO LONGER AVAILABLE AS AN OPTION.
I really, really need this machine for work.
I do have a backup but it is over three months old and I did a lot of work on machine since then (stopped running as I ran out os space as it needs 1.5TB space on my NAS to run backup and did not get another drive yet.
Thanks in advance for any help at all. :)
-
The AMBAKDRV.SYS is part of AOMEI backupper - have you got that installed or recently uninstalled it ?
If you haven't then it could be an infection
It's unfortunate that you can't get into Safe Mode as what I've found about that AMBAKDRV.SYS is that it can be stopped in Services if it's a genuine file.
MS has a Hotfix for that Stop Code but I'm not sure if it applies to your error but you would need at least Safe Mode with Networking and they usually send these to you in an email.
https://support.microsoft.com/en-us/help/2764302/-0x0000001e-stop-error-occurs-intermittently-in-windows-7-sp1-and-wind
Do you have a Win 7 Ultimate install disk you can use to boot up with ?
It's best if your install disk includes SP1 but if it hasn't and you have a valid retail key, you can download the ISO on your friend's laptop from https://www.microsoft.com/en-gb/software-download/windows7
Scroll down and enter your product key and if it accepts it, it will release the download which will be about 3.09GB and select Save.
You can then use Windows USB/DVD Burner Tool to create a bootable disk. http://wudt.codeplex.com/
Assuming you have, tap F12 as you switch on to use the one off boot order change - use the cursor keys to select the DVD drive - insert the disk and press enter then press any key when prompted to boot from CD or DVD..
You may be presented with an inverse window with Windows Setup (EMS Enabled) highlighted - press enter.
Use the dropdown to change/confirm Language, Time and currency format - Next
Click on Repair your computer bottom left in the Install screen and note the location of the volume as it isn't always in C: when you boot up with an install disk or go into the Recovery Environment.
You may be able to use your restore points to go back to before the .NET Framework updates or see if a sfc /scannow will do anything for you.
Select Command Prompt and enter this command using the location letter of the volume instead of the X that I have used.
sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows
Let us know how you get on with those.
-
Thanks VERY much Boggin'.
I began to try what you have recommended, but when I turned the computer on again it went into chkdsk so chkdsk is running and it is now way past the point that it stopped when it got the BSD. Now at 4 of 5 but 145k or 310k to go.
I makes sense to me to wait to see what happens.
I will keep you posted.
Thanks MUCH, again, Boggin'
-
That sounds promising as long as it doesn't find any bad sectors.
-
Well, by Monday morning, another BSD, but this time with page fault in non-paged area. I remember when the chkdsk began yesterday, I was trying to get to Safe Mode but F8 did not take and it began "Starting Windows". and after a while I saw it was in chkdsk. this prolly had to do with setting up of chkdsk for reboot. I dunno.
So, now, I am trying to get into safe mode and for the last 20 minutes still stopped at the AMOEI driver load.
I will try restart now without safe mode and see if chkdsk starts again.
-
But wait. I just saw an email from Jim suggesting a look at this:
https://support.microsoft.com/en-us/help/2521220/-0x0000001e-stop-error-when-you-perform-disk-i-o-intensive-operations
And, these symptoms seem to fit exactly as my 2 TB hard drive is a RAID (ie two 2 TB drive in mirror configuration). I have never done a hotfix before. But I see STOP 0x000000001E message I believe. And hotfix link sends me to "Contact Us" MSFT. Although, not RAID5 but RAID0.
-
OK - NEW BALL GAME! I thought that whatever I am going to do, I should try a reboot and press F8 which I did just before
I had to go out to the doctor.
Now, the machine is in safe mode.
Normally, I would just run Tweaking 4 Pro. But, after that scare of possibly being trapped in the BSD, I don't know what to do.
Any suggestions would be appreciated. Should I apply the hotfix or any MSFT fix?
I will wait to hear from y'all. Thanks in advance.
I can not work today without my computer.
-
As I'd said before, MS send these Hotfixes to you via email.
However, if you aren't sure that is the right one for you then perhaps best to leave it.
You haven't answered if you have AOMEI installed or have had it installed.
You may be able to get into Safe Mode by using msconfig
Go Start - type msconfig and press enter then under the Boot tab check the box for Safe boot and if you want that with Networking, then also check the box for Network - Apply - OK - Restart
If that gets you in, go Start - type services.msc and press enter then look for AOMEI or similar in Services.
It may be showing as Started and Automatic.
You can change its status to Manual by right clicking on it and selecting Properties then use the dropdown to select Manual - Stop - Apply - OK
Go File/Exit to close Services,
While you are in Safe Mode you can check to see what the chkdsk found.
Go Start - type eventvwr and press enter and when Event Viewer opens, ensure Event Viewer (Local) is highlighted.
When it has read the data etc. expand Windows Logs and click on Application/Action/Find then type chkdsk or wininit into the Find box and press enter.
Cancel the Find box and read the report in the scrollable window, checking to see if it finds any KBs in bad sectors, although you have to use the slider bars and down arrow to read it, but I think your BSODs are probably caused by that AOMEI.sys driver.
To boot back to normal you will have to go back into msconfig - uncheck the box for Network if you have chosen it and then uncheck the box for Safe boot - Apply - OK - Restart and then see how the computer performs.
If things are back to normal and you have AOMEI and want to continue using it, then I suggest you reinstall it as it has become buggy.
You should be able to do that in Safe Mode with Networking if you still have problems in normal mode.
EDIT - I was writing this post while you were replying but do what I've suggested in Safe Mode.
-
OK, Boggin. And, thanks again for your help.
I could not use the Advanced/.../Find the way you described it, but I did get to an event viewer that showed the 16 hour chkdsk did complete around 2:30 AM. Zero bad sectors. :)
OK, sorry for not answering your question about AOMEI. Yes, I have it and have installed it and have been using for years. Works like a charm; even restore whole machine to another completely different machine; BTW, I wanted to spend top dollar for backup as I figured any low-priced BU would be unreliable, etc. I tried Acronis; absolutely impossible to use and help non existent without $90 call per incident --- where did it put it? --- is it complete? --- whey does it not restore? --- etc. --- all no brainers; but, I should be able to install and use without support; No?
More BTW: I tried Paragon --- not as expensive but same thing; not easy to use; support wacky, etc.
Then, AOMEI, and wham: Great backup. All the time. Restores like a charm. No brainer to use --- even differential and incremental!
So, yes I apologize for not answering. I have it and have used it for years.
I did notice one message about Backerupper (the AOMEI) product --- "possibly corrupted."
But, then a Netgear problem. But, right now in Safe Mode Netork seems connected.
Maybe best if I give you the sequence:
Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 8/6/2017 6:57:18 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
3043584 file records processed.
File verification completed.
39074 large file records processed.
0 bad file records processed.
2 EA records processed.
278 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
3397294 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
3043584 file SDs/SIDs processed.
Cleaning up 131 unused index entries from index $SII of file 0x9.
Cleaning up 131 unused index entries from index $SDH of file 0x9.
Cleaning up 131 unused security descriptors.
Security descriptor verification completed.
176856 data files processed.
CHKDSK is verifying Usn Journal...
53585616 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
3043568 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
137183270 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
1953019903 KB total disk space.
1399725324 KB in 2824137 files.
1333648 KB in 176857 indexes.
0 KB in bad sectors.
3227847 KB in use by the system.
65536 KB occupied by the log file.
548733084 KB available on disk.
4096 bytes in each allocation unit.
488254975 total allocation units on disk.
137183271 allocation units available on disk.
Internal Info:
00 71 2e 00 a5 ca 2d 00 5d aa 3e 00 00 00 00 00 .q....-.].>.....
60 31 00 00 16 01 00 00 00 00 00 00 00 00 00 00 `1..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-06T10:57:18.000000000Z" />
<EventRecordID>1103842</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
3043584 file records processed.
File verification completed.
39074 large file records processed.
0 bad file records processed.
2 EA records processed.
278 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
3397294 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
3043584 file SDs/SIDs processed.
Cleaning up 131 unused index entries from index $SII of file 0x9.
Cleaning up 131 unused index entries from index $SDH of file 0x9.
Cleaning up 131 unused security descriptors.
Security descriptor verification completed.
176856 data files processed.
CHKDSK is verifying Usn Journal...
53585616 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
3043568 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
137183270 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
1953019903 KB total disk space.
1399725324 KB in 2824137 files.
1333648 KB in 176857 indexes.
0 KB in bad sectors.
3227847 KB in use by the system.
65536 KB occupied by the log file.
548733084 KB available on disk.
4096 bytes in each allocation unit.
488254975 total allocation units on disk.
137183271 allocation units available on disk.
Internal Info:
00 71 2e 00 a5 ca 2d 00 5d aa 3e 00 00 00 00 00 .q....-.].>.....
60 31 00 00 16 01 00 00 00 00 00 00 00 00 00 00 `1..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
===
Log Name: Application
Source: Backupper Service
Date: 8/6/2017 6:57:36 AM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The description for Event ID 0 from source Backupper Service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Backupper Service
Backupper Service in OnStart
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Backupper Service" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-06T10:57:36.000000000Z" />
<EventRecordID>1103843</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>Backupper Service</Data>
<Data>Backupper Service in OnStart</Data>
</EventData>
</Event>
===
Log Name: Application
Source: FrAgent
Date: 8/6/2017 6:57:41 AM
Event ID: 105
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The service was started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="FrAgent" />
<EventID Qualifiers="0">105</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-06T10:57:41.000000000Z" />
<EventRecordID>1103844</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
</EventData>
</Event>
===
Log Name: Application
Source: NetgearSwitchUSB
Date: 8/6/2017 6:57:42 AM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The description for Event ID 0 from source NetgearSwitchUSB cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
NetgearSwitchUSB
MediatekSwitchUSB in OnStart
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="NetgearSwitchUSB" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-06T10:57:42.000000000Z" />
<EventRecordID>1103845</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>NetgearSwitchUSB</Data>
<Data>MediatekSwitchUSB in OnStart</Data>
</EventData>
</Event>
===
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 8/6/2017 6:57:47 AM
Event ID: 4101
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
Windows license validated.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
<EventID Qualifiers="16384">4101</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-06T10:57:47.000000000Z" />
<EventRecordID>1103846</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>0x00000000</Data>
<Data>0x00000001</Data>
</EventData>
</Event>
===
Log Name: Application
Source: Microsoft-Windows-EventSystem
Date: 8/7/2017 2:33:23 AM
Event ID: 4625
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />
<EventID Qualifiers="16384">4625</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:23.000000000Z" />
<EventRecordID>1103847</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">86400</Data>
<Data Name="param2">SuppressDuplicateDuration</Data>
<Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>
</EventData>
</Event>
===
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 8/7/2017 2:33:23 AM
Event ID: 1531
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: M764-140-DQ64G3
Description:
The User Profile Service has started successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1531</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:23.099017100Z" />
<EventRecordID>1103849</EventRecordID>
<Correlation />
<Execution ProcessID="1840" ThreadID="2136" />
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
</EventData>
</Event>
===
Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 8/7/2017 2:33:24 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
3043584 file records processed.
File verification completed.
38469 large file records processed.
0 bad file records processed.
2 EA records processed.
278 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
3397298 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
3043584 file SDs/SIDs processed.
Security descriptor verification completed.
176858 data files processed.
CHKDSK is verifying Usn Journal...
53758848 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
3043568 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
137186535 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
1953019903 KB total disk space.
1399711764 KB in 2824056 files.
1333652 KB in 176859 indexes.
0 KB in bad sectors.
3228347 KB in use by the system.
65536 KB occupied by the log file.
548746140 KB available on disk.
4096 bytes in each allocation unit.
488254975 total allocation units on disk.
137186535 allocation units available on disk.
Internal Info:
00 71 2e 00 56 ca 2d 00 0e aa 3e 00 00 00 00 00 .q..V.-...>.....
60 31 00 00 16 01 00 00 00 00 00 00 00 00 00 00 `1..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:24.000000000Z" />
<EventRecordID>1103848</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
3043584 file records processed.
File verification completed.
38469 large file records processed.
0 bad file records processed.
2 EA records processed.
278 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
3397298 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
3043584 file SDs/SIDs processed.
Security descriptor verification completed.
176858 data files processed.
CHKDSK is verifying Usn Journal...
53758848 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
3043568 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
137186535 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
1953019903 KB total disk space.
1399711764 KB in 2824056 files.
1333652 KB in 176859 indexes.
0 KB in bad sectors.
3228347 KB in use by the system.
65536 KB occupied by the log file.
548746140 KB available on disk.
4096 bytes in each allocation unit.
488254975 total allocation units on disk.
137186535 allocation units available on disk.
Internal Info:
00 71 2e 00 56 ca 2d 00 0e aa 3e 00 00 00 00 00 .q..V.-...>.....
60 31 00 00 16 01 00 00 00 00 00 00 00 00 00 00 `1..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
===
Log Name: Application
Source: Backupper Service
Date: 8/7/2017 2:33:44 AM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The description for Event ID 0 from source Backupper Service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Backupper Service
Backupper Service in OnStart
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Backupper Service" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:44.000000000Z" />
<EventRecordID>1103850</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>Backupper Service</Data>
<Data>Backupper Service in OnStart</Data>
</EventData>
</Event>
===
Log Name: Application
Source: FrAgent
Date: 8/7/2017 2:33:48 AM
Event ID: 105
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The service was started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="FrAgent" />
<EventID Qualifiers="0">105</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:48.000000000Z" />
<EventRecordID>1103851</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
</EventData>
</Event>
===
Log Name: Application
Source: NetgearSwitchUSB
Date: 8/7/2017 2:33:50 AM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The description for Event ID 0 from source NetgearSwitchUSB cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
NetgearSwitchUSB
MediatekSwitchUSB in OnStart
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="NetgearSwitchUSB" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-07T06:33:50.000000000Z" />
<EventRecordID>1103852</EventRecordID>
<Channel>Application</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>NetgearSwitchUSB</Data>
<Data>MediatekSwitchUSB in OnStart</Data>
</EventData>
</Event>
===
So, Boggin' the last event was at
8-7-2017 2:33:50 AM
So, when I looked at 930 there was the BSD.
BTW, AOMEI was already stopped here in safe mode.
And, I am about to delete it so I can reinstall fresh.
But, I will wait to hear from you.
How did it get corrupt, I wonder; how can I prevent this in the future.
I have no idea what the Netgear USB thing is other than I have a Netgear wireless plugged into my USB for communications; I can not use wired here as d-mark for fiber is on the other side of the building.
BTW, I wonder if there is any way to print this log out except screen by screen.
Should I run another Tweaking?
Thanks, again Boggin for all your help!
-
Reinstalling AOMEI will probably be a good idea but in Programs and Features, when you right click on it do you get a Repair option ?
I don't know why it is snagging that Netgear if that is your wireless dongle.
Can you go to Device Manager/View/Show hidden devices and check for any yellow alerts - you may need to expand Network adapters and Non-Plug and Play Drivers.
I don't know if you can get a driver update for the dongle, but if you aren't getting any connectivity problems then I'd ignore that error.
BTW - Is AOMEI a paid for or free program ?
-
Thanks again Boggin for your assistance!
AOMEI was free but once I saw that it worked so well, I purchased a license.
Yellow on Devices: [after expanding every + sign]
Microsoft Teredo Tunneling Adapter > This device cannot start. (Code 10)
Apowersoft Audio Device - "unknown device"
BTW, AOMEI.
And, I am about to delete it so I can reinstall fresh.
Questions:
1. How did AOMEI get corrupt, I wonder; how can I prevent this in the future.
Wireless seems good. So as you said, I will not worry about that.
2. BTW, I wonder if there is any way to print this log out except screen by screen.
3. Should I run another Tweaking?
So, I am uninstalling AOMEI and rebooting.
I will then reinstall AOMEI and reboot again.
Keeping fingers crossed.
I will appreciate any suggestions.
-
Yes, I uninsulated AOMEI in Programs and Features.
There was no repair option.
But, I had to restart to complete the un-install process.
In doing so, I wanted to go to Safe Mode, but it went in starting normally (F8 did not work).
And came up with a new BSD --- very different.
It is attached.
-
HOWDY - SO THIS TIME i KEPT PRESSING THE f8 CONTINUALLY TO GET TO sAFE MODE after another BSD (attached) with a new message.
Am in a quandry, here.
-
But, I tried again. F8 to Safe Mode+. Now i am in Safe Mode.
-
I've seen different causes for that stop code so I'm going to contact another member who is more used to dealing with BSODs.
He'll give you instructions in how to upload the mini dump file.
-
While you are waiting for this other member to pick up your thread, can you download BlueScreenView and post its report.
This will give a brief description of its analysis of the mini dump files.
Scroll down to the bottom of the page and use the second download link.
http://www.nirsoft.net/utils/blue_screen_view.html
It will list all of your BSODs but it's the most recent one that will be of interest.
-
Hi FreeCat.
We'll probably need a lot more data to figure this out, can you please follow these BSOD posting instructions (https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/68-blue-screen-of-death-bsod-posting-instructions-windows-10-8-1-8-7-vista.html) as much as you can and attach the zipped folder(s) back here, please.
-
OK, thanks Boggin'. I just saw these posts about BSD and have gathered the data re the BSOD posting instructions.
I can not see how to attach BSOD zip file to this post and here are answers to questions asked by the BSOD site:
BSOD zip file attached.
Here are the answer to the questions:
Howdy and thanks in advance for any help; I need this machineto work every day and have missed only Monday so far.
Major error occurred 8-4 overnight to 8-5.
I did a windows update and reboot was required and I rebooted so the update could finish overnight. In the morning was first BSOD.
Here are the answers to your questions:
This is Windows 7 Ultimate 64 bit running on a Del T7500 with 64GB of RAM using the W7 disk from Dell.
OS was not pre-installed as I had a software that took the C drive from my XP ro system and used that as a base to take the programs from XP and put them on this W7; I am not sure of all the details as the Dell OEM (no longer around) did all of this. This was done around 2009 when I bought the machine. The machine has performed pretty darned well over the years. Occasionally there were some problems (not any major ones), but never BSOD that stopped me cold. I would give you the details of these but I do not recall them too well and they were not big-deals as they were solved. OK, one was when I had to switch from wired internet to Wi-Fi. The Netgear USB dongle needed updating but could not connect after updating. Another was in attempting to change the RAID0 virtual C drive to a new drive, it took a whole weekend to boot the system; OK, that was a little bit of a big deal, but nothing like the present situation.
Hardware age 2009. OS7 running since then.
CPU is 16 processor AMD.
Video is two W7000 with four monitors each (Dell 2407P) for a total of eight monitors.
MotherBoard is Dell original with total added RAM of 64 GB.
Power supply is Dell and I believe it is 1150 or 1500 watts - hard to read).
Dell computers T7500 Desktop.
-
OK BSOD file attached here.
-
I didn't get a notification for your previous post.
I don't have anything installed to read the dump files in that format so you'll have to wait for satrow to come back.
-
OK, Bloggin, but the dump files I saw in the zip folder were just text files. But, with stuff I did not understand, but maybe you would.
-
I'll leave you with satrow on this but will monitor to see how you are getting on.
If he needs anymore info he'll let you know.
-
On reading more it seems that first BSOD matched my machine; maybe one of the others.
This brings to mind Jim's comment which has a hotfix as a solution:
"That error may indicate a disk problem. Or.. an i/o issue with the controller.
https://support.microsoft.com/en-us/help/2521220/-0x0000001e-stop-error-when-you-perform-disk-i-o-intensive-operations"
But, I will wait for satrow.
-
It's looking like Windows boot was interrupted whilst trying to run the newly updated file versions, probably by older or incompatible 3rd party drivers. Maybe your BitDefender interfering, perhaps the boot time defragger - there are several other potential suspects. The Windows driver affected appears to be Win32k.sys, the kernel driver for the graphics subsystem.
MS debug output snippet showing hardware/graphics faulting in the 8 dump files:
BugCheck 1E, {ffffffffc000001d, fffff800052ec35f, 0, fffffa8071d99a00}
Probably caused by : hardware ( nt!MmUnlockPages+22f )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 3B, {c0000005, fffff9600015e775, fffff8800832c1a0, 0}
Probably caused by : win32k.sys ( win32k!ValidateHwnd+65 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {ffffffffffffff83, 1, fffff8000529c363, 0}
Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+3bdaf )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 1E, {ffffffffc000001d, fffff800042dc35f, 0, fffffa8073f88000}
Probably caused by : hardware ( nt!MmUnlockPages+22f )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 1E, {ffffffffc000001d, fffff800042ac35f, 0, fffffa80733c9000}
Probably caused by : hardware ( nt!MmUnlockPages+22f )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 3B, {c0000005, fffff9600017e775, fffff880085c41a0, 0}
Probably caused by : win32k.sys ( win32k!ValidateHwnd+65 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 3B, {c0000005, fffff9600014ed90, fffff8800a276fb0, 0}
Probably caused by : win32k.sys ( win32k!HMValidateHandleNoSecure+10 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 1E, {ffffffffc000001d, fffff800042ac35f, 0, fffffa80781c5000}
Probably caused by : hardware ( nt!MmUnlockPages+22f )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
I'd say *something* is preventing Win32k.sys from loading the hardware drivers for the graphics cards; Win32k.sys 22/06/2017 is the newest driver loaded, the oldest is BASFND.sys from 25/04/2003!
For the best chance of keeping an older OS running, esp. on a relatively complex workstation like yours, you need to ensure that 3rd party drivers starting at Boot are kept to a minimum - get the latest versions you can, any 3rd party driver that's older than the latest Service Pack (November 2010) needs to be uninstalled or updated. Set 2011 as your target oldest date for any 3rd party drivers, newer is likely to be better.
The driver supplied with DaemonTools (amongst others), sptd.sys, is a known bad driver, often causing BSODs on W7, use the DT uninstaller and then use one of the methods here (http://www.duplexsecure.com/en/faq) to disable/uninstall the driver. Do you really need things like an active Boot time defragger?
For reference, list of 3rd party drivers by date plus pointers for further details:
**************************Tue Aug 8 01:28:50.700 2017 (UTC + 1:00)**************************
BASFND.sys Fri Apr 25 00:17:12 2003 (3EA87078)
lmimirr.sys Tue Apr 10 23:32:45 2007 (461C108D)
teamviewervpn.sys Thu Dec 13 09:22:09 2007 (4760F9C1)
ckldrv.sys Mon Mar 17 16:46:29 2008 (47DEA065)
LMIRfsDriver.sys Mon Jul 14 17:26:56 2008 (487B7E50)
inpoutx64.sys Sat Oct 18 00:01:16 2008 (48F9193C)
b57nd60a.sys Sun Apr 26 12:14:55 2009 (49F4422F)
vrvd5.sys Mon Sep 7 19:41:24 2009 (4AA553D4)
lsi_sas.sys Thu Oct 1 16:04:35 2009 (4AC4C503)
npf.sys Tue Oct 20 19:00:19 2009 (4ADDFAB3)
ISODrv64.sys Fri Jan 29 03:39:02 2010 (4B625856)
GSVDRIVE.sys Fri Dec 10 06:07:07 2010 (4D01C38B)
mcdevice.sys Thu May 19 08:09:59 2011 (4DD4C247)
FSPFltd2.sys Fri Jun 3 15:59:38 2011 (4DE8F6DA)
StarPortLite.sys Wed Oct 19 11:54:09 2011 (4E9EAC51)
vasdDev.sys Mon Mar 19 07:11:16 2012 (4F66DC14)
bdvedisk.sys Tue Apr 17 12:34:26 2012 (4F8D5542)
WinisoCDBus.sys Tue May 8 10:57:47 2012 (4FA8EE1B)
scrcamhrdrv_x64.sys Wed May 9 14:48:54 2012 (4FAA75C6)
tbhsd.sys Tue Oct 9 23:01:42 2012 (50749EC6)
bdfwfpf.sys Mon Oct 29 12:23:28 2012 (508E7540)
leawo_vad.sys Tue May 21 08:20:07 2013 (519B2027)
RrNetCapFilterDriver.sys Fri Nov 1 15:51:24 2013 (5273CDFC)
BootDefragDriver.sys Mon Nov 11 03:01:36 2013 (52804890)
hotcore3.sys Mon Dec 16 15:56:37 2013 (52AF22B5)
UimFIO.SYS Mon Dec 16 16:03:22 2013 (52AF244A)
UimBus.sys Mon Dec 16 16:03:26 2013 (52AF244E)
uim_im.sys Mon Dec 16 16:03:46 2013 (52AF2462)
uim_devim.sys Mon Dec 16 16:03:57 2013 (52AF246D)
clwvd.sys Tue Jan 28 03:58:25 2014 (52E72AE1)
Sleen1864.sys Tue Jan 28 12:54:11 2014 (52E7A873)
HD-Hypervisor-amd64.sys Thu May 1 08:28:08 2014 (5361F788)
wav_mixer.sys Fri May 9 07:58:59 2014 (536C7CB3)
eudskacs.sys Wed Aug 13 17:43:54 2014 (53EB95CA)
eubakup.sys Wed Aug 13 17:44:00 2014 (53EB95D0)
EUBKMON.sys Wed Aug 13 17:44:22 2014 (53EB95E6)
EuFdDisk.sys Wed Aug 13 17:44:27 2014 (53EB95EB)
AntiLog64.sys Thu Nov 6 10:22:02 2014 (545B4BCA)
sptd.sys Thu Dec 11 14:52:44 2014 (5489AFBC)
bdfndisf6.sys Mon Dec 15 15:39:07 2014 (548F009B)
ElbyCDIO.sys Wed Dec 17 23:30:51 2014 (5492122B)
mse.sys Fri Jan 2 15:49:21 2015 (54A6BE01)
GUSBootStartup.sys Thu Apr 23 03:01:12 2015 (55385268)
cbfs5.sys Fri Apr 24 21:41:26 2015 (553AAA76)
vpnpbus.sys Fri Apr 24 21:42:22 2015 (553AAAAE)
gzflt.sys Wed Apr 29 12:32:17 2015 (5540C141)
trufos.sys Mon May 11 09:26:27 2015 (555067B3)
avchv.sys Tue May 12 13:14:18 2015 (5551EE9A)
diskpt.sys Mon Jul 27 13:02:36 2015 (55B61DDC)
vDisk.sys Mon Aug 17 04:20:15 2015 (55D152EF)
diskbckp.sys Mon Aug 17 04:20:17 2015 (55D152F1)
AtihdW76.sys Wed Mar 30 06:00:37 2016 (56FB5D75)
atikmpag.sys Sun Apr 17 02:50:25 2016 (5712EBE1)
atikmdag.sys Sun Apr 17 03:57:02 2016 (5712FB7E)
tap0901.sys Thu Apr 21 10:10:05 2016 (571898ED)
avc3.sys Wed Jun 22 18:34:09 2016 (576ACC11)
A6210.sys Thu Sep 15 13:14:21 2016 (57DA909D)http://www.carrona.org/drivers/driver.php?id=BASFND.sys (http://www.carrona.org/drivers/driver.php?id=BASFND.sys)
http://www.carrona.org/drivers/driver.php?id=lmimirr.sys (http://www.carrona.org/drivers/driver.php?id=lmimirr.sys)
http://www.carrona.org/drivers/driver.php?id=teamviewervpn.sys (http://www.carrona.org/drivers/driver.php?id=teamviewervpn.sys)
http://www.carrona.org/drivers/driver.php?id=ckldrv.sys (http://www.carrona.org/drivers/driver.php?id=ckldrv.sys)
http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys (http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys)
http://www.carrona.org/drivers/driver.php?id=inpoutx64.sys (http://www.carrona.org/drivers/driver.php?id=inpoutx64.sys)
http://www.carrona.org/drivers/driver.php?id=b57nd60a.sys (http://www.carrona.org/drivers/driver.php?id=b57nd60a.sys)
http://www.carrona.org/drivers/driver.php?id=vrvd5.sys (http://www.carrona.org/drivers/driver.php?id=vrvd5.sys)
http://www.carrona.org/drivers/driver.php?id=lsi_sas.sys (http://www.carrona.org/drivers/driver.php?id=lsi_sas.sys)
http://www.carrona.org/drivers/driver.php?id=npf.sys (http://www.carrona.org/drivers/driver.php?id=npf.sys)
http://www.carrona.org/drivers/driver.php?id=ISODrv64.sys (http://www.carrona.org/drivers/driver.php?id=ISODrv64.sys)
GSVDRIVE.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
mcdevice.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
FSPFltd2.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=StarPortLite.sys (http://www.carrona.org/drivers/driver.php?id=StarPortLite.sys)
http://www.carrona.org/drivers/driver.php?id=vasdDev.sys (http://www.carrona.org/drivers/driver.php?id=vasdDev.sys)
http://www.carrona.org/drivers/driver.php?id=bdvedisk.sys (http://www.carrona.org/drivers/driver.php?id=bdvedisk.sys)
http://www.carrona.org/drivers/driver.php?id=WinisoCDBus.sys (http://www.carrona.org/drivers/driver.php?id=WinisoCDBus.sys)
scrcamhrdrv_x64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=tbhsd.sys (http://www.carrona.org/drivers/driver.php?id=tbhsd.sys)
http://www.carrona.org/drivers/driver.php?id=bdfwfpf.sys (http://www.carrona.org/drivers/driver.php?id=bdfwfpf.sys)
leawo_vad.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=RrNetCapFilterDriver.sys (http://www.carrona.org/drivers/driver.php?id=RrNetCapFilterDriver.sys)
http://www.carrona.org/drivers/driver.php?id=BootDefragDriver.sys (http://www.carrona.org/drivers/driver.php?id=BootDefragDriver.sys)
http://www.carrona.org/drivers/driver.php?id=hotcore3.sys (http://www.carrona.org/drivers/driver.php?id=hotcore3.sys)
http://www.carrona.org/drivers/driver.php?id=UimFIO.SYS (http://www.carrona.org/drivers/driver.php?id=UimFIO.SYS)
http://www.carrona.org/drivers/driver.php?id=UimBus.sys (http://www.carrona.org/drivers/driver.php?id=UimBus.sys)
http://www.carrona.org/drivers/driver.php?id=uim_im.sys (http://www.carrona.org/drivers/driver.php?id=uim_im.sys)
http://www.carrona.org/drivers/driver.php?id=uim_devim.sys (http://www.carrona.org/drivers/driver.php?id=uim_devim.sys)
http://www.carrona.org/drivers/driver.php?id=clwvd.sys (http://www.carrona.org/drivers/driver.php?id=clwvd.sys)
Sleen1864.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=HD-Hypervisor-amd64.sys (http://www.carrona.org/drivers/driver.php?id=HD-Hypervisor-amd64.sys)
wav_mixer.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=eudskacs.sys (http://www.carrona.org/drivers/driver.php?id=eudskacs.sys)
http://www.carrona.org/drivers/driver.php?id=eubakup.sys (http://www.carrona.org/drivers/driver.php?id=eubakup.sys)
http://www.carrona.org/drivers/driver.php?id=EUBKMON.sys (http://www.carrona.org/drivers/driver.php?id=EUBKMON.sys)
http://www.carrona.org/drivers/driver.php?id=EuFdDisk.sys (http://www.carrona.org/drivers/driver.php?id=EuFdDisk.sys)
http://www.carrona.org/drivers/driver.php?id=AntiLog64.sys (http://www.carrona.org/drivers/driver.php?id=AntiLog64.sys)
http://www.carrona.org/drivers/driver.php?id=sptd.sys (http://www.carrona.org/drivers/driver.php?id=sptd.sys)
http://www.carrona.org/drivers/driver.php?id=bdfndisf6.sys (http://www.carrona.org/drivers/driver.php?id=bdfndisf6.sys)
http://www.carrona.org/drivers/driver.php?id=ElbyCDIO.sys (http://www.carrona.org/drivers/driver.php?id=ElbyCDIO.sys)
http://www.carrona.org/drivers/driver.php?id=mse.sys (http://www.carrona.org/drivers/driver.php?id=mse.sys)
GUSBootStartup.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=cbfs5.sys (http://www.carrona.org/drivers/driver.php?id=cbfs5.sys)
http://www.carrona.org/drivers/driver.php?id=vpnpbus.sys (http://www.carrona.org/drivers/driver.php?id=vpnpbus.sys)
http://www.carrona.org/drivers/driver.php?id=gzflt.sys (http://www.carrona.org/drivers/driver.php?id=gzflt.sys)
http://www.carrona.org/drivers/driver.php?id=trufos.sys (http://www.carrona.org/drivers/driver.php?id=trufos.sys)
http://www.carrona.org/drivers/driver.php?id=avchv.sys (http://www.carrona.org/drivers/driver.php?id=avchv.sys)
http://www.carrona.org/drivers/driver.php?id=diskpt.sys (http://www.carrona.org/drivers/driver.php?id=diskpt.sys)
vDisk.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
diskbckp.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=AtihdW76.sys (http://www.carrona.org/drivers/driver.php?id=AtihdW76.sys)
http://www.carrona.org/drivers/driver.php?id=atikmpag.sys (http://www.carrona.org/drivers/driver.php?id=atikmpag.sys)
http://www.carrona.org/drivers/driver.php?id=atikmdag.sys (http://www.carrona.org/drivers/driver.php?id=atikmdag.sys)
http://www.carrona.org/drivers/driver.php?id=tap0901.sys (http://www.carrona.org/drivers/driver.php?id=tap0901.sys)
http://www.carrona.org/drivers/driver.php?id=avc3.sys (http://www.carrona.org/drivers/driver.php?id=avc3.sys)
http://www.carrona.org/drivers/driver.php?id=A6210.sys (http://www.carrona.org/drivers/driver.php?id=A6210.sys)
--- E O J --- 2017 Aug 08 15:57:25 PM 3rdPartyDriversDate Copyright 2017 Mikael Pryor
-
Howdy satrow,
Thanks for all your thoughts.
BTW, what is the DRT?
Re: BASFND - Since I am using Netgear wireless, is this necessary? I spend just 30 minutes trying to login to Broadcom and their PW system is IMPOSSIBLE! Is there some simplier way to get this driver.
Re: Bitdefender. About two years ago, one of my data feeds was being cut off by Bitdefender. I tried to contact Bitdefender about this but could get no answer or fix from them. So, I attempted to un-install bitdefender but could never get it completely off. It always comes up with some message to update it or whatever. So, maybe telling me how to complete get it off my machine might be a good things here. BTW, which anti-virus would you suggest for best and total protection?
Re: Older operating system. I do not use the virtual capabilities of W7 Ultimate so I do not run any older operating systems at present.
Re: Boot time de-fragger. If I do not need this, I can delete it. But, I am not sure if it helps my system or not.
Re Graphics drivers. Originally I had Matrox cards in this machine, but they were very slow, etc. Then i put in NVIDA cards but could not drive all 8 monitors, I got the AMD W7000 in 2012 but AMD had very flaky support at that time for these cards and drivers would not work properly for a while. At the end of 2013, AMD released drivers that worked. To my knowledge I un-installed all other video drivers and I do not need any except the ones for the W7000. So,
it would be good, I think, to drop the W2k32sys driver. No? If that is a stupid idea and I should keep Win32k.sys driver, how to I get and install the latest?
At the rate I am going here to replace all of these, I will be here till Christmas. is there some site at which many drivers are located? Or some reliable tool that can get the latest for me?
BTW, when I get a new driver, do I just put it in the Windows folder somwhere or how to I put it on the system?
Thanks, again, for your work to help me.
-
DRT = Driver Reference Table at Carrona.org, mirrored at Sysnative (https://www.sysnative.com/drivers/). A big list of the commonest drivers, often linking them to the originating site, where it might be possible to find drivers or further details.
If you're not using a piece of hardware, remove it or disable it from within the BIOS and that should prevent the driver from being loaded at Boot. (Here's how to determine which Broadcom device you have https://www.broadcom.com/support/ethernet-nic#determine_driver, it's a similar routine for other hardware drivers as well.)
I think you're running the old BitDefender 2015 version, uninstaller linked here (https://forum.bitdefender.com/index.php?/topic/40936-uninstall-tool-old-bitdefender-antivirus-free-edition-2015/). There's no single security software that's foolproof, most that claim to be are quite heavy and can interfere too much with eg. baked-in browser security, to the extent that you might be more at risk. Avast, Avg, Avira free versions are all quite good when they've been stripped down to remove the dross. Much depends on your PC usage though.
Now that Vista's fallen over the cliff, W7 is an older OS. MS' support for it has already declined, the latest CPU/motherboard chipsets don't support W7 - for older hardware, drivers are rarely updated.
The AMD drivers are likely to be good (though I'd still check for a more recent driver), Win32k.sys is a core Windows driver that sits between the graphics drivers, DirectX and GDI (https://en.wikipedia.org/wiki/Graphics_Device_Interface), and the Windows kernel. It's frequently updated to fix vulnerabilities - if it's compromised by some malformed fonts, for instance, it can lead to the PC being owned by the bad guys. It's not something that's possible to disable, without it, there's be no windows in Windows!
There are a few software programs that claim to find, and some might even install, updated drivers but they're not 100% accurate (neither are Windows' driver updates, even with W10), one bad driver and you might be back to BSODs.
Many drivers come as part of an installer package, so they're pretty much automated, others might need installing via the Device Manager (check the upper images in the above Broadcom links and you'll see Update Driver options in the menus).
-
I am lost with all the driver stuff from satnow. I really want to thank him for all the information, but basically it tells me that the problem could be in 367 different places. And getting each driver one is like eating spagetti that is in Italy with very long forks when I am in Florida.
I did scannow - complete 100% and said there were errors but log file did not have any errors. I'd like to see those errors but log file is 0 bytes (great programming Mr. Softie. :).
Either Jim, satnow or Boggin suggested some virus checker but I can not find the link (went through emails and forum twice). I would like to try virus checker.
Then as a last resort, just go back to the checkpoints I made before the update. I think I did registry back then also. Or, if I knew how, just uninstall the Windows update.
Could this make this worse?
Thanks.
-
Your BSODs seem to start after those updates so going back to before them with your restore points could just put you back to where you are now unless you hid them when offered again.
I only suggested you could have an infection if you didn't have AOMEI installed.
To identify which updates you got, go Start - type windows update and press enter then click on View update history where you can make a note of their KB numbers.
You will then need to go to Installed Updates, put the KB number into the top right search box and when it comes up, right click on it and select Uninstall, but it will be a slow process as each one will require a reboot and reconfigure updates.
It may not have been all of the updates that caused the BSODs.
You could use your restore points to go back to before them and when they are re-offered, just select one at a time and if things are okay after the reboot, create a restore point and do the same for the rest of the updates.
I think it was a year or so ago that some of six updates I got on my Win 7 laptop took out my audio and that is what I did to identify which ones.
The thing is though that you can't access Windows update in Safe Mode to uninstall a particular update if you end up with another BSO, but you will be able to use the new restore points you have created and then when you get that update again, right click on it and select Hide.
Change you update settings to Let me choose.. and then you will be able to vet them for single installs.
-
According to systeminfo.txt, the last 10 KBs installed:
[235]: KB3156019
[236]: KB3159398
[237]: KB3161561
[238]: KB3161949
[239]: KB3161958
[240]: KB3163245
[241]: KB3164033
[242]: KB3164035
[243]: KB3167679
[244]: KB3168965
[245]: KB3170455
-
Thanks for your help Boggin and satnow, but:
Grrrr. In trying to use a restore point in safe mode, the systems says "no restore points have been created."
But, I definitely created some before the update. Did a registry backup also. See scannow message, attached. Maybe with a reboot I can see the log file?
-
Can you load MSConfig (Start > Run 'msconfig' ) and choose Selective Startup + Load System Services, Apply and Ok, allow it to reboot - hopefully, it will start without a BSOD, so you can then begin checking those logs, trying to access System Restore, maybe begin uninstalls, ... ?
-
Howdy,
I did what you said satnow, but got another BSOD, attached
-
Another 0x3b with access denied relating to win32k.sys. It's late here, see what Boggin comes up with later, he might be online again in ~5 hours.
-
Thanks, Satnow.
-
Restore points being wiped out can be a cause of an infection, but you need to see if they are still enabled.
Can you go to System protection and check that it's still showing as On.
In your opening post I've noticed that you say you are using Pro Ultimate - which is it, Pro or Ultimate as they are two separate versions and did you download and create a new install disk as I'd laid out in my Reply #1
If you hadn't then as you can now get Safe Mode with Networking, you'll be able to do it on your own machine.
With that you can perform an offboot sfc /scannow but it isn't guaranteed to repair what a normal sfc /scannow was unable to.
The steps for that are in my Reply #1.
To view the CBS log produced by a sfc /scannow, enter this cmd which will produce a desktop icon which when double clicked will open the log in Notepad.
You can copy & paste the cmd to the cmd prompt but it is best done straight after a sfc /scannow as the CBS log can be volatile.
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt
This produces a cut down version of the CBS log showing what it could and couldn't repair.
Downloading and running SFCFix.exe straight after a sfc /scannow may have some success but will produce its own log, but it must be run straight after a sfc /scannow.
http://www.majorgeeks.com/files/details/sfcfix.html
You can copy & paste both those reports into your reply box.
Is Event Viewer still showing the same errors or have any more been produced with the change of the stop error code ?
To rule out an infection, I want you to run a scan with the free ESET Online Scanner while in Safe Mode with Networking.
https://www.eset.com/uk/home/online-scanner/
Hit the SCAN NOW box.
Click on Advanced settings and check those boxes except for Archives and Proxy - it can take a while to run.
There's also a box to uninstall on completion if I remember rightly.
-
Forgot to add this but you can uninstall those updates that satrow has listed by going Start - type installed updates and press enter.
Click on the top right search box and enter the update in full - i.e. KB3156019 and that will come up in the main pane along with its install date.
Right click on each in turn and select Uninstall.
You can defer the restart until you have uninstalled all of them which will boot you back into normal mode and not sure if you'll be back with the BSOD, but it will go through a partial reconfigure before it shuts down and then restarts.
-
It's W7 x64 Ultimate SP1.
Info for the PC from systeminfo.txt/MSInfo32:
OS Name: Microsoft Windows 7 Ultimate
OS Version: 6.1.7601 Service Pack 1 Build 7601
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Organization:
Product ID: xxxxx-xxx-xxxxxxx-xxxxx
Original Install Date: 6/11/2013, 12:03:35 PM
System Boot Time: 8/7/2017, 8:44:07 PM
System Manufacturer: Dell Inc.
System Model: Precision WorkStation T7500
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: Intel64 Family 6 Model 26 Stepping 5 GenuineIntel ~2926 Mhz
[02]: Intel64 Family 6 Model 26 Stepping 5 GenuineIntel ~2926 Mhz
BIOS Version: Dell Inc. A14, 7/6/2012
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-05:00) Eastern Time (US & Canada)
Total Physical Memory: 65,534 MB
Available Physical Memory: 61,120 MB
Virtual Memory: Max Size: 131,065 MB
Virtual Memory: Available: 126,708 MB
Virtual Memory: In Use: 4,357 MB
-
Thanks, Boggin and Satnow.
OK, I have a lot of stuff to do, so I will give you answers and outline what I understand.
System Protection is turned off. I will leave it off until you tell me to turn it on.
(I have never touched it previously; did not know it was there.)
Yes, I have Ultimate. Pro was on system when purchased, but Dell wiped it and installed Ultimate.
(Sorry for confusion on this.)
I have begun the eSet AV scan; looks like it will take a while; 5% done, so far so good. Re Virus Scann: Bloggin, I saw that in May 2017 you tried Bitdefender. Did you like it? What were those others you suggested; I looked through the log but got lost and could not find them.
I saved the event viewer, but I am not sure if this is what you can see (ATTACHED). Last time I did it screen by screen and it took over an hours; let me know if this is good or tell me a way to get it to you without screen by screen --- there must be a way.
Next I am going to try to uninstall the updates as per Satnow's list.
Then, I will work on the scannow stuff as it seems more complicated than un-install of update.
Thanks again for your help, Satnow and bloggin.
Jim, mentioned this hotfix for the scannow problem; I have been told that hotfixes are dicey and should be used only as a last resort:
"There seems to be a hotfix for that – but defiantly coming back to something with your drivers is not happy with the update at all.:
https://support.microsoft.com/en-us/help/980932/stop-error-code-0x0000003b-system-service-exception-on-a-computer-that
-
Hi Bloggin,
I went to un-install the first update but no results found. See attached. Maybe I did it incorrectly.
BTW, eStat still no errors.
The Bitdefender uninstall did not uninstall it.
-
You would need to clear Start from the box before you enter the KB number.
Did you go Start - type installed updates to get that window because it looks more like Windows Explorer.
It's strange that you should mention Bitdefender as I've seen an entry for BDVEDISK in the event log.
I'm in the middle of composing a fuller reply.
-
You should have system protection turned on.
BTW - Is jpm (Jim) emailing you these Hotfixes ?
I wasn't overly impressed with Bitdefender because it was slow to start on boot and Windows Defender was kicking in (Win 10).
I used IObit Uninstaller to uninstall Bitdefender as Windows Uninstall which is supposed to uninstall it tends to leave residue.
However, you should be able to remove BDVEDISK using FreeFixer. - http://www.freefixer.com/
You can also use FreeFixer to remove anything else that has a box next to it where it says the file is not found - these are residue.
I gave Windows Defender a go but wasn't sure just how effective it was so went back to my paid for Norton Security.
You don't have a lot of Errors recorded but I did notice one for BDVEDISK not being able to load.
That belongs to Bitdefender, so have you had it installed at one time ?
Looking at this article, BDVEDISK can cause a 0x03B BSOD but it would have BDVEDISK.sys in the stop code.
http://www.fixoserror.com/fix-bdvedisk-sys-blue-screen-error-step-by-step.html
This article is for info only - don't go clicking on any download buttons.
I've gone down past that error and haven't been able to find it to copy & paste.
I'm not sure what this error means - perhaps satrow may have an idea.
Log Name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Source: Microsoft-Windows-Windows Firewall With Advanced Security
Date: 09/08/2017 01:36:28
Event ID: 2011
Task Category: None
Level: Information
Keywords:
User: LOCAL SERVICE
Computer: M764-140-DQ64G3
Description:
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
Reason: The application is a system service
Application Path: C:\windows\system32\lsass.exe
IP Version: IPv4
Protocol: TCP
Port: 49154
Process ID: 664
User: SYSTEM
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Firewall With Advanced Security" Guid="{D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85}" />
<EventID>2011</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-08-09T00:36:28.762974400Z" />
<EventRecordID>178597</EventRecordID>
<Correlation />
<Execution ProcessID="1068" ThreadID="1140" />
<Channel>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="ReasonCode">1</Data>
<Data Name="ApplicationPath">C:\windows\system32\lsass.exe</Data>
<Data Name="IPVersion">0</Data>
<Data Name="Protocol">6</Data>
<Data Name="Port">49154</Data>
<Data Name="ProcessId">664</Data>
<Data Name="ModifyingUser">S-1-5-18</Data>
</EventData>
</Event>
-
You also have a couple of these but I think you've already run a chkds /r haven't you ?
Log Name: System
Source: Ntfs
Date: 09/08/2017 01:35:30
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume4.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="49156">55</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-09T00:35:30.902472700Z" />
<EventRecordID>1205144</EventRecordID>
<Channel>System</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>\Device\HarddiskVolume4</Data>
<Binary>0C000C000200380002000000370004C000000000020100C000000000000000000000000000000000EE0C14001A00000000000100</Binary>
</EventData>
</Event>
-
The last Hotfix (https://support.microsoft.com/en-us/help/980932/stop-error-code-0x0000003b-system-service-exception-on-a-computer-that) doesn't apply here, it's an older 'fix', pre-SP1.
Try the latest BitDefender Uninstall tool: http://www.majorgeeks.com/files/details/bitdefender_uninstall_tool.html
-
Thanks for this. I will get to it as soon as anti-virus eSet finishes.
-
Just a reminder, go Start - type installed updates and press enter when View installed updates comes up.
Has ESET found anything yet - it usually tells you as it progresses.
Have you previously run a chkdsk /r ?
-
Howdy Bloggin and Satnow,
Yes I did run chkdsk 0 errors and I believe the /R was the parameter.
eSet still running (10+ hours so far) and 7 threats found. I hope these 7 threats are listed with some option to delete them when eSet is done. :|
So, I guess it is best to wait before proceeding with the other suggestions like attempting the uninstall of W7 updates.
BTW, I did have BitDefender and it worked too well interfering with my life streaming data. so I attempted to uninstall it over a year ago; some of it stopped working; but there was always a ghost of it running. I remember one was AVG and there were two more; what were the other two?
I will prolly try the other one you mentioned once I get out of this mess.
Yes, Jim is mailing me these hotfixes.
I will turn on system protection.
I just ran the new BitDefender un-install so hopefully it is now totally gone.
I do not understand the disk error you pointed out (volume 4?). As I said the chkdsk ran and said 0 errors as per the long printout from yesterday. I am pretty sure that the /R parameter was used. Is there way to tell from the log?
Does not the Tweaking all in one tool clean things up like the left over BitDefender scrap?
I am trying the uninstalls as soon as eSet is done.
-
OK - eSat just ended so th's like 15 hours.
Good. But, after selecting all and delete selected eSet seems to be doing nothing - just sitting there no message that it is working, etc.
See attached screen and list of what it found.
BTW, WIREDTOOLS seems to be where most of the virus was. I tried to uninstall it and got message "program does not exist."
What do you suggest?
-
The chkdsk Event Viewer entry was some hours older to your last boot and it didn't reappear during the latest boot that was recorded but thought I should mention it.
It's been a while since I ran ESET but I think it should give you a box to check to uninstall the program on completion.
I'll run it on my Win 7 laptop and as I don't expect it to find anything, it could still run for an hour or so, but will get back to you on that.
I think the longest it has ran on mine was about 1¾hrs.
One of the boxes that you checked was to clean automatically, but I'll see how that goes on mine.
I should have said to also check the top button of those two options as well as those in the Advanced settings.
I can't advise what to do with ESET until it completes on mine.
This article which includes a download link will show you how to remove the WiredTools.dll using FreeFixer.
http://www.freefixer.com/library/file/WiredTools.dll-139610/
As for the ones in Program Files(x86) - go Start - click on Computer - double click on Windows (C: ) then double click on Program Files (x86) and scroll down to look for any folders with the name WiredTools - right click on them and select Delete.
Unless you had installed WiredTools, it could have been installed as an unwanted bundled program when you downloaded something else.
When downloading anything you should always look to see if there are any boxes auto checked before hitting Next or Install.
Windows Repair can repair damage caused by infections but not until the infection has been removed.
-
It's finally finished after 1hr 31mins with no threats found on a summary page with a box to Delete application's data on close.
If still nothing has happened for you, then use the X to close the window and see if it gives you a message.
-
Howdy Bloggin and Satnow,
I did it all; I was confused at times but got thru all you suggested; I think. :)
the eSet ended after about 15 hours. It found 10 things --- all were related to Wiredtools; I do not remember installing any Wiredtools --- even (on my NAS I keep the install files for everything that I install in my "1 DOWNLOADS" folder --- nothing there). I selected remove all and ended eSet with remove files from quarantine and remove applications files. "Remove from quarantine" lead me to believe maybe put back where they came from; but, I guessed right, I am hoping.
Still could not go into protect mode and could still not run scannow, but I figured I might try after a reboot with the new instructions; but now, I am sending you all this up-to-date stuff before I loose track of it. So, doing that right after I send this.
I deleted the Wiredtools in the Program Files (x86) folder. Image attached.
Filefixer found an enormous amount of stuff. I got to believe that what it found is some kind of mistake. But, I dunno. I did not check any boxes.
I have zipped the collection of stuff which is attached along with the BSOD (still the win32k) that I can after running all this.
-
Yes, remove from quarantine would have put them back.
A lot of those type of programs include adware.
FreeFixer does find a lot of stuff but you don't check the boxes on all to remove, otherwise you would end up with problems.
Any that has a removal box next to it and you aren't sure what it is, then click on the more info link.
Where it has file not found next to it, you can check the box for removal.
Did you run the Bitdefender Uninstaller as there is still some residue showing in there.
FastPCTools - did you install this program or is it something else that has ended up installed on your computer ?
AVG Secure Search - I've seen this add-on stop someone from connecting to the Internet and wouldn't have it installed.
jusched is just an updater for Java.
LogMeIn - have you ever had someone remote connect to your computer ?
I wouldn't worry about the red entries in FreeFixer.
Have you managed to uninstall those Windows Updates as you are still getting the BSOD 0x03b stop code.
-
Congratulations, Bloggin and Satnow!
W7 up and only because of your help. :)
Sorry, but yesterday, since I was out of work for 3 days, I had to go in so could not do it and did not get back till I had to sleep.
So, first thing I got the update screen showing and uninstalled the 3 updates; I thought there were 4 plus 2 .NET updates but prolly mistaken.
The screen showing them is attached.
I also got some kind of Malware bytes message, but I am not currently using that; I remember installing it and using for one day about a year ago; but, I thought I uninstalled it.
(also attached)
The machine came up very slowly, but seems ok for now.
Of course, there is more to do.
This is what I see:
1 - I should run the scannow to find bad / missing files; but I am not sure what parameters to use.
2 - I should install some anti-virus. MS Windows Defender? I think it is very slow. AVG? I saw what you said about AVG security so that, I guess is out. I just dunno.
3 - Reinstall AOMEI and backup system.
4 - Figure out what went wrong with the updates so they can be installed. Here I am totally lost.
5 - Figure out what is going on with this disk error you pointed out (pasted below). I have tow two Hitachi 2 TB Raid0 drives as my C drive. and I though they were OK based on the CHKDSK with 0 errors a few days ago. There is one other drive on the system; I am not sure what this is exactly but if I try to get to it with the explorer it looks like the attached "140" picture (the D drive in the picture is on the two Hitachi drives a one virtual drive). The drive I am speaking of is the "J" drive which is unassailable if I try to drill into it but it is somehow connected; but, there is a message index corrupt and accessible. I notice this drive in 2013 right after the Dell guy left when he was taking out my W7 Pro and installed V7 Ultimate. I called Dell to ask about it and I could not get the same guy, but they told me if everything else is working ok, don't worry about it. lol So, I stopped thinking about it.
So, thanks again, gentlemen for all your help and guidance. I will wait to hear from you before doing anything else.
Here is what you said about it previously which mentions a "Volume 4" and to my knowledge I do not have a volume 4:
You also have a couple of these but I think you've already run a chkds /r haven't you ?
Log Name: System
Source: Ntfs
Date: 09/08/2017 01:35:30
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Computer: M764-140-DQ64G3
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume4.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="49156">55</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-08-09T00:35:30.902472700Z" />
<EventRecordID>1205144</EventRecordID>
<Channel>System</Channel>
<Computer>M764-140-DQ64G3</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>\Device\HarddiskVolume4</Data>
<Binary>0C000C000200380002000000370004C000000000020100C000000000000000000000000000000000EE0C14001A00000000000100</Binary>
</EventData>
</Event>
I do not use this drive that I know of.
-
While I can't see all of the drives in your pic - I've never seen any with a red bar or alerting to an infection and not to boot.
What do you use those for ?
To perform a chkdsk on another drive - you would enter chkdsk x: /f or /r parameter where x is the drive letter.
So for drive J: you would enter chkdsk j: /f
I would just use the /f parameter for now because if /r finds and tries to repair bad sectors it could be running for quite a long time and the /f report would say if it found any bad sectors or would give you an error message that it was unable to continue.
The choice then would be yours to run a chkdsk /r but any drive that shows bad sectors then it is time to back that up for its pending complete fail.
I would install the free version of MBAM again as it's a very good antimalware scanner and you can use the Custom scan to select the drives you want it scan, so you can include those showing as in red.
It only shows C: and D: on mine but hopefully it will pick up on those on your machine to check the boxes for.
Hit the Download Free button - https://www.malwarebytes.com/mwb-download/
Click on Scan in the left pane and then on Custom/Configure Scan and then check the boxes for the drives.
I don't know why satrow's list of updates didn't include those, but I have KB4019990 as being installed on my Win 7 on 27th July, KB4014596 on 18th May and don't have KB4025341 installed.
After each month's updates I run Disk Cleanup as an admin which cleans out obsolete updates.
You would do that by going Start - type disk cleanup - right click on Disk Cleanup and select Run as administrator and that will do the system files.
Mine cleaned out 0.98GB of updates this month - normally it's just 2 or 300MB but if you've never run Disk Cleanup as an admin then it will probably clean out a few GBs.
I'd then do a defrag with the elevated cmd defrag /c which will do all of your drives, but don't run that cmd until you've run an antimalware scan on those other drives.
I'm not really sure about advising on a free antivirus program.
I've seen people complaining about AVG becoming bloated, Shane has no time for Avast but I've also seen where people swear by them.
I use Norton Security Deluxe which is a paid for program and that covers installation on up to 5 machines but if you shop around you can usually get it cheaper than what Norton want to charge you for it.
Kaspersky is also another paid for program which has a very good rep and I think cheaper than Norton, although because it is of Russian origin, there's the suspicion that it could be used for spying on people - I read that the US gov. is refusing to use it or anything Kaspersky.
-
Howdy Bloggin,
The red bar is my Synology NAS telling me that the drive is near 90% full; it is not a virus or anything bad.
All of my drives are in the jpg image that I sent to you; maybe scrolling would show them to you.
So, do you thin that "volume 4" error is on my C drive? Is there a way to tell from the dump info you have me? Anyway, I will just take the "J" drive out of my machine the next time I open it up.
When I look for MBAM I get some bit locker program from MS and Malware bytes. You must beam MalwareBytes.
BTW, do you just have the free version and run a scan weekly? or the personal live version?
So, I will use MBAM. When uo mention Shane has no time for Avast, what does that mean? I have time to explore once I get machine in shape. Might it be worth exploring?
Thanks for this information.
But, now I am wondering how to fix whatever stopped my machine with the updates. Should I run the scannow and with what parameters to find out if some Win 7 file has problems. Will scannow fix the problem when it finds it? What parameters to use for scannow?
Thanks again for you help.
-
You don't use any parameters for sfc /scannow which only scans system files, so may not snag what else could have caused the BSOD.
When those updates present themselves again, create a restore point and just check the box for one at a time to see which if any can cause a BSOD.
You now know how to get out of that by either using the restore point or uninstalling that update in Safe Mode.
If one of the updates was responsible for the BSOD then when it is presented again, check its box, right click on it and select Hide.
You may not get the one for KB4025341 again as I don't have it installed, so it could have been withdrawn.
I'm going to have to shoot off now but will be back later.
-
The J: is the drive flagged as having file system errors according to your logs.
If you'd like to stress test your drivers for stability now, you can - but it's not without risks and will usually trigger a BSOD, sometimes as a False Positive or occasionally pointing to a hardware problem. It might also make Windows unbootable - you need to have a Restore Point set and tested before utilising it.
https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/29-driver-verifier-blue-screen-death-related.html. Study this and double-check everything before trying it out. Personally, I'd want to get the PC fully cleaned/patched up before using it.
-
Howdy,
I ran the SFC and posted the results here twice, but they did not poste. What could be wrong?
-
Howdy here are sfc results again - attached one at a time --- first is beginning and end of log file plus sfc cmd stream messages..
Re-posting as maybe the combined attachments were too big.
My question, when you have time, is is SFC complete?
Should it be run again?
What cause it and what can I do to stope these errors in the future?
Thanks.
-
Here is the CBS.log itself --- attached.
-
My eyes blur over trying to read a full CBS log.
Run the sfc /scannow again and if it reports it is unable to repair all files then copy & paste this cmd to the prompt and press enter.
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt
This will put an icon onto the desktop which when double clicked will open the CBS log in Notepad with what it could and couldn't repair.
You can then copy and paste that into your reply box.
-
Howdy Bloggin and Satnow,
I did what Bloggin suggested with the findstr. I double checked it and did it twice but could not get the icon or the condensed results from the CBS.log. Screen print of what I did is attached.
So, I ran the sfc /scannow again and am sending that log.
Also Malware bytes found 33 threats which I quaranteened. It also found hundreds of the stuff that I do not understand. I printed the report several ways so you could read it easier and including a grahpic.
Looking to hear from you. Have not rebooted the machine yet. What are my next steps to repair this machine so I can apply updates?
Thanks in advance, fellas, for all your great help. :)
-
Bloggin, I sense that there is some way to identify the lines in CBS.log that will tell you useful information.
If you give me specifs on what to look for there, I can search and find them for you; then, I will list them out all together and send to you.
-
I would reboot to get rid of those Trojans but for that findstr command to work, it has to be run from the same command prompt as you ran the sfc /scannow from and not a standard cmd prompt.
This is what a standard cmd prompt looks like -
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Users\KAM4>
As you can see, it comes up with c:\ and the computer username but when you run the cmd prompt as an admin you get the prompt showing as system32
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
Run another sfc /scannow after the reboot and then if the sfc /scannow reports it is unable to repair some files then immediately copy & paste that findstr cmd.
This is because the CBS log can be volatile.
There's one other program you can run which I find is better at getting rid of adware and that is AdwCleaner.
http://www.majorgeeks.com/files/details/adwcleaner.html.html
Scroll down and view the vid tutorial and that will save me from explaining things.
In the lower pane where you see those items checked, sometimes AdwCleaner will snag smaller programs as PuPs that you have installed - just uncheck the box for any you want to keep before you hit Cleaning.
-
Howdy Bloggin,
Thanks for your help.
I rebooten and only checked two PUPs as those ere the only ones I knew for sure were useless.
I did my best to tructions about how to run the sfc, but I do no result.
Image of the CMD screen is attached.
I even tried some stuff of my own after I saw that it did not work.
any, I have enclosed the whole CBS file and I have another copy with all before the very last run of scf is clipped off to make it easier for you to see.
I will await further instructions. Whe did I do incorrectly?
-
Hmmm.... it looks like it can't find your profile or it could be corrupt - I wonder if you will need to create a new admin account.
Create a system image onto external media then scroll down to Fix Corrupt User Profile in Windows 7 in this article to create a new admin account and transfer your data to the new account.
https://neosmart.net/wiki/corrupt-user-profile/
Ignore the MS easy fix it link as it has been withdrawn.
When you've done that, run another sfc /scannow and if it still reports it is unable to repair all files, copy & paste that cmd again to see if it works with the new account.
I just cannot work my way through that CBS log in its current form.
-
Bloggin,
I have another user account "Administrator".
Could I just fo there and try it there?
-
Yes, you can.
-
OK, Bloggin. Done!
It is attached. I await further instructions.
Thanks y9ou for your help.
-
It just seems to be the MSDTC.Log that is being snagged.
I don't know what effect this has on the system and from a Google, even taking ownership of it and deleting it for Windows to create another hasn't worked.
What I suggest is a repair install that won't affect your personal stuff or installed programs but you will need to reinstall Windows Updates and will need an install disk that includes SP1.
I don't think you confirmed if you created a new install disk on your friend's or your computer.
If you didn't then go to https://www.microsoft.com/en-gb/software-download/windows7 and scroll down the page to enter your product key which when verified as a genuine retail key will release the ISO download for your version.
This download is ~3.09GB so can take some time to download.
Select Save and when complete, download Windows USB/DVD Burner Tool to create either a bootable USB if your computer can boot from an USB or create a bootable DVD.
http://wudt.codeplex.com/
Select Browse then go to your Downloads folder - click on the ISO then on Open and follow the prompts to create the bootable media.
Go Start - Computer - insert the DVD or USB and double click on the drive.
If using a DVD then the process should start but if using an USB that will open the files where you can either double click on setup Application or right click on it and select Run as administrator.
-
Howdy Bloggin,
OK, I will do this, but I am very afraid of doing this procedure; it feels to me like some sort of open heart surgery where the patient has to die and be brought back to life.
This feeling , I guess is based on several issues. About two years ago on this machine (I call 140) I suddenly began getting messages that it was not genuine even though it had been working fine for years. I called Softie and it took them a call that lasted a very long time (and maybe there was a second call that same day) and finally they gave me a code to enter (they gave me about 6 and the last one worked) which made it genuine again.
Then, about 9 months ago my 135 (again W7 Ult 64b - a Dell also but less powerful) machine became not genuine after working fine for years. Since this machine was in limbo, I decided to call Sofite on that. I was on the phone for over an hour and he logged on and tried about 10 codes to no avail. Then after a reboot, we lost connection.
And, now that Softie regards W7 as a a geezer about to die, I fear for support. This last guy sounded like he was about 7 years old.
These experiences weigh on my mind. I remember in the install with the Dell guy on 140, there was trouble reading the original disc and he had to boot with some kind of copy that he made; then, continue with the original disc. It was a nightmare to me. I thought he would be living here; it took two days. But, he impressed me that he really knew his stuff, and finally, the machine worked fine.
So, Bloggin, I will begin looking for the discs as I still have not unpacked from my move a few months ago. Since I feel this might take a while, do you suppose I could use the machine for work this week --- just not do any updates. It seems to be working OK right now. Then, next weekend begin Saturday AM and go through the operation you outlines for me. And, BTW, thanks again to you and Satnow for all your help!
Incidentally, when this is all done, does the Tweaking forum provide for any way to print a log of all posts to this incident as I feel I would like to have access to all the good suggestion made in the future?
Thanks, again.
-
You don't need to dig out any old install disks unless you require it for the product key, although there are a couple of programs that will display that key for you but if MS have overridden your original key, then that may no longer work to free up the ISO download which will include SP1.
The free version of Speccy is one such program http://www.majorgeeks.com/files/details/speccy.html
When it has installed click on Operating System where it will have your product key at the top.
Try this key on that website to see if it will accept it as genuine to release the download.
If you ever get the not genuine message again, there is a series of commands that will rebuild the licence store which is a known fix for that error message.
Go Start - type cmd then right click on cmd and select Run as administrator - accept the UAC and enter these cmds -
net stop sppsvc
(wait until the service has stopped before entering the following lines)
CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
REN tokens.dat tokens.bar
net start sppsvc
slui.exe
After a couple of seconds the Windows Activation dialog will appear.
You may be asked to re-activate and/or re-enter your product key, or Activation may occur automatically.
Then reboot.
You can copy & paste that long one to the cmd prompt.
-
OK. Good. Thanks. I will do what you said.
But, just thinking about my work situation. Could I put doing this off until next weekend and just use my computer the way it is for a week as long as I do not do any updates?
BTW, what is the "portable" version of things; I see this a lot and do not understand what they mean.
Thanks, again, Bloggin.
-
That's not a problem if your computer is working okay.
Portable is when you install a portable version onto something like a Flash drive.
Before you perform the repair install, create an image onto external media and run Windows Repair in Safe Mode and then see if a sfc /scannow still reports it cannot repair that MSDTC Log, as that could have been the result of those infections.
It's probably prudent to create a system image now before you eventually go ahead with those updates and then you'll have something to fall back on.
-
OK, Bloggin.
I have downloaded the ISO twice onto two separate drives and will make a DVD today.
And, also, I will make a AOMEI Backeruppper image today.
Next weekend, I will perform the restore steps you outlined and report back here when done.
I would like to save this case with all the postings; does the Tweaking Forum provide for that?
Thanks again, Bloggin and Satnow for all your help. God Bless your both.
-
You could save one of your email notifications so when you click on that, it will bring you straight to your thread.
The thread auto becomes locked after 30 days of the last reply, but if you want to add to it after that, just PM me and I'll unlock it.
-
OK STATUS IS: I have created a bootable W7 DVD disc from the Speccry program. Thanks. Feeling very good so far. Will report more shortly.
-
Hi - I have come to a quandary:
I know I have to do the repair install based on what you said:
"Before you perform the repair install, create an image onto external media and run Windows Repair in Safe Mode and then see if a sfc /scannow still reports it cannot repair that MSDTC Log, as that could have been the result of those infections.
It's probably prudent to create a system image now before you eventually go ahead with those updates and then you'll have something to fall back on."
But, I installed a new AOMEI Backerupper but it gets a 4xxx error that I sent to them. They said, uninstall reboot install and reboot, which I am in the process of doing. But, after that I am not sure how to perform the repair install. I looked back at the log and can not find that.
So, after i do the image backup, exactly what do I do with the system disc to get system back to normal so I can put on those updates?
How do I do that? Thanks in advance.
-
If you can't get AOMEI to work then you can use Windows own Create a system image.
When you have created a system image/backup and run Windows Repair in Safe Mode with Networking, run another sfc /scannow to see if it still reports it is unable to repair that file.
If that is the case then you will need to proceed with the repair install.
Prior to doing a repair install it is advised that you back up your drivers folders onto something like an USB stick.
They can be found at C:\Windows\System32 and there are three of them and then you can drag and drop them back in after the install should they be needed.
To perform the repair install, go Start - Computer - insert the install disk and double click on the drive which should start the process - you may have a small amount of user input such as agreeing to the EULA but once it starts, it will just get on with it.
You'll then be looking at the Windows Updates wanting to download and install or you may have to do a manual check for updates, but I'd change the update settings to Let me choose... and then you can vet them before they download.
One update I think you look for is KB2952664 - this is a Telemetry update which sends data back to MS and is a spy, but it's up to you.
I know a few including myself that hide this update when it is offered.
-
Thanks, Boggin, for your help. OK Backerupper has been running for about 10 hours and is at about the 25% mark. That error happened within a hour last time, so I think we are clear of that. the reboot and reinstall did it.
I will wait and watch and keep you informed of my next steps.
BTW, how is windows create image called. I never knew there was one.
Thanks again for your help.
-
It's all I use, but go Start - Control Panel - System and Security/Back up your computer and you will see the option in the left pane where you can also create a System Repair disk.
Before you go for the repair install, see if an offboot sfc /scannow will repair that file.
You may need to change the boot order to boot up with the install disk so tap F12 as you switch on, use the cursor keys to select the DVD drive, insert the disk and press enter.
You may be presented with an inverse window with Windows Setup [EMS Enabled] highlighted - just press enter.
Use the dropdowns to change/confirm Language and Time and Currency format - Next - then on the Install screen click on Repair your computer bottom left then select Command Prompt.
At the prompt enter bcdedit |find "osdevice"
You need to enter this cmd as Windows doesn't always see the volume as being in C:
That is a Pipe symbol before find and is the uppercase of \ then use the partition letter that gives you instead of the X I have used and enter this cmd -
sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows
Note there is a space before each /
You won't see the % progress as you would when running a normal sfc /scannow but it will report the same as a normal one would on completion.
If that says it can't repair all files as well then you will need to perform the repair install.
If it says it has repaired files then enter exit in either case to close the cmd window, remove the install disk and restart and then run another sfc /scannow to see what it reports.
-
Thanks, Bloggin, but MS has trouble with going to my NAS. I tried a stand alone USB but system not seeing the stand alone. Got some advice from AOMEI about deleting some XML files so I will try AOMEI again. Back later. Thanks again.
-
What is the USB for that you tried ?
-
Howdy Bloggin,
Thanks for your continued interest. I have lost track of it, but it was from the MS site. I tried to look for it but could not find it again. However, I tried AEOMI BU again and it froze whole system after 9 hours at 17% on Friday. Then again on Saturday --- same thing same 17%.
I do not understand as I have used AOMEI successfully on this machine many times in the past. Las week I wrote them about the 4xxx message I received twice after reinstall and reboot and they gave me a link to use which uninsulated and re-installed BU.
One thing about them is very weird. I have two paid licenses for two computers using A BU but there is NO place to enter the license codes; and, I looked and looked for somewhere to do that. I asked Megan at A whey that is or where to enter the code so I am actually using the pro version, but, somehow, she just does understand the questions (which I clearly asked in several emails).
So, I do not know what to do except this is what I will try after i get back from church today: Run who crashed and zip the A BU logs up. Would you like to see them or anything else? Thanks, again, for your help and concern.
-
I was asking what was on the USB.
Let's see if AOMEI will work in a clean boot.
Go Start - type msconfig and press enter then under the Startup tab click on Disable all - Apply - OK - Restart and try it again.
If it still hangs then go back into msconfig and under the Services tab check the box for Hide all Microsoft services then click on Disable all - Apply - OK - Restart - but you must first check the box to hide all MS services.
Event Viewer may have recorded something about the AOMEI freeze - it could relate to Drive J:
-
Howdy Bloggin,
Sorry about the confusion about the USB. What I mean to say was that the link I got:
https://wudt.codeplex.com/SourceControl/latest did not work.
Secondly, I tried to substitute a 2 TB USB drive and use the MS backup, but the USB connect did not work and I lost track of things that I tried to fix it.
But, LOL, AOMEI is still going after 30 hours using what you said disabling all but MS services. I noticed my machine so much fast --- I may keep it this way for a while after backup is done. :)
And now, only 8 hours to go. Then I will try the next step you suggested which I forgot but will go back in the log and lookup. Thanks, again, for your help Bloggin. :)
-
You need to check if your computer will boot from an USB.
You can either check in the BIOS/Boot or tap F12 as you switch on to see if it gives an USB option.
Not having used AOMEI I don't know how long a back up would take, but you have a number of drives to back up which can determine how long it would take.
BTW - It's Boggin - not Bloggin :)
I'm not getting any email notifications of replies so I may be a bit late in replying, notwithstanding time differences.
-
Sorry Boggin. 9:24 EST here and backup finished - Now it is 54% through verification. BTW, what do you use for system backup. I tried them all (Acronis, Paragon, etc) and (until now) AOMEI Backerupper is the best. Will keep you posted.
The next step I remember is to boot from the disc you helped me recreate and run the scan now from that while on the c:\ prompt. Correct?
-
When you select Repair your computer on the Install screen, that will take you to the Recovery Environment (RE) where you select Command Prompt and that displays as a x: prompt.
Enter bcdedit |find "0sdevice" to see which partition letter it sees the volume in and use that letter in the sfc /scannow command as I've posted earlier.
As I've said before, I use Windows own Create a system image.
However, after the Oct. update that Win 10 will be getting, that will no longer be an option as MS are removing it in Win 10 and I'll have to look for something else to create my images.
-
Hi Boggin
Backup / imaging software
I'm a long term user and great advocate of Casper, now in version 10, from Future Systems Solutions -
https://www.fssdev.com/products/casper/. It's not free, but I've found it totally reliable and the support is first rate.
-
Hi Boggin,
Overnight it finished completion and now I have a full image backup; I will proceed with the repair on the weekend as I need my computer during the day for work. Will keep you informed.
Still_Game: I will take a look at Casper doe to the recent challenges with AOMEI which has been reliable up to now --- but it so SLOW. Weird part of AOMEI is that I purchased two licenses but there is no place to enter the license key and they have not answered several inquiries on that; this give me worries about continuing using AOMEI . Thanks.
-
Weird part of AOMEI is that I purchased two licenses but there is no place to enter the license key and they have not answered several inquiries on that...
Aomei software usually differentiates between the Demo/Pro etc. versions on the Help > About screen.
-
Hi Boggin
Backup / imaging software
I'm a long term user and great advocate of Casper, now in version 10, from Future Systems Solutions -
https://www.fssdev.com/products/casper/. It's not free, but I've found it totally reliable and the support is first rate.
Thanks, but I'd be looking for a free program to replace Windows System Image when the time comes - I have Macrium Reflect in mind but I'll need to get some more info on it as I've seen restore problems reported for it.
-
satrow - Yes, AOMEI says Pro in the about, but I have not put in any license info. I looked at every place in the menu settings, etc. there is no place to put license info. Just weird.
-
If it says Pro not (Demo), it should already be licensed so there's no need for somewhere to input your licence info.
-
Boggin - I am trying all the fixes today. BTW, if you find a system backup that you really like and costs money, tell me and I will buy you a license. With stuff like that, I like to know there is someone I can call for hlep and I can get updates. well, that is my way of working. Anyway, let me know and I will purchase it for you.
-
Thank you but I can afford it myself - it's just that I'm averse to buying something when I can get a free version that does the same.
There is the exception with Windows Repair, but generally I'm a tight git :D
I think that when the time comes I'll probably opt for Macrium Reflect and if I'm in a generous mood and I like it, I may just splash out and get the pro version :)
-
Howdy Boggin. Well I did what you said booted up from CD, found system on E: drive and three runs of scannow with the offboot and windows parameters gave: "There are errors but could not fix them."
So, Now I have to repair using the cd. I am confused about how to do that.
-
I'll go through it again.
Boot up the machine, go Start - click on Computer and insert the disk.
Double click on the DVD drive when you see it has come up and that should start the process.
There will be some user input such as accepting the end user licence agreement (EULA) but it will just get on with it.
At some point you will be prompted to enter your product key to activate it.
While this won't affect your personal stuff or installed programs, it will produce a Windows.old folder which will be of a few GBs in size.
You will need to reinstall all of Windows updates but you can let it do this over night, provided you change your update settings to Let me choose so that you can control when you want them to download.
When you are sure everything is as it should be, go Start - type disk cleanup - right click on Disk Cleanup and select Run as administrator
When it has completed, scroll through the box to check the box for Windows.old and that will get rid of that and then you can do a defrag when that is done.
-
Sorry, Boggin. I confused you by not being complete. Originally, I did not know to run this from the existing windows, but I did some reading and figured that out. I already did all you said and it kept saying things like can not continue as some updates needed and you must run again: "The following issues are preventing Windows from upgrading. Cancel the upgrade, complete each task, and then restart the upgrade to continue. Windows needs to be restarted so necessary changes to system files can be made before continuing."
Finally, I just ran it again, and again, I got more or less the same messages. I figured that may the third time is the charm and still got the same messages. (BTW each run takes about a half hour.)
I am tempted at the beginning to not take the fork that says get latest updates. But, with that fork there is warning about being vulnerable to virus, etc. But, then I figured that I did something way wrong and stopped before taking that fork. I saved the screens if you want to look at them.
-
Yes, can you post those.
-
It's been a while since I unsuccessfully tried a repair install on my Win 7 laptop, but looking for updates is a normal part of the process now that I've been reminded by this article which will walk you through.
http://www.pcgamer.com/how-to-repair-a-faulty-windows-installation-without-reformatting/
-
bOGGIN, HERE ARE THE MESSAGES IN ORDER INSTALL 0 1A 1B AND 2 sAME MESSAGES EACH TIME. DID THIS 4 TIMES NOT THREE. should I tkae the formk that says no updates which migh get a good system working and then apply the security updates?
-
Boggin, I am looking at the link. Yes I did method 1 just the way it was laid out. Maybe i should do the sfc scannow several times. Maybe each time it fixes a little. How many time do you think would be the limit to try that? 3, 6, 9? It seems like the cleaner and less dangerous way to fix W7.
-
So, I am proceeding to keep running the scf scannow.
2 Boservations:
1 - When I first ran it earlier in the day I saw many corrupt files which looked ancient. Then, I renumbered the dunsil drive that was left in the machine when the Dell guy left years ago. So, I decided to just go in and disconnect it as maybe the SCF was looking at it to find those corrupt files. I did so and the first Scf that I ran after that there were no longer any more corrupt file messages.
So, that seems to be good, but the first scf run after that sill found errors that could not be corrected. I am going to keep running it for up to x times. hehe
But, that is not all. After removing the dunsil J drive, there was only 1 drive left. So, somehow, the 2nd Dell guy that came go confused and took out my second RAID drive instead of the dunsil J drive. He was younger than the first guy as the first guy got tied up with something on the NYSE downtown. So, all these years I thought I was RAID protect but I was not. LOL
But, I will fix this once, I have a fixed system by writing a AOMEI backup and reinitializing two RAID drives then restoring. Until recently I have not had any problem with AOMEI --- better than Paragon and Acronis which I paid for but were not supported.
Boggin, you mentioned Marcum Reflex; I remember trying that like 5+ years ago and I could not get a full restore like AOMEI gave me. Maybe different now. Dunno.
2- The first time I ran the SCF while the J drive was there, the Windows drive was E. After removing the J dunsil the Windows drive was D.
But when the scf finished it said the CBS log file was on C:
Should I try scf using the C drive and the off and dir?
-
No.
When you boot up with an install disk you are loading into memory and not Windows, so it doesn't always see the volume as in C: which is why you have to execute that bcdedit |find "osdevice" cmd.
I'm confused as to what HDDs are in use.
If a sfc /scannow still reports that it cannot repair all files in a normal boot, can you remove all but the HDD that has Windows installed on, boot up with the install disk and then run those cmds ?
If that reports the same then follow the steps in that last article to perform a repair install.
-
Yes, only 1 drive now. Still sfc errors. Does running it more help at all? It seems to me that each sfc gets finished sooner and sooner. But, you think i should stop sfc-ing and just do the (possible) nasty reinstall?
-
Yes - I would have gone for the repair install when the offboot sfc /scannow first reported the same.
-
Howdy Boggin and satnow - I did not forget - still working on this - but no electric during Irma stopped everything - now have a CPU fan down so waiting for Dell to come and replace fan. Will keep you posted. Thanks for your help.
-
Hope you weren't hit too badly with Irma.
So have you nailed this down to an overheating problem or is this something else that has gone awry ?
-
Howdy Boggin - No heating problem before. I knew this thanks to Speccy, and a big thanks to you for showing me Speccy. I would like to send someone some money for Speccy as this is a SUPPER PROGRAM! wILL KEEP YOU POSTED ONCE i RESUME MY RESTORE ADVENTURE. tHANKS AGAIN FOR ALL YOUR AND SATNOW'S HELP.
-
Okay.
-
Boggin satnow - Further delay due to power outage and a hardware problem unrelated to the OS. Service guy broke the video card while taking it out. Will keep you posted. Sorry.
-
Hope he's going to replace it FOC.
-
Yes, and maybe motherboard also. Coming on site Tuesday or Wednesday. What is FOC?
-
FOC= Free of Charge.
With a new motherboard you will probably have to contact MS to have them activate your product key as it will be tied to the old motherboard, but they are quite understanding when hardware needs to be replaced, so that should be straight forward.
-
Thanks, Boggin. Did not know this.
-
If the Dell tech is going to change your motherboard on a home visit then he should help you with this.
I assume you will be restoring with a system image rather than leaving it as a clean install and reinstalling your personal stuff and programs after ?
-
Howdy Boggin,
Thanks for your concern. I had Dell service for years in the past, but this service is with Aventis Systems out of Atlanta Ga. Sorry if I confused you about that.
Well, the system has not yet come back. I spoke with them on Friday (13th) and they said that motherboad has all the correct voltages and is OK. They still have not gotten the 2 AMD W7000 display cards to work together. When the machine left, one worked fine. I am hoping to hear from them today or tomorrow that they replaced the bad W7000. I will keep you informed.
-
Perhaps you should have stayed with Dell.
Is this the first time you have used Aventis ?
-
Yes, first time with Aventis. Unfortunately, I thought I renewed the Dell but I renewed another Dell machine so the service on the T7500 lapsed and they would not renew it when I realized this in checking with them when I was moving from NY to FL. So, I choose Aventis based on approval / authiorization by Dell. They seem to be OK except for sending the machine back to the wrong address and not anchoring the video card (LOL). I am keeping toes crossed on this here.
-
Well if they don't make a good job of it then post your displeasure on Facebook or Twitter - they just love bad publicity :)
-
OK, Boggin. machine is back. It has a brand new ADM W7000 graphics card, but only 7 of 8 monitors work. Using same cables/monitors --- it is not them as I switched them to make sure. Somehow the Active Adapter for these AMD cards is not tuned to the adapters I purchased years ago (according to AMD tech guy). So, i am askomg Aventis to get me current adapters. I understand that each card is supposed to come with 2 of these. I will wait to fix this. More to come.
-
It looks like you may eventually get there :)
-
A software that I use for work was updated and it depends on .NET aos after install there was a message to check that windows has all the latest .NET update.
I am not going to do any updates until I fix the OS but I just ran windows update to see what was there. It seems that those 4 updates that were a problem are no on the search list. I have attached an image.
I wonder why they are gone?
-
It's possible they've been withdrawn or superseded.
-
Howdy - So I imagine my system is still in some kind of jeopardy, but I do not know exactly what kind. How do I check?
-
Run a chkdsk /f followed by sfc /scannow and see what each report.
To view the chkdsk log, go Start - type eventvwr and press enter.
When Event Viewer opens ensure Event Viewer (Local) is highlighted in the left pane - if it isn't then just click on it.
When it has read the data expand Windows Log - click on Application/Action/Find then type chkdsk or wininit into the Find box and press enter.
Cancel the Find box and read the log in the scrollable window.
I've already described this but if the sfc /scannow reports it cannot repair some files as it did before, then copy & paste this cmd to the cmd prompt and press enter.
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt
This will put an icon onto the desktop which when double clicked will open the CBS log in Notepad which you can then copy & paste into the reply box.
This is why it was suggested that you perform a repair install but if your machine works okay even with irreparable files then do the repair install at your discretion.
Sometimes you can ignore a report of an irreparable file as it can be the result of a Windows Update.
-
Reinstalling AOMEI will probably be a good idea but in Programs and Features, when you right click on it do you get a Repair option ?
I don't know why it is snagging that Netgear if that is your wireless dongle.
Can you go to Device Manager/View/Show hidden devices and check for any yellow alerts - you may need to expand Network adapters and Non-Plug and Play Drivers.
I don't know if you can get a driver update for the dongle, but if you aren't getting any connectivity problems then I'd ignore that error.
BTW - Is AOMEI a paid for or free program ?
Hi B,
I learned that I needed assistance uninstalling programs; that helped a lot of previous errors;
I would suggest that you ask people to download a "total uninstaller" program to uninstall programs they want to re-install. this will help problems in the areas of uninstalling what people also simply want to uninstall.
-
hehe lol - Aventis went from not wanting to send me the active adapters to having someone come day and install a new motherboard. Long story, but in short AMD said it was the motherboard that was damaged by the W7000 card that got loose during shipment as it was not put in properly. I thinks someone lost theri job. But, the Technical Manager, Robert Martin, stood up for me and resolved the adapter issue and is getting a man down here Tuesday to install the new MB. So, we shall see.
-
Sounds like a decent bit of Customer Service - hope all goes well.
-
Howdy,
Well, Aventis came through. New motherboard and on-site service, but still have not been able to get the AMD W7000 monitors working correctly. Followed AMD instructions for a whole week and yet not they want me to install again with one W7000 connected and connect monitors 1 at a time. then add the other W7000 with monitors one at a time.
I tell you AMD has got their head up their behind with these two W7000 which perform well once connected. I had similar problems when I first bought them except 5 years ago their phone help was non-existent and when I did get connected they knew nothing and could not help (this went on for 9 months).
I will keep you posted. I really want to clean up this OS.
-
Could it be a compatibility problem with the graphics cards ?
-
Boggin, I really do not know. I had Nvida and other AMD cards on this machine when I first got it, but they were slow. Each of these cards has 4 GB of memory for the two cards driving 8 monitors. For about 4 years now, I have used them and they worked pretty darned well. T7500 and W7 64b supposed to work all together with the W7000 cards --- and they have before this.
-
I don't know if we've covered this but have you checked the cables - say from the monitor that does work with the one that doesn't ?
-
Thanks, Boggin. Yes, that was the first order of elimination. At one point we checked each monitor with each cable --- 64 ++ connects and disconnects. A nightmare due to some monitors needed extensions.
-
Can the monitors be reset - or has that also been tried already - it's such a long thread :(
-
Thanks, but I do not know what you mean by "reset". What is that?
-
There should be something in the menu to reset the monitor to default settings.
This is for a Dell PC monitor as an example - http://en.community.dell.com/support-forums/peripherals/w/monitors/4487.monitor-factory-reset-self-test-bid-built-in-diagnostic
With it being a new motherboard then perhaps you need to treat things as out of the box ?
-
Happy New Year, Boggin!
Still only 7 of 8 monitors going. Tried everything AMD gave me. Now on with a third suport person, a supervisor, named Moe. So we will see. I just am worried about the final 'fix' to Win 7 until monitors are OK. Thanks again for all your (and others) help so far.
-
Happy New Year to you Freecat :)
Are you still having problems with your Win 7 system other than the monitors ?
-
Well, so far so good except that I have that problem that I can not (am afaraid to) perfrom any Win 7 updates due to having system unworkable after last one which you helped me undo.
I have scheduled (in my brain) that rebuild of the system that you showed me once I solve this monitor problem.
-
It's quite possible that one could have been withdrawn and superseded, but if you want to give the updates another try, create a System Repair disk to boot up with and create a full system image onto an external HDD.
-
Thanks, Boggin. I will do that as soon as I fix the monitor challenge.
-
See you next year then :D
-
:cheesy:
-
Happy New Year!
Well, it is next year, Boggin.
AMD still wants to try the same stuff as before that did not work. BIOS, etc.
And, now they want to apply the windows updates --- critical they say.
But, I told them updates were OK before this new card so send me a new card and stop wasting my time.
We will see what they say.
-
It looks like they broke their New Year resolution to be kind to their customers :D
-
Hi Boggin,
AMD is a bad out of control company that does not care about customers. Yet, I just bought another new W7000 in the hopes that I can have my 8 monitors back; the only thing that allowed this was a good price of a company clearing inventory. Gee, I wonder!
It should get here soon, and I will keep you updated.
-
Does your machine also use an AMD CPU ?
-
Not AMD. My machine has dual Intel Xeon X5570 Gamestown at 2.93 GH - 4 cores 4 threads each.
-
Are you aware of the recently publicised threats of Meltdown and Spectre and MS update KB4056894 to counter them in Win 7 ?
This may not be an immediate threat, so the newer update is optional.
https://www.computerworld.com/article/3246286/microsoft-windows/buggy-win7-meltdown-patch-kb-4056894-throwing-blue-screens.html
Intel are vulnerable to Meltdown and Intel are supposed to be working on a firmware/BIOS update to counter this.
https://www.techarp.com/guides/complete-meltdown-spectre-cpu-list/
Third party antivirus programs should have modified this key for the update to be compatible., but can be manually checked.
https://support.microsoft.com/en-gb/help/4072699/january-3-2018-windows-security-updates-and-antivirus-software
-
Thanks, much, Boggin. I am following up with Del now.
-
VIDEO FIXED! Will be trying to fix OS this week.
Boggin, I found this free today.
Looks very good and free today:
https://sharewareonsale.com/checkout/order-received/10427855?key=wc_order_5a87f86b30959
Seems better than AOMEI.
-
I use Windows own create a system image on my Win 7 laptop but use Macrium Reflect Free on my two Win 10 laptops.
That is because MS are deprecating the Win 7 system image that can be used on Win 10.
Macrium doesn't overwrite the previous image and you can use it for differential back ups of files, although I just use it for system images.
Is that a lifetime free licence on that program or just for 12 months ?
As a recap, what problems are you still experiencing with your OS now that you've got your graphics sorted ?
-
Howdy Boggin,
I spoke too soon. I was impressed with the German precision, etc. They responded for support pretty well, but it ran for 2 days and had another 3 days to go for my 2 TB C drive with no compression, etc. That long is too long for backup, IMO.
So, I am back to AOMEI Backupper, but still get the 4098 error with no real explanation from AOMEI. So, I am at a loss to proceed without making another full back as the one I made when i first started is to old. I will look at Marcum again. I will keep you posted.
-
OK, wow, this does not stop for me. I've had this computer for about 4 years and it was fine. No problems. Fast. Neat!
But, that was last year and now still challenges which began when machine was shipped in to Aventis for servicing. I won't repeat all the nutty-gritty details from that moment to now.
But, now that I have brand new MB, brand new video card and 8 monitors working again.
So , I am back to making a backup and either applying those Win 7 updates or doing whatever you suggest to repair the corruption that we found last year.
I figured that the next step was to run an AOMEI image backup for safety. But, in the process of doing so and using the machine I got the 4098 error on AOMEI --- twice --- which they have no support for orther than: "Try the AOMEI PE build." I ran the PE build but did not understand what happened. I also tried the CLONE option; this option write "most" of the Win 7 system onto the D drive, but had another error. I gave up on AOMEI even though I paid for it twice.
But, then, I noticed that the mouse delay got longer with a ten second delay at times. Maddening.
Also, Windows explorer seemed to take a very long time even for simple items. Definitely Windows explorer was not acting properly.
I was tempted to run Tweaking, but had Kerish doctor running so I asked it for a report on service optimization. Attached.
I was not sure what KD was saying so I ran Tweaking.
But, Tweaking confused me. I set it up for safe mode reboot (after downloading the latest). I got to the chkdsk part and it ran Chkdsk /R.
I went to bed and when I got up in the middle of the night, I checked it several times; last time I looked it was a t stage 4 of 5 and seems to be OK with no errors reported.
When I got up in the morning, normal Windows rebooted and I was unsure what to do. I had thought that Tweaking would restart in safe mode after the Chkdsk /R was complete,
But, anyway, I started up Tweaking again and figured all would be good. I am pretty sure I began with Registry Backup first, but somehow the Permissions Backup was running for several (3+) hours; and it was --- it seemed to me slow --- screen print is attached. At this rate I would be here another several hours, maybe all day. So, I killed it figuring something was wrong connected with the original basic Windows 7 problem.
In using the mouse, and starting apps, it seemed that mouse and explorer problems disappeared. I have no idea why. Was it Keresh or Tweaking or what?
So, the next step was backup. I figured it the Windows image backup is good enough for you, I would try it. But, it would not recognize my D drive so matter what I did. The D drive is there and I can see it and write on it, etc. but Wind image backup would not see it.
So, I got the free Macrium and tried to install that and system apps are working in the backgroup but system is frozen for any other work except I can move open windows around. Tried to cancel Macrium with task manager but frozen now for about 3 hours.
I finally pulled the plug. Restarted Windows and the machine seems to be OK with no mouse problems, explorer problems, etc. Another things was was prolly fixed earlier also: Shortcuts on the START list came back. They have been missing for days.
You might be interested in windows updates. I did not do any intentionally. Attached is updates pending and failed update graphics. FWIW.
So, Boggin, that is my story. I am at a loss as to what to do next.
-
The Permissions Backup is a Pro optional feature, but prior to running the repairs, it will auto create a registry back up so I'm not sure the Permissions back up is necessary - I've never done it.
You could just go straight for the repairs.
I assume D: drive is the USB drive that you have your external HDD plugged into - my D: drive is for my CD/DVD drive and my ext. HDD usually get E: or F:
With Macrium you need to plug the ext. HDD in first before you open the program.
With your ext. drive plugged in can you go Start - type diskmgmt.msc and press enter to see if it recognised in Disk Management and has a drive letter assigned to it.
Just to confirm that your internal HDD is okay, can you go Start - type eventvwr and press enter.
When Event Viewer opens, ensure Event Viewer (Local) is highlighted in the left pane - if it isn't then just click on it.
When it has read the data, expand Windows Logs - click on Application then on Action/Find and type chkdsk or wininit into the Find box and press enter.
Cancel the Find box and read the chkdsk log in the scrollable pane below and check that it hasn't reported any KBs in bad sectors.
Can you run the Windows Troubleshooter and then try the updates again.
I'm surprised it gave you an update for the July 2017 MSRT as well as the older Win 7 Roll up.
If the updates still fail then download the System Update Readiness Tool (SURT)
https://www.microsoft.com/en-gb/download/details.aspx?id=20858
This is a 533MB download and can take a while to run but when it's done, its log can be found in Windows C:\Windows\Logs\CBS then double click on the Checksur one which will open in Notepad.
If it reports any corruption, can you copy & paste it into your reply.
You can also run a sfc /scannow to see if that reports anything amiss.
-
OK. Progress!
Attached it the CHKDSK log (had no idea how to get that - thanks) and there were no errors. Good.
Re backup: I know I had a D drive as I used Disik Management to format it and assign the letter D.
But, when i went to DM again, letter was gone. Dunno if AOMEI or Windows Backup took the drive letter out, in in windows explorer it was still D but in DM it had no letter. So, I used DM to give it the letter H and started the Windows Backup again and it is now running. Moray and Thank You very much!
When if completes, I will attempt the update again and let you know.
Boggin, you are so nice helping me. I really, really appreciate your help. God bless you for it. (... although we know that is not why you help.)
-
That's good news and thanks for the update.
-
LOL Boggin. Woe is me. Well nothing was written and there was an error (scrn 3 shows error message). BTW, I forgot to mention that my backup drive (now H) is a 2 TB internal empty drive (simple format).
Some little tiny, tiny amount of the drive was written on, I think. I was asked to check the event log for SPP and Vss entries, but could find one that were recent. Maybe I am looking in the wrong spot.
Weirdly, the display of the internal drive that was once D and is now H still shows as D and it shows with some kind of data on it 65.8 MB free of 99.9 MB --- a system reserved area? Scrn 5 next post as I could not figure how to add it to this one.
Over to you Boggin.
-
Scrn 5 attached
-
I've always used an external HDD for my system images so I'm not sure how you would recover the image from an internal separate HDD.
I don't know what those other drives are but go into Disk Management to see if that reserved partition is listed.
In Win 7 that would normally be 400MB and gives you access to the advanced boot options - are you able to get to those when you tap F8 (usually) as you switch on ?
Go into Event Viewer and when it has read the data, click on Error then on View All Instances of This Event in the lower right pane where you should see the immediate errors.
Clicking on any will give more info the pane below.
-
OK, my plan is to just have the system image for now. I understand that on a drive C crash ---- after replacing drive C ---- I could use the stand alone boot MS mentions to recover the systen,
Yes, there is a system reserved area on that D drive so prolly best to wipe the whole drive and start again. AOMEI or MS or someone could not do the backup but they were able to put the systems reserved area on the drive.
BUT, I got hung up twice where nothing would work --- not even going to task manager. So, I went to Safe mode --- BTW weird as it is using the high res graphics card which I never saw used by Safe Mode previously --- and am doing a common repair. Based on what you said, I only did the Registry backup and then began the common repair list.
So, far going slow but plunking along. 2 hours. I took a picture, attached.
-
Windows would normally put that reserved partition in during a clean install.
It's certainly taking its time compared to what it takes on mine, but as long as it's working, then you just have to patient.
I've never known safe mode to use the GPU either - perhaps a wipe and clean install may be better.
-
OK, Boggin, I will exercise patience. But, what is a wipe and clean install? Of what?
-
A wipe is a format of the HDD followed by a clean install - I assume you have install media and a valid retail key ?
You would of course need to back up your personal stuff and make a note of any product keys for any paid for programs.
I can't remember if your computer is custom or an OEM branded build.
With the latter then a factory reset would take it back to out of the box where the same would apply for your personal stuff and product keys.
-
OK, notes, but that is the last thing I would want to do.
Way too many installs and may to be able to find all the keys.
I do have the DELL OEM Windows 7 64 bit install disc and the key for that.
Anyway, it has been close to over 5 hours since Tweaking began and looks to be only half finished. there are messages that it failed several times. See attached image and Tweaking log is also attached.
Can you tell what is causing this to fail? Should I use a different repair list other than "common"?
Or, should I try the sfc /scannow ? What parameters to use if i put the original disc in the DVD drive?
-
That repair seems to be for the sidebar and gadgets.
You could stop the program and run it again with Repair 19 unchecked but you could perform an offboot sfc /scannow after booting up with the install disk.
The install disk would need to be the Pro version and include SP1 which yours may not include.
There are a couple listed for Win 7 x64 Pro SP1 on this web site - http://windowsiso.net/windows-7-iso/windows-7-download/professional-iso-7/
Select Save on the download then install Windows USB/DVD Burner Tool to create the install disk.
https://www.microsoft.com/en-us/download/details.aspx?id=56485
You may need to change the boot order in the BIOS or by tapping F12 as you switch on for the one off boot order change.
Press any key when prompted to boot from CD/DVD and you may be presented with an inverse window with Windows Setup (EMS Enabled) highlighted - just press enter then navigate to the Install screen and click on Repair your computer and select Command Prompt.
Enter bcdedit |find "osdevice" and using that partition letter instead of the X I have exampled, enter -
sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows
For clarity that is a Pipe symbol before find and is the uppercase of \ and note there is a space before each /
When it's done, it will report as for the same when you do a normal sfc /scannow.
Enter exit to close the cmd window, remove the install disk and select Restart.
EDIT - Things seemed to have changed on that website, so if you can't download the iso I can burn you a couple of Win 7 x64 Pro SP1 disks and send them to you - just PM me your address if this is required.
I suppose in the mean time you could perform a sfc /scannow from within Windows to see what it reports - no parameter is required.
-
Thanks, Boggin. I do have the install disc with SP1, so no need to burn me one.
I will stop Tweaking and do the SFC. Will keep you posted.
Thanks again for your help.
-
Hi Boggin,
I set MSVONFIG to just load basic but there is all kinds of crap running.
How do I set system up so these processes and services do not run?
See attached.
Still in safe mode the system feels so much cleaner and faster. Mouse and explorer response is much better. I want to make it even with less stuff loaded all the time. How to do that?
Thanks.
-
Go into msconfig and under the Startup tab click on Disable all - Apply - OK - Restart then see how it runs.
The only program I have enabled in there is for my Realtek HD Audio Manager.
Under the Services tab you can probably uncheck any updaters, but check the box to Hide all Microsoft services and that will give you a clearer view of what non-MS services are running.
StartUpLite is a program that can help you to decide if you have any unnecessary programs in your start up menu, but generally you don't need any as they will start when you want them without them running in the background and taking up memory.
https://www.malwarebytes.com/startuplite/
If you have the free version of MBAM installed, then go Start - type services.msc and press enter
Scroll down to the MBAM service, right click on it - select Properties and use the dropdown to change its status to Manual then click on Stop - Apply - OK - File/Exit then reboot to effect.
If you run a scan with it, it will remain started until you reboot although I don't think it will be heavy on resources - it's just one thing less that will take up memory when using the computer normally.
-
Well, I killed some services and got a nicer, faster, cleaner system.
Also found the reason for freezing up: My browser (Opera which I have been using for 10 years - greatest browser -- no problems) is stuck on some site which takes control of my machine. Only by killing in TM was I able to get machine back. Previously I could not get to TM. Dunno why I got to it this time as when the lockout occurs and this site takes control, almost nothing is possible. I will just use another browser for now till I figure out a way around that.
But, although I selected diagnostic boot only STARTUPSTAR, BOOSTSPEED and ANVIR still wound up as active processes.
I do not understand why. Any idea?
But, that is (sort of) minor as the MS back still does not recognize any drives. I deleted the D and H and reinstated it as one H drive and yet it fails to recognize even though it is visitable in Disk Management and Explorer.
An image with status of things is attached. I started the VDS and VSS (?) by hand. Still no backup possible.
I think the backup is necessary for me to proceed with MS W7 update to avoid the BSOD.
-
STARTUPSTAR and BOOSTSPEED are programs you have installed which have become part of your system's start up and ANVIR has taken over from your normal Task Manager which now is also part of your system.
I don't know why you have installed VisiBroker but the VssProvider while showing as Started has a status of Disabled which should be changed to Manual, although I don't have that service in my Win 7.
When you go to Create a system image, click on Select another backup to restore files from and if your other internal HDD isn't listed, see if Refresh will pick it up.
As I've said, I've never used a separate internal HDD to back up to as I use laptops, so don't know if there's a different procedure for it to find the path.
As for Opera, I would download AdwCleaner using a different browser and run a scan with that should you have picked up adware which is causing that freeze.
https://www.malwarebytes.com/adwcleaner/
I've never used Opera but a Google has found this article for how to reset it to defaults should it still not work after running AdwCleaner.
https://winaero.com/blog/how-to-reset-opera-browser-settings-to-their-defaults/
and there's this one - https://computerstepbystep.com/windows_7_opera.html
-
Thanks again, Boggin.
Not sure of how this happened and what exactly it means: "STARTUPSTAR and BOOSTSPEED are programs you have installed which have become part of your system's start up and ANVIR has taken over from your normal Task Manager which now is also part of your system." Since you did not comment they they might be a problem, I will just put this aside. I wonder how they can "un-become" a part of my system, but for now, as i said, putting aside.
Re VisiBroker: I am not sure what it is/does. I have not consciously installed it. Since you made no further comment, I just made note but will leave it alone.
I will change the VssProvider to Manual.
I have used internal HDD for backup by AOMEI and it worked fine.
My Malwarebytes run produced some errors; I attached only the first and last page here; at the end of the last page is a serious result categorized as MALWARE. Can I just clean them all? Or should I pick and choose? Maybe this is the cause of the backup not working.
I will work with your Opera links to see if I can use Opera again.
I will keep you posted. Thanks again for your help.
-
Can you copy the MBAM log and attach that and I'll have a malware removal expert look at them as they may not all be unwanted.
He may want you to register on the BleepingComputer.com forum where he works and have you run a couple of diagnostic programs.
This is what I'd found for STARTUPSTAR, BOOSTSPEED, ANVIR and VisiBroker.
https://www.abelssoft.de/en/windows/System-Utilities/StartupStar
https://www.auslogics.com/en/software/boost-speed/
https://www.techadvisor.co.uk/download/system-desktop-tools/anvir-task-manager-free-923-3330806/
https://www.microfocus.com/products/corba/visibroker/
I doubt if they would have come preinstalled on your computer and would have had to have been installed/bought.
I don't see why you can't just uninstall them if you don't want them.
Go Start - All programs and scroll down to each to see if they have their own Uninstaller.
-
I've had a reply back regarding your MBAM report and it would appear that you could have serious infections and the advice is as in the reply I got - they may also be able to determine what is legitimate and not of those PuPs.
I have had a look and mirc32.exe is a Trojan (bottom of second attached screenshot). The rest of them, that I can see (there 627 detections most of which I cannot see) seem to be legitimate PUPs, mostly adware and junk. Given the presence of a Trojan on the computer, I would strongly recommend that the user join Bleeping Computer and follow the instructions at this link to open a topic in the Viruses, Trojans, Spyware, and Malware Removal Logs Forum: https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/.
With that many detections, it is probable that the computer is seriously infested and the user could be at risk of having a keylogger and other more nefarious malware infecting his/her computer. Unfortunately, I will not be able to assist him, as I have seven open logs over there right now and two Juniors about to start Junior Exercise 1 that I teach. The backlog, as of yesterday, was not that bad and he should receive a reply in two or three days at the most.
-
Ok, I deleted the BAD malware at the bottom of page two and noticed the computer was slow after running MalwareBytes. Before deletion, I saved as text the list of the 627 items. Attached here.
I am not sure if there is another log.
However, MalwareBytes said must restart to complete removal. On restart Windows "desktop" comes back ut it is totally black. Mouse moves around screens. Did restart a second time. Same thing. So, I restarted in Safe Mode. Same thing. mouse moves. Black desktop.
Ut Oh. :(
-
Boggin, JohnC in Bleeping said: Posted Today, 01:51 PM
Tap F8 for advanced boot options and select Use Last Known Good Configuration. Does that work?
And this worked. I have regular desktop back and it seems to work. But, afraid to try Opera and afraid that black screen stuff may come back.
One thing I may not have mentioned: Windows Backup said "Drive H is not connected" However it is clearly present as seen in Windows explorer and in Disk Management app; I can read and write to it.
-
Using LKGC could have put that Trojan back onto the machine, but I'd stick with Bleeping Computer until your machine is infection free and that may resolve the HDD problem, but one thing at a time.
I'll leave your other thread for the time being.
-
It would seem that you have opened a thread in the BSOD section and duplicated your query about system image not recognising your separate internal HDD.
Go back to my Reply #175 and follow the instruction in there where your machine can then be checked for malware.
If your machine is infected then that can have an adverse effect on its running and may/not be the cause of Windows not recognising that internal HDD.
-
Hi Boggin,
Sorry if opening a thread on Windows backup not recognizing H drive was wrong. Seems like a different subject to me. I will delete it if you want.
I did run the MalwareBytes and quarantined the one very bad flag but then could not have windows com up without just a black desktop. JiohnC in Bleeping told me to try F8 with LAST KNOW GOOD CONFIGURATION and that worked. But, now stuck.
I am making a backup with EASEUS which is free and seems to be working. Will let you know how it ends.
-
Malware removal is a specialised subject and while MBAM is a good program, it had also snagged other items which could impact your machine.
I don't know if they were the cause of your black screen after MBAM had removed that Trojan, but you would be better served allowing the experts on the Bleeping Computer forum clean up your machine.
Last Known Good Configuration restores your computer back to where it was able to boot but in doing so, could have reinstated that infection.
Read through what I had posted and submit the FRST logs on that forum as requested in the malware removal section.
-
Howdy Boggin,
So, I have made and verified a system image backup to H with EASEUS some; it's free; it ran in a reasonable amount of time; seems to have good ratings; pro version does not cost a lot and has more features like restore to different machine, etc. So, it is painful for me to loose my "friend" AOMEI which I have used for this an many other machines flawlessly in the past (including restoring to a different machine.) But, that is life.
So, now that I have an image backup, I wonder if I should do what you suggested:
Press any key when prompted to boot from CD/DVD and you may be presented with an inverse window with Windows Setup (EMS Enabled) highlighted - just press enter then navigate to the Install screen and click on Repair your computer and select Command Prompt.
Enter bcdedit |find "osdevice" and using that partition letter instead of the X I have exampled, enter -
"sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows
For clarity that is a Pipe symbol before find and is the uppercase of \ and note there is a space before each /
When it's done, it will report as for the same when you do a normal sfc /scannow.
Enter exit to close the cmd window, remove the install disk and select Restart."
I have my Win 7 64b Ultimate distribution disc with SP1. (Or, do I need to ge the download one?)
Should I try it within Windows first?
Also, FWIW since I used the MalwareBytes program I have some annoying ByteFence thing that keeps showing up. I will mention that to Bleeping.
So, last question is: Should I go to Bleeping first or just do the SFC?
Thanks, again, Boggin for your assistance.
-
So success at last in creating an image :)
I would go to Bleeping Computer first to get the machine disinfected as it could resolve any problems and then you could run the offboot sfc /scannow, should the infection have caused any damage.
-
Good, Boggin, that is why I waited to hear from you. Early this morning I posted about removing threat and on re-boot weeing only black desktop in BSOD forum. No replies. Should I go to some other place? Or, do they have a tool like Tweaking (Could not find one.) Thanks, again for your help.
-
No, just wait for a reply - it's a busy forum.
Have you complied with the pre-posting requirements regarding posting the FRST logs ?
-
Boggin, I have no idea. I would really like to delete my posts in Bleeping as they are mixed up and asking the wrong questions. I looked for the FIRST requirements but could not find them.
ALSO, Boggin, are you familiar with cc cleaner: https://www.ccleaner.com/ccleaner
-
The instructions for FRST are at Step #6 in https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ which is the link I had included in a previous reply.
You need to read through that article and when you get a response after posting, you can ask your helper who will be a Mod, to delete that thread/posts in the BSOD section.
Yes, I am familiar with CCleaner and have it installed, but why do you ask ?
-
Thanks, Boggin, I though that maybe it cleans what I have here infected?
-
No, CCleaner has a number of tools but antimalware isn't one of them.
-
Still working with Satchfan on getting out bad stuff. Multiple runs of Rogue Killer and Adware program. Will keep you posted.
-
Can you copy & paste a link to your thread so that I can follow it.
-
Howdy Boggin,
Happy to do so. Did not realize you wanted to see it.
Here:
https://forums.whatthetech.com/index.php?showtopic=131439&page=2#entry885775
-
Thanks - I looked for it on the BC forum but couldn't ID yours.
-
It's certainly cleaned a lot of stuff out.
I noticed it cleaned out FreeFixer - sometimes these type of programs will be seen as PuPs and although I have that installed on my computers, AdwCleaner has never snagged that yet.
-
I've just bumped this thread to keep it active and easier to find.
-
Thanks Boggin. Satchafan is still working with me on this. Machine is much faster. I have learned a great deal. Look at the Bleeping thread when you have time: https://forums.whatthetech.com/index.php?showtopic=131439&page=3
And, THANK YOU SO VERY MUCH, Boggin!
-
I had a look at it just before my last post - it's certainly moving on.
-
Hi can I post a file ghere for Satchafan? 18 MB and limit in Bleeping computer.
-
That's okay but ask him as he may have a means of uploading a file that size - he must have dealt with large uploads before.
You can also tell him that after conferring with garioch7 it was me that sent you to the BC forum and while you are being helped there, there will be no input from me.
-
Sorry, Boggin, but I do not understand "there will be no help from me."
Satchfan is away from Internet for 36 hours and he asked me to send him the Malwarebytes Antimalware log but could not find a TXT log to send.
He then asked me to look in a specific place but I can not even find a Malwarebytes Antimalware folder there.
I am somewhat confused with Malwarebytes programs. Are there two of them? One Malwarebytes Anti-virus and the other Malwarebytes Antimalware?
I went to try to specifically download Malwarebytes Antimalware but most of the FREE downloads did not work. I finally went to Major Geeks and got a download, but it seems to be Malwarebytes AntiVirus. I installed and ran (again?) but there seems to be no log, again, where Satchafan told me to look.
Also, I could not find "tools, folders, options" in Windows explorer. What am I doing incorrectly?
Here is what Satchfan told me:
Show hidden Files and Folders
open Windows Explorer, (Windows key+E)
at the top, click on Tools>Folder options
click on the 'View' tab
under 'Files and Folders', place a check in Show hidden files, folders and drives
You can then find the log at the following location:
C:\Users\Morgan Pierce Parker\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
-
What I meant was that while he is helping you, I can't/shouldn't give you additional advice.
I can't use my Win 7 machine just yet as it's running a full scan with the free version of MBAM and things are a bit different in Win 10.
I've copied this from a Google link but it isn't how I remember doing it.
Select the Start button, then select Control Panel > Appearance and Personalization.
Select Folder Options, then select the View tab.
Under Advanced settings, select Show hidden files, folders, and drives, and then select OK.
I've done a scan with MBAM also on this Win 10 machine but as it didn't find anything, then I assume that is why it hasn't made a log.
Has your scan found anything ?
EDIT - Scroll down to the Win 7 part in this article which looks more straight forward and has pics - https://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/
-
Thanks, Boggin. The HOW TO GEEK was very clear on how to show the files. But, still no Malwarebytes folders in USERS folder.
This Malwarebytes company give me the creeps. Always asking for something. Too many similar but different names for things.
Just not good and clear marketing. Once machine is fixed, I think I want to go to Emisoft. What do you think of Emisoft?
Re this, I will just wait till Satchfan gets back. Thanks for your help.
-
Don't scan with anything else unless your helper instructs you.
Did your last MBAM scan find anything ?
Did you follow the full path from Users ?
-
Yes. Many "Website Blocked" items and eight old Scan Reports. Wait!
I just realized that if I check "Scan report" I can view that report and EXPORT IT.
Maybe that is what Satchfan wants. I will post those.
Thanks, again, Boggin!
-
Yes, I've just found the Reports link in the left pane and what you have found for viewing it.
As MBAM has never really found anything on my machines, I've never bothered with the reports.
-
I've just had a look at your BC thread and that has posted fine.
-
Boggin, maybe coming to an end at BC. Just posted.
Can you give me some of your thoughts on using Tweaking? Or, should I just forget it?
-
If your machine is working okay after then there will be no need to run it, but some infections can cause damage to system files.
If you do decide to run the program, create a system image first onto external media.
If you use the program to create a restore point, go into System protection to confirm that it is actually created.
-
Thanks, Boggin, for your help.
I did my last post at BC. They have indicated that I am no longer wanted. You can see my final post there. Maybe, after reading what CA said, you are finished with me also. Let me know, please.
In any event, I wish to give you a salute and thank you for all your help.
I was hoping for some advice on the original problem about the MS Update that seems to have caused all of this. However, reading what Satchfan and CA have said, it is prolly all these "registry tools" and unknown programs which have cause the problems on my machine. So, I have deleted much and will not put unknown programs on my machine --- also will stay away from "fixing" programs, etc.
I guess, if I do not hear from you, I am going to do a full backup and then try the MS updates. And, after that, install Avast Anti-virus or Emini.
Thanks so very, very much, Boggin. Have a good life! You are blessed.
I will donate $100 USD to this forum. Where do I do that?
-
Some forums will not help when they find either illegal software or P2P as they are usually used for downloading pirated software.
I don't abandon anyone unless because of their behaviour, I find offensive - yours hasn't been such and you are welcome here at any time.
What updates are waiting to download/install ?
As for a donation - perhaps you should contact Jim (JPM) at [email protected] email
I use msconfig to disable startup items I don't want starting when I boot up and my machines work okay.
He did have a point about orphan files though that if you uninstall a program that you have previously disabled in msconfig, that entry will remain, so you should re-enable that item first before uninstalling.
-
Howdy Boggin,
I sent Jim and email.
OK, I very much like the performance of the machine with the MS config keeping on only the MS services. It is fast. Plus, prolly, the other junk I deleted at Satchfan's request was surely helpful.
So, I have sworn off all registry tools and "fixers" and will not use them. Except every once in a while I will use the Tweaking tool for backup registry; and, I will use CREATE RESTORE POINT; I guess I will do this when I feel some software to be installed might mess up my machine.
I hate to be saying something like this (doing things by "feeling") but I have no other reference point. I do not understand why or when I will ever have to restore the registry except if something goes wrong.
Well, back to the original problem: Originally, I got a BSOD after an MS update. There were two update numbers that cause this and you prompted me through removing them. Between that and all the BC stuff my machine seems to be doing well. But, I am afraid to run any updates.
I want to delete the MW bytes "trial" and install Avast or Emimi, but I am unsure if this is the thing to do. I was told to uni-install all the MS anti-virus stuff (DEFENDER and some other MS thing --- I think MS scan or something like that. So, I guess I should leave this off my machine.
BTW, all I said about Satchfan in Bleeping Computer there is a correction. I thought I was in Bleeping Computer with Satchfan, but the forum was really in What The Tech.
Re updates: When I went to see about what updates should be installed, I got this message:
"ERRORS FOUND - WindowsUpdate_80070422" "WindowsUpdate_dt000"
So, I will wait to hear from you before doing anything.
-
First of all, I don't know how you ended up on that forum when the original link was for BC.
As for MBAM, the trial will end naturally 14 days after you installed it but to manually end it - open MBAM and click on Settings then on Account Details where you'll see the button to end it.
For the Windows Update error, did you get this when trying to download or install updates, or after a manual check for updates ?
Let's see if the update service is set correctly.
Go Start - type services.msc and press enter - you may need to expand the window but scroll down to Windows Update and ensure it is set to Automatic (Delayed) and showing as Started.
If it is not showing as Auto then right click on it and select Properties then use the dropdown to change it to Auto (Delayed) or just Auto - Start - Apply - OK
Close the Services window, reboot and try the updates again.
Let me know if you get an error when trying to start it.
Sometimes changing the update settings to Never check - rebooting and changing it back to Check for but let me choose.. can sometimes work.
Work your way through the steps in this article for Troubleshooter and then Fix Windows Update problems and then try them again.
https://support.microsoft.com/en-us/help/947821/fix-windows-update-errors-by-using-the-dism-or-system-update-readiness
If they still produce an error which may be a different one, perform a sfc /scannow to see what it reports.
If it reports it is unable to repair some files, then download SFCFix.exe and post its report.
http://www.majorgeeks.com/files/details/sfcfix.html
That may tell you to run SURT which is the System Update Readiness Tool.
Lower down on that Troubleshooter page you will find download links for the SURT version you will need to download, but it can resolve a number of update problems on its own, if you want to run it before a sfc /scannow.
The 64 bit version is a 533MB download and can take a while to run but its log can be found in Windows C:\Windows\Logs\CBS then double click on the Checksur one which will open in Notepad.
-
Howdy Boggin,
Well, totally honestly, I thought I was still on BC. I do remember having trouble getting in to BC at one point (just before hooking up with Satchfan) so I felt I had to create another account (Safe instead of FreeCat). I did notice something like (but not exactly) "Jimmy Coyote originally started this forum" so I figured it was just renamed.
Anyway Satchafan seemed to have helped me as computer was faster; I guess due to deleting all that crap.
OK, I will leave Malware Bytes alone and running for the moment --- unless you say to end it; I was just thinking it would conflict with Avast when I installed Avast --- if you think Avast would be good.
The windows update error happened when I am searching for updates. Oddly, the window showed Most recent check for updates: Never. Updates were installed: Never. "WindowsUpdate_80070422" "WindowsUpdate_dt000"
Yes in service.msc Windows Update shows enabled - started - automatic.
OK, Boggin, I have downloaded the update fix and am posting so I do not loose what I have written sofar. Will follow your instructions.
-
Hi Boggin,
I downloaded and installed the package for 64b W7, then I ran it.
Nothing changed on windows Update will got that strange error.
So, I saw instructions fo look in the CheckSUR.log
I found this:
=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2018-03-27 15:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Payload File Missing 0x00000000 MSDTC.LOG amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229
Summary:
Seconds executed: 1003
Found 1 errors
CSI Payload File Missing Total count: 1
-
OK, I tried a number of things on this MS page:
None worked --- i.e. Updates still failed with same error.
When I got to this part of this page:
https://support.microsoft.com/en-us/help/10164/fix-windows-update-errors
AT COMMAND PROMPT:
Ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
I got "access is denied".
Then I tried the sfc /scannow but got this message:
Windows Resrouce Protection could not start the repair service.
So, now at a standstill, here, Boggin.
-
From a Google on that error, it's item 3 in this article but I don't know how you will be able to do that if you don't have another machine to copy the file from.
https://support.microsoft.com/en-us/help/2700601/how-to-fix-errors-found-in-the-checksur-log
What I would suggest is that you perform a repair install in which case you will need to download all of the updates afresh which hopefully resolve that error.
Without going back through this thread which is quite long now, have I directed you in how to obtain a Win 7 ISO that includes SP 1 ?
You will need to have such a disk as the install disk needs to match the version you have installed.
If I haven't, then go to https://www.microsoft.com/en-gb/software-download/windows7 and enter your product key as directed which will release the ISO download.
You can use https://www.microsoft.com/en-us/download/details.aspx?id=56485 to create a bootable DVD or USB.
To perform a repair install, with the machine booted up, go Start - Computer - insert the install media and double click on its drive.
If using a disk, this should start the process but if using an USB, that will open to its files where you would double click on setup Application.
A repair install doesn't affect personal stuff or installed programs.
EDIT - just seen your recent reply - go ahead with a repair install.
-
Boggin, I do have another machine (Win 7 Ult 64 bit) that I can use to get stuff.
Also, I do have the MS install disk with SP1. So, should I do something with the other machine?
And, what?
Also, other machine does not have any problems; it is just a Dell 690 --- slower.
-
If you feel happy about the procedure to copy that file across, then try that but you always have the option of a repair install should that not work.
Is that Dell machine also Win 7 Ultimate SP1 x64 ?
-
Yes, other machine is W7 Ultimate 64 bit. SP1 So, what file should I copy?
-
It's the one that says is missing in the Checksur log.
Using the Dell, you could copy it from your post and then go to Windows C:\Windows\WinSxs and paste it into the top right search box which should land on it.
As the article says, you may need to take ownership of the file before it will allow you to do anything with it.
Scroll down this article to the hyperlink for Take Ownership Menu Hacks and run that so when you right click on a file, you can select Take Ownership - saves chewing on with those cmds in the fix article.
https://www.howtogeek.com/howto/windows-vista/add-take-ownership-to-explorer-right-click-menu-in-vista/
I have this on my Win 7 machine and a Win 10 specific one on my Win 10 machines.
-
Boggin, pardon me for being so dummb here, but the only file I see they could mean is:
CSI Payload File Missing 0x00000000
I searched my other machine foe this and came up empty.
-
If you look in the WinSxS folder you will see that they start with amd64 so try a search with -
amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229
or just up to include the 31bf number if the full one isn't found.
-
Howdy Boggin,
I found the file on my other machine (same Ultimate 64b) and took ownership of it and put the folder and file in the winsxs folder under Windows. (BTW, it took a long time to take ownership of winsxs before I could do the copy.) I put the big long amd64xxx file into the amd64xxx folder and also directly into the winsxs folder.
Still same error on the Windows update. Exactly the same no change.
So, what do you suggest now?
BTW, I have INTEL CPUs on this machine. Is this amd64xxx file have to do with the AMD graphics cards?
-
I only meant for you to take ownership of that one file and not the whole WinSxS folder which is very large.
Did you confirm that it's now in the target machine by doing a search for it on there ?
If it is then run SURT again to see what it reports this time.
AMD were the first to produce 64 bit architecture so just as Hoover were the first to invent vacuum cleaners, some still call them Hoovers regardless of the brand and so the same with Biro and ballpoint pens, so MS refer to 64 bit things as amd64.
-
OK, boggin,
I ran SURT.
It just --- sort of --- installs.
And the CBS log looks like this (3-27 is the first one):
=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2018-03-27 15:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Payload File Missing 0x00000000 MSDTC.LOG amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229
Summary:
Seconds executed: 1003
Found 1 errors
CSI Payload File Missing Total count: 1
=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2018-03-29 10:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 1091
No errors detected
===
However, Windows update still gives the message:
Error(s) found:
Code 80070422
I tried SFC /Scannow, and I got the message "Windows Resource Protection could not start the repair service."
What should I try next?
-
Let's try again - didn't realize you had posted two Checksur logs.
Can you boot up with your install disk and navigate to the Install screen and click on Repair your computer and select Command Prompt.
At the prompt enter bcdedit |find "osdevice" and using that partition letter instead of the X I have exampled, enter -
sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows
For clarity, that's a Pipe symbol before find and note the space before each /
-
OK, Boggin. I ran the repair exactly as you specified. It said that it would take a while; it did.
At the end, the final message was "System has no integrity problems."
OK, so what is next, Boggin. And, thanks for you help.
-
See if a sfc /scannow will now run in normal mode and if it does without reporting it is unable to repair some files, try your updates again.
If they still fail, then post the error code.
If the sfc /scannow still fails to run then go into Event Viewer to see what that reports.
-
Well, Windows comes up (pretty fast) but there is a black desktop; the mouse moves around but can not get task bar or task manager with Ctrl-alt-Del.
I shut if off and tried again and had the option for safe mode, etc. I choose normal again and same thing happened: black desktop and mouse.
What do you suggest, Boggin?
-
Can you boot it up into the advanced boot options to see if Last Known Good Configuration will get you back in normally ?
-
Hi - I guess I do not know how to get to advanced options. Only choice was normal, safe with networking or command prompt. I am in safe mode now. Well, not really safe mode.
Safe mode has same thing. Black screen and mouse.
OK, I am trying F8 now. OK, normal desktop.
I will try repair scan now on H DD windows.
Same message "Windows resource Protection could not start the repair service."
What to look for in Event Viewer?
-
EV ATTACHED HERE.
-
When you tap F8 as you switch on, look down the list of options where you will see Last Known Good Configuration and select that to see if you get a normal boot after the reboot.
Which Event ID immediately followed the failed sfc /scannow
-
OK - I ran SFC again and posted the time and started the EV right after.
ATTACHED
-
Are you back in normal mode now ?
Can you click on Administrative Events in Event Viewer or on Event Viewer (Local) for the errors - those are just info.
-
Yes, normal mode:
EVENT CODE for that event:
+ System
- Provider
[ Name] VSS
- EventID 8224
[ Qualifiers] 0
Level 4
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2018-03-30T20:29:10.000000000Z
EventRecordID 1144632
Channel Application
Computer M764-140-DQ64G3
Security
- EventData
2D20436F64653A2020434F525356434330303030303737332D2043616C6C3A2020434F525356434330303030303735352D205049443A202030303030353738382D205449443A202030303030343238342D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820
Binary data:
In Words
0000: 6F43202D 203A6564 524F4320 43435653
0008: 30303030 33373730 6143202D 203A6C6C
0010: 524F4320 43435653 30303030 35353730
0018: 4950202D 20203A44 30303030 38383735
0020: 4954202D 20203A44 30303030 34383234
0028: 4D43202D 20203A44 575C3A43 6F646E69
0030: 735C7377 65747379 5C32336D 76737376
0038: 78652E63 20202065 7355202D 203A7265
0040: 656D614E 544E203A 54554120 49524F48
0048: 535C5954 45545359 53202C4D 533A4449
0050: 352D312D 2038312D
In Bytes
0000: 2D 20 43 6F 64 65 3A 20 - Code:
0008: 20 43 4F 52 53 56 43 43 CORSVCC
0010: 30 30 30 30 30 37 37 33 00000773
0018: 2D 20 43 61 6C 6C 3A 20 - Call:
0020: 20 43 4F 52 53 56 43 43 CORSVCC
0028: 30 30 30 30 30 37 35 35 00000755
0030: 2D 20 50 49 44 3A 20 20 - PID:
0038: 30 30 30 30 35 37 38 38 00005788
0040: 2D 20 54 49 44 3A 20 20 - TID:
0048: 30 30 30 30 34 32 38 34 00004284
0050: 2D 20 43 4D 44 3A 20 20 - CMD:
0058: 43 3A 5C 57 69 6E 64 6F C:\Windo
0060: 77 73 5C 73 79 73 74 65 ws\syste
0068: 6D 33 32 5C 76 73 73 76 m32\vssv
0070: 63 2E 65 78 65 20 20 20 c.exe
0078: 2D 20 55 73 65 72 3A 20 - User:
0080: 4E 61 6D 65 3A 20 4E 54 Name: NT
0088: 20 41 55 54 48 4F 52 49 AUTHORI
0090: 54 59 5C 53 59 53 54 45 TY\SYSTE
0098: 4D 2C 20 53 49 44 3A 53 M, SID:S
00a0: 2D 31 2D 35 2D 31 38 20 -1-5-18
-
I was adding to my last post as you were writing yours - that event is only info and not an error.
Can run a chkdsk /f to see what that reports.
I'm not sure if I've already explained how to view its log but in Event Viewer expand Windows Logs - click on Application - Action/Find then type chkdsk or wininit into the Find box and press enter.
Cancel the Find box and read the log in the scrollable pane below.
-
I am confused.
In the search for wininit and for chkdsk, the only events are in September of 2017.
For example:
Chkdsk was executed in read-only mode on a volume snapshot.
Checking file system on C:
The type of the file system is NTFS.
WARNING! F parameter not specified.
Running CHKDSK in read-only mode.
CHKDSK is verifying files (stage 1 of 3)...
3043584 file records processed. File verification completed.
43520 large file records processed. 0 bad file records processed. 2 EA records processed. 278 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
3396284 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)...
3043584 file SDs/SIDs processed. Cleaning up 149 unused index entries from index $SII of file 0x9.
Cleaning up 149 unused index entries from index $SDH of file 0x9.
Cleaning up 149 unused security descriptors.
Security descriptor verification completed.
176351 data files processed. CHKDSK is verifying Usn Journal...
54420504 USN bytes processed. Usn Journal verification completed.
Windows has checked the file system and found no problems.
1953019903 KB total disk space.
1463051716 KB in 2785144 files.
1297792 KB in 176352 indexes.
0 KB in bad sectors.
3228919 KB in use by the system.
65536 KB occupied by the log file.
485441476 KB available on disk.
4096 bytes in each allocation unit.
488254975 total allocation units on disk.
121360369 allocation units available on disk.
-
I must have run check disk (since the problems begain last Summer at leat 15 times). Never an error that I recall. Attached is one I just ran without /F (by accident) as I did not want to reboot. But, I will run again with /F and reboot if you want.
-
Well that looks okay.
Did you manage to find your way in Event Viewer to see the errors for when sfc /scannow failed to run ?
-
Howdy - No, the wininit and chkdsk were from September 2017. All that I found I have posted.
-
windows update also has same error. ATTACHED
IS IT NOT A LITTLE WEIRD THAT wu SAYD nEVER ON RECENT CHECK AND INSTALLED?
Sorry caps.
-
You should get a log when you use a parameter with chkdsk.
Can you try a sfc /scannow again then go straight into Event Viewer to see what error has been produced.
In Event Viewer ensure Event Viewer (Local) is highlighted in the left pane - if it isn't then just click on it.
-
OK, Boggin,I did what you asked, below.
But, I have no idea what to look for in Event Viewer.
Should we ask someone in Bleeping Computer at this point?
-
According to that, it hasn't recorded anything for its failure as it would have been listed as an error within the last hour.
Can you go Start - type services.msc and press enter.
Scroll down to Windows Module Installer and click on it then on Start in the left pane and then try the sfc /scannow again.
The default setting for that service is Manual - if isn't and shows as Disabled, right click on it and select Properties then use the dropdown to change it to Manual - Apply - OK
Or you could change it to Auto and click on Start before Apply - OK
Click on File/Exit to close the Services window.
There is an elevated cmd you can use to start the Module Installer but we need to see what its status is.
The cmd is net start trustedinstaller
-
OK, SFC is running "will tkae a long time" - Sorry that I forgot, but where do I look for sfc results or should I just trywindows update again when sfc done. Thanks.
-
It depends upon what the sfc /scannow reports.
If it reports no integrity violations then we are no further forward and I would be contemplating a repair install if you still get that update error.
Hopefully it will report that it has repaired all files but if it reports that it was unable to repair some and as the offboot sfc /scannow reported no integrity violations, then I would still be contemplating a repair install.
If it reports that it cannot repair some files then you can copy & paste this cmd which will produce an icon on the desktop which when double clicked will open the CBS log in Notepad.
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt
Right clicking on that - Send to - Compressed .zip will give you a file that you can attach to the reply box.
This is a cut down version of the CBS log which says what it has and couldn't repair.
If it reports that then you're still looking at a repair install.
-
HOWDY - GREAT! BOGGIN!
Sfc worked and updates found and ready to installed.
See attached picture.
But, could not get the sfc log to display - there was an error message - see picture.
So, I am applying the updates and will report when done.
-
OK, so update still going and looks like it will take quite a while.
I will keep you posted.
When you have time tell me what went wrong about displaying the CBS log. Thanks.
BTW, the King and Queens of Easter Bunnies are wearing crowns. What are their crowns made of?
Happy Easter!
-
I don't know what went wrong with that cmd - it usually works for me and I just copy & paste it from a Wordpad doc.
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt
I'll run a sfc /scannow later and test it.
You want to hide that KB295664 as it's a telemetry update and sends data back to MS.
As I assume it's already downloading and installing, then after the install reboot, go to Installed Updates and enter that KB into the top right search box and when it comes up, right click on it and select Uninstall.
It will be presented to you again where you can right click on and select Hide.
As the sfc didn't find any files to repair, I don't know why the updates should suddenly start to work.
-
OK. Still updating. Maybe updates worked due to services.msc now automatic.
-
Now after 6 PM and still updating. Worried a little about this, but will let it play out. hehe
-
Well you can only wait until they either complete successfully or fail.
The MSRT one can take a while to install as it does an antimalware scan on installation - at what point is the machine still installing ?
I ran a sfc /scannow on both a Win 7 Home Premium and Win 10 machine and that cmd produced a desktop icon in each case.
-
I've just been having another look at the cmd window you had posted and yours looks somewhat different to my admin one in that it doesn't mention the name of the computer as yours does even though it shows as an Admin prompt in the top bar.
As a tip, if you want to copy the output of a cmd window, right click in its window and click on Select all then press enter where you can then right click in the reply box and select Paste.
While this is on a Win 10 machine, it's the same as on my Win 7 -
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
Did you put your clock right ?
This being out can affect a number of things including updates and can be a pointer to your CMOS battery running down, so I would change that as a matter of course - they tend to last about 6yrs but mine are still going fine since 2010 - 2011.
-
Ut oh - it is now 9AM the next day and installed updates is still at 2 of 6 and the progress bar does not look like it has moved by about 5PM yesterday. So, it may be stock. What to do?
I can cancel and ? or ?
Thanks, I see how I can select in the CMD window. Will use that in the future.
I remember you mentioned clock in a previous post, but did not understand what you meant. My clock is at the correct time and date.
Over to you, Boggin.
-
Some how or other, your cmd prompt alerted you that your clock was wrong, but for me, there's still something wrong with your system as your cmd prompt looks like an hybrid of a normal cmd prompt and an admin one.
c:\users is a normal prompt and the one I posted previously is an admin one.
While you can run a chdksk and sfc /scannow from it, it was confused by that findstr cmd because the path didn't tally from what should have been an admin prompt.
I think you should go for a repair install on this machine.
I'm not sure what would happen if you shut the machine down while it is in the middle of installing updates or if it will let you - you may be able to end the process via Task Manager and then perform the repair install.
The updates shouldn't have taken this long so it has obviously found something not right.
-
Success! sort-of 4 of 6 completed.
I came back here just now after services and see that 4 of 6 complete.\
And, it wants a restart.
Error code 8007006E
I have attached the update history and the two that were not installed were MS Office updates for 2010 which I do not have on this machine. I have only Office 2003 and 20013.
So, what is you diagnosis, Bloggin?
Are we past the two updates that caused the BSOD?
I will now reboot and let you know what happened in the next post. Hopefully, it comes back with no problem. Fingers crossed.
-
See how it goes after the reboot but I wonder why it downloaded two Hotfixes for SURT (KB947821)
-
Looking at your updates, it looks like you have more to come because that Rollup is for Dec. 2017
I cannot quite see from your pic the status of all of the update history - I can see the F or failed and the S for successful but can't remember what the P is for.
-
OK, Boggin, W7 booted up with no problem - it took longer than usual - prolly due to updates being installed. But, got desktop back with going to last know config.
Based on what you said I started Windows Update again for the additional updates. First time, stopped after 30 seconds with "could not continue."
But, there was a try-again button and I pressed it and it has been searching for almost 5 minutes os far. This seems good, I think.
The "P" is for pending.
I reviewed what you said about clock and I can not see where system determined something was =wrong with the clock.
OK, update has found updates - 2 important re security and many others.
But of the many others, I am only checking Dell display and two for .NET stuff as I use .NET --- not selecting any of the others unless you tell me to do so.
See below.
And, thanks VERY MUCH, again, Boggin for your help.
-
One more thing Boggin: I notice install and update for MS Security Essentials after the reboot. I believe that Satchfan told me to delete all of this when I was working with her --- and I did.
So, should I install/update this now?
-
About the clock - it was in the pic you attached about the findr cmd failing to find the path.
I'd install all of those except for the language packs for now - I've never seen those updates before on my Win 7.
You can install those later if you want.
How long is since this machine last had updates in relation to you installing Ultimate ?
I think the AMD one may be what AMD have released to counter Meltdown and the Spectre vulnerabilities.
Just seen your last post - it may be there is MSE residue left on the machine - how did you uninstall MSE and what antivirus do have installed now ?
Download and run the MSE Uninstaller which should get rid of any MSE residue.
http://www.majorgeeks.com/files/details/microsoft_security_essentials_removal_tool.html
-
I'm going to shoot off for a couple of hours as I haven't had my evening meal yet and it's turned 7;30pm here in the UK.
-
CLOCK: That was about printing the time before and after the command that id not work (so you could see the time.
OK, so you are saying that MS Security Essentials is not essential and never be installed? I used Programs and Features to uninstall last time.
Essential or important updates were always installed until the BSOD problem when I began this case last Summer.
I have none except some kind of Malware Bytes thing that Satchan told me to use and is now expired. Some part of it is still working. but, I do not like Malware Bytes. Very annoying.
I like Avast or eMini (sp?) but Satchafan siad to wait until done before installing any AV program.
Update still cranking.
-
Yes, when you first install MBAM you get the 14 day Trial Premium version which will revert to the free version on expiry where it is just an antimalware scanner which you would run manually and is a very good one - I have the free version installed.
MSE isn't bad but there are better programs and if you are happy with Avast Free then install that, but run the MSE Uninstaller first - I don't know what emini is.
As for the clock, it said the correct time and told you to put yours right ?
Going by the time stamp of the posts, the updates seem to be taking a lot longer than they should.
When this lot finish, go Start - type disk cleanup then right click on Disk Cleanup and select Run as administrator
This could find a few GB of obsolete updates to clean out and may help.
-
OK, Boggin, I hope I am not speaking too soon, but I believe that we are close to the end of this nightmare.
Except for the MS Office 10, it seems all of the important updates are applied; and, I believe I mentioned that I do not have MS Office 10; instead I have 03 and 13.
I did do the disk cleanup and that got rid of some stuff.
I un-installed MS Essentials and are about to install Avast. If I remember you use only free version of MalwareBytes. anything else?
There are optional updates (posted below) and I am unsure of these; I remember Shane once saying long ago: "If it is not marked important, skip it.
So, is that still the right guidance?
After all of these, I am at a loss to figure out exactly what was done to "fix" my machine and exactly what was wrong with it. Do you know?
Is there anything else to check for in case there is still some unknown lurking problem? Any further diagnostics to run?
-
At the top of your second pic it mentions 2 Important updates but I can only see the one for AMD.
If you click on the AMD one and then on More info in the right pane, it will tell you what it is for just as it will for those other updates immediately below.
Quite often they are for remote desktop.
I wouldn't bother with those language ones unless you want to install them.
Any you don't want to install, check their boxes and right click on each and select Hide.
Can you compare your admin command prompt to mine that I have posted.
For me, yours isn't as it should be.
-
Howdy Boggin,
Been away most of yesterday so that is why I am late responding. Back now.
I am confused about these two important updates also. When I click where you said, I get info that they are for MS Office 2010 which I do not have. I will use your suggestion to hide these.
Those were "important" but not for me as I do not have Office 2010. they are still listed as important even though I have hidden them.
The only ones left are AMD for display - but I am afraid of this as I had so many problems getting these AMD W7000 cards to work properly.
Based on what I told you I heard long ago from Shawn: I guess that the other updates in picture below (not marked important) can be ignored. Is that correct?
Well, I do not understand about the admin command prompt. I am operating machine as admin with name of Morgan Pierce Parker.
So, are there any final diagnostics that I should apply to be sure that I have gotten all corruption from machine?
Do you have any idea what "we" did to fix things and what was the cause of this original BSOD from last Summer?
Thanks, again, Boggin.
-
What did the info say for that AMD one ?
Yes, you can probably ignore the ones below the AMD one.
Sometimes updates can cause problems on some machines which could be why you got the BSOD.
There are two ways to run a cmd prompt - as an user or as an admin.
To run cmds such as chdksk /f or /r and a scfc /scannow you need to run it as an admin.
This is what you get when you run it as an user where you see the computer name -
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Users\KAM4>
and this is what you get when you run it as an admin -
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>
To run a cmd prompt as an admin you would go Start - type cmd then right click on cmd and select Run as administrator.
To run it as an user, when cmd comes up you would just press enter.
Can you either go back to your pics you attached to compare or open an user cmd prompt and then as an admin as I've described.
Yours of course will have Win 7 on them.
-
OK, Boggin,
Here is what I get when I run CMD as admin:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
And here as user:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
I emailed AMD and got an unbelievably quick response:
Hi Morgan;
If your system is working as intended, please ignore any updates related to your graphic card.
Thank you
Ali
So, Boggin, are there any final diagnostics that I should apply to be sure that I have gotten all corruption from machine?
Do you have any idea what "we" did to fix things and what was the cause of this original BSOD from last Summer?
Thanks, again, Boggin. You must be into Winter sports. :)
-
That was good of AMD.
You've posted two pics for an admin cmd prompt.
In your Reply #248 Page 17 the pics you posted showed you being able to perform a sfc /scannow from an user account which you shouldn't have been able to do and is probably the reason why the findstr cmd failed.
Doing so should have produced this message -
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Users\KAM4>sfc /scannow
You must be an administrator running a console session in order to
use the sfc utility.
C:\Users\KAM4>
This is why I think there's still something wrong with your system and is why I advise performing a repair install.
-
Well, that certainly makes sense Boggin.
But, updates work. If there a list of all updates this machine should have somewhere?
MPP IS an admin on this machine. Maybe that is why it worked.
But, what if I do it the way you demonstrated as admin.
I am afraid of the repair install; this could alway be done at some future point --- no?
I will try that now just for drill.
And, here is the result:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>time
The current time is: 15:09:04.60
Enter the new time:
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
C:\Windows\system32>
Boggin, it took about 45 minutes.
If you want the log, please tell me which or where it is. Thanks.
-
There's no point in looking at the log as it didn't find anything wrong, but a sfc /scannow doesn't scan all files.
Can you try the sfc /scannow by going Start - type cmd and press enter to see if you get the same error message as I and everyone else usually does.
And why is your cmd prompt telling you the time ?
The CBS log is found at Windows C:\Windows\Logs where you'll see the CBS log.
While there is always a local administrator, you normally have to right click on something to select Run as administrator, otherwise it runs as normal with less privileges.
-
At Start by typing cmd and pressing enter I get this:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Morgan Pierce Parker>
I get the time because I type in "time" to show you how long things take.
So, if you think of something more to do (other than the repair re-install
W7), Boggin, please let me know.
-
Try a sfc /scannow from that prompt.
-
OK,
It took a while. Here is the screen:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Morgan Pierce Parker>
C:\Users\Morgan Pierce Parker>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
C:\Users\Morgan Pierce Parker>
-
You shouldn't have been able to do that from that level of cmd prompt.
When you select the cmd prompt to Run as administrator you will find that findstr cmd will produce the desktop icon for the CBS log as I've described.
Boot up into Safe Mode with Networking and open Windows Repair and run just the Permissions repairs to see if that puts things right.
See if you can still perform a sfc /scannow from the Users cmd prompt after the reboot.
-
ok Boggin, I will do that in the safe mode later today.
Currently, I am using the machine for work and can not reboot.
But, I did do a Malware Bytes scan and some thing have shown up:
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 4/4/18
Scan Time: 2:16 AM
Log File: b9e38b54-37cf-11e8-9250-00ff83c10af3.json
Administrator: Yes
-Software Information-
Version: 3.4.5.2467
Components Version: 1.0.342
Update Package Version: 1.0.4608
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 807126
Threats Detected: 12
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 41 min, 4 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 1
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}, No Action By User, [314], [238383],1.0.4608
Registry Value: 4
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|DISPLAYNAME, No Action By User, [314], [238383],1.0.4608
PUP.Optional.TNT, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|OSDFILEURL, No Action By User, [6695], [244085],1.0.4608
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|FAVICONURL, No Action By User, [314], [238383],1.0.4608
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|URL, No Action By User, [314], [238383],1.0.4608
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 3
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata, No Action By User, [1229], [373186],1.0.4608
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0, No Action By User, [1229], [373186],1.0.4608
PUP.Optional.FastestTube, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\OPERA SOFTWARE\OPERA STABLE\EXTENSIONS\PHAHNHBGFDHGOBENEBNJBGMACGPBFAAG, No Action By User, [1229], [373186],1.0.4608
File: 4
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata\computed_hashes.json, No Action By User, [1229], [373186],1.0.4608
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata\verified_contents.json, No Action By User, [1229], [373186],1.0.4608
PUP.Optional.FindWide, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DZYGI7OP.DEFAULT\PREFS.JS, No Action By User, [314], [301558],1.0.4608
PUP.Optional.Freshy, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DZYGI7OP.DEFAULT\PREFS.JS, No Action By User, [277], [301562],1.0.4608
Physical Sector: 0
(No malicious items detected)
(end)
===============================
I think I should quarantine these, but I will wait for your opinion.
I do not know how these PUPs get there. I plan to uninstall MalwareBytes and put on Avast on the next boot. Would that stop these PUPs?
I see that two of these are for FireFox. I only use FireFox when GoToMeeting is used as that does not work with Opera. Is there another supplementary browser you would suggest. I have been running Opera for ten years and, to me, it is the best.
-
I would keep MBAM as it's an excellent antimalware scanner, but if you read the report, it says no action by user.
They are just browser extensions which a website may have put in.
I only ever use IE - currently IE 11.
-
OK, Boggin,
I will keep Malware bytes on your suggestion.
Speaking of which there were threats discovered overnight, below; I quarantined them.
Can you tell me how it works. License is not activated and yet it did a scan without my asking overnight. So, that must means it works in real time, maybe?
Is there a way to stop the nagging update message? I remember once before I did subscribe (prolly on another machine) and it began nagging about all kinds of other products they have --- about 5 different things. It never stopped so I un-installed it.
So, what it the difference between a malicious item and a threat?
So, we should quarantine both --- all the time? When not to do that.
BTW, I stopped using IE many years ago. IE let so much bad stuff on my other machine. Nagging me, etc. At least once a virus which messed up my machine. It was a new machine and Dell fixed it and told me not to use it. There were many articles about IE being bad, so I stopped all togehr using it in all machine.
But, now, some program will call it up even though I have Opera as my default. I never had trouble with Opera and it is faster.
I had problems similar to IE with Firefox also, but I use it as my alternate only when some broadcast program like TOTOMEETING does not work with Opera. What about Safari? How is that. I do not like Chrome due to the nature of the Google corporation. IMO, a bad company that does things behind your back.
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 4/5/18
Scan Time: 2:16 AM
Log File: e44b2086-3898-11e8-9311-00ff83c10af3.json
Administrator: Yes
-Software Information-
Version: 3.4.5.2467
Components Version: 1.0.342
Update Package Version: 1.0.4624
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 807301
Threats Detected: 12
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 25 min, 36 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 1
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}, No Action By User, [314], [238383],1.0.4624
Registry Value: 4
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|DISPLAYNAME, No Action By User, [314], [238383],1.0.4624
PUP.Optional.TNT, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|OSDFILEURL, No Action By User, [6697], [244085],1.0.4624
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|FAVICONURL, No Action By User, [314], [238383],1.0.4624
PUP.Optional.FindWide, HKU\S-1-5-21-2396228472-3482715812-2186985281-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E8307B89-5F41-4591-83AE-91CC210327DF}|URL, No Action By User, [314], [238383],1.0.4624
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 3
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata, No Action By User, [1228], [373186],1.0.4624
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0, No Action By User, [1228], [373186],1.0.4624
PUP.Optional.FastestTube, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\OPERA SOFTWARE\OPERA STABLE\EXTENSIONS\PHAHNHBGFDHGOBENEBNJBGMACGPBFAAG, No Action By User, [1228], [373186],1.0.4624
File: 4
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata\computed_hashes.json, No Action By User, [1228], [373186],1.0.4624
PUP.Optional.FastestTube, C:\Users\Morgan Pierce Parker\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag\2.4.0.19_0\_metadata\verified_contents.json, No Action By User, [1228], [373186],1.0.4624
PUP.Optional.FindWide, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DZYGI7OP.DEFAULT\PREFS.JS, No Action By User, [314], [301558],1.0.4624
PUP.Optional.Freshy, C:\USERS\MORGAN PIERCE PARKER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DZYGI7OP.DEFAULT\PREFS.JS, No Action By User, [277], [301562],1.0.4624
Physical Sector: 0
(No malicious items detected)
(end)
===========
There was one more thing overnight: Windows update happened and it wants me to reboot to complete now. I thought I choose "notify me but do not install". But, it updated anyway.
I have posed the update history below. Can you have a look to see it all is good with that update?
I will reboot in safe mode and do what you asked in one of you last posts, now.
But I am unsure of how to do this. Is this permissions repair with the MS WINDOWS7 SP1 release disc:
"Boot up into Safe Mode with Networking and open Windows Repair and run just the Permissions repairs to see if that puts things right.
See if you can still perform a sfc /scannow from the Users cmd prompt after the reboot."
-
The reason MBAM is doing the scans is because you are running the 14 day Premium free trial.
If you want to revert to just the free version then open MBAM and click on Settings and then on Account Details where you will see a button to end the free trial.
I said to expect some more updates as the machine is catching up on those.
It shouldn't have auto installed them when you have the update settings set to Check for but let me choose - have you checked to see if it's still set to that.
You don't need the install disk to run the Windows Repair program.
If you haven't already have it installed or don't have the latest version then download it from www.tweaking.com
The repairs I want you to run are as in my pic.
Uncheck the top box which will clear the rest then check just the first 4 boxes.
I've always used IE since I bought my first laptop in 2010 and have used Norton since then without my machines becoming infected.
I don't click on unknown links in emails - don't use P2P download sites and don't go looking for what could be dodgy websites.
Do you actually have an antivirus program installed ?
-
OK, Boggin,
Ran Tweaking Tool. (BTW, I was very confused when you said run repair tool; I kept looking for some Microsoft thing). But, I ran Tweaking tools with only first four check as admin. Machine has doubled in speed.
The setting reverted back to install on Windows Update. (pic below). But, can you tell me if the other setting are correct?
Several updates applied them selves and there were several reboots due to this.
But, there are several updated that are "recommended". So, I wonder should I do these and what is the rule going forward about recommended?
I am running the SFC now, but I had a hard time getting the command prompt as "administrator.
See the windows it ways administrator at the top.
-
That's still showing as your Users cmd prompt even though it says Admin in the top bar - I don't understand why that is.
I'm going to ask my Support about that.
As AMD said you could ignore the AMD update then right click on it and select Hide - do the same for KB2952664
I got KB4099950 as an Important one on my Win 7 so install that one and you will have to click on each one of the rest and then on the More info link in the right pane to see what the rest are for.
You probably don't need any that are for Remote Desktop.
-
Thanks, Boggin.
OK I did what you said about KB4099950.
But, what about the .NET framework. I use .NET programs so should I include that?
And the one to Preview of Quality Rollup --- that sounds important. No?
However after this last reboot, there is a major problem that I can not resolve.
Most web pages (about 35 of 40) that I have tabs open on will not long open. They give a message like The webpage at https://email.secureserver.net/login.php?domain=email.mpj.com might be temporarily down or it may have moved permanently to a new web address.
using Firefox, I CAN get to that site.
Also, many desktop shortcuts, etc. no longer work.
Also, VERY IMPORTANT: VARIOUS DROP DOWN ITEMS NO LONGER WORK:
Send to Zip file, Open with RAR, etc.
machine is vi rurally unusable for most that i do with it.
How can I fix these things? thanks in advance.
-
Yes, I had .Net Framework on my list to install, but forgot to include it in my post.
You can hide the Preview for the Rollup as they can sometimes cause problems and it's only Optional anyway.
Go to Installed Updates - type KB4099950 into the top right search box and when it comes up, right click on it and select Uninstall then see if your computer starts working again as it should after the reboot and let me know.
That update should be installed before KB4088878 or KB4088875 as this article explains - https://blogs.technet.microsoft.com/yongrhee/2018/04/02/hotfix-4099950-to-fix-lost-network-settings-after-kb4088878-andor-kb4088875-on-windows-7-sp1-andor-windows-server-2008-r2-sp1/
After the reboot go back to Installed Updates and type each of those updates into the top right search box to see if you have them installed.
-
OK, Boggin,
I made one mistake in my last report.
What I said:
""... I did what you said about KB4099950."
What i meant to say:
I did not yet do what you said about KB4099950."
So, the condition was no caused by that.
I did make a Tweaking backup of registry, create restore and the optional "ownership" (right under registry) just before the reboot to apply updates.
Should I restore those?
Also, the two updates you said should be installed before KB4099950 are not in my to be installed list of past history list.
Also, I went to see about un-installing the very last update kb4100480 that has installed date of 4-6 and the one before that KB4074598, but I can not see any otpion to uninstall them. How is that done? Thanks.
-
Windows Update should have created a restore point - use that to go back.
-
Hi Boggin - Been through a nightmare here. finally was able to get updates applied using iobit tool that Satchan used many times and restoring restore point. tweaking tool made things worse just doing the first four. Have not had a bootable system till now. I just applied the last updates and system looks stable. I am thinking of getting Win 10 and a 500 gb SSD and having Win 7 run virtual. This way I would use my main dozen programs on 10 and still have all my 7 stuff available. . Does that make sense.
-
Some do dual boot with Win 10 and 7 but the few programs I have installed all worked except CCleaner when I upgraded from 7 to 10 and I was surprised my printer also did.
CCleaner just needed to be reinstalled as any program would should it not survive the upgrade.
What Win 7 stuff are you talking about as I believe most will survive the upgrade, although I've seen a few complaints about Office 2003 running in Win 10 - mainly because MS seems to have given up on it.
I don't have Office installed but do have Word Viewer so that my old MS Works can read attached docs which have been put together in Office.
By all accounts, you can still get Win 10 free providing you have a valid Win 7 key as someone found on another forum.
With OEM machines, the COA sticker key tends to wear off - I'm sure MS made those biodegradable :)
I made a hard copy of those should I have ever needed them.
To get Win 10, just create the install media from after reading the instructions - https://www.microsoft.com/en-gb/software-download/windows10
Prior to upgrading my two Toshiba Win 7 machines, I created system images as well as having factory reset install media.
While I've never created a virtual drive to dual boot or for anything else, to upgrade, go Start - Computer - insert the install media and double click on its drive.
This will start the process if using a DVD but will open to its files when using an USB where you would then double click on setup Application.
Before deciding on whether to use a DVD or USB, you will need to ascertain if your machine can boot from an USB, although that isn't a requirement for the upgrade.
I've created both DVD and USB and prefer to use the USB when I want to boot up with install media to troubleshoot.
When you are prompted for a product key, just enter your Win 7 one.
If you are installing onto a new disk, then you will need to have Win 7 installed on it first to get the freebie.
-
OK, thanks, Boggin. I have to take all you said in and rest for a day or so before I move again. I am very fearful that W7 will go back to unusable state. I --- before your response --- was thinking of install the dozen or so programs that I use 90+% of the time fresh on W10 and then doing a virtual boot of 7 into 10 - avoiding dual boot which will waste time.
Happy to hear that W10 will not cost. My plan would be to install 7 from MS disc onto the SSD (valid copy) and then put W10 on to that.
What do you think of that?
-
Are you still talking about a virtual install ?
-
hehe - I do not know what virtual install is. What I am planning (but not sure is a good idea) is install fresh 7 onto the new ssd using the 7 ultimate 64 product key. Then installing 10 onto that ssd. then, when I want to use 7 load it as virtual OS from my (damaged) w7.
-
I think once you have gotten used to Win 10 you won't want to go back to 7.
-
OK, Boggin - So what I said makes sense. I am just afraid of W7 conversion effort bringing broken registry stuff in W10. But, if I can use W7 programs (those I only use 10% of the time) in a virtual image of 7 that would make me feel safer. Does it make sense to you?
-
If you are going to do a clean install onto a new drive then you shouldn't have any broken registry stuff.
-
Yes, but I though you implied that I put existing W7 on the new drive and put W10 ONTOP OF W7.
nO?
-
No - if you put Win 10 on top of a clean install of Win 7 then there shouldn't be any corruption to transfer, but I've seen where a problem with Win 7 has vanished after the upgrade.
You are in effect installing a different OS.
The only way a problem could be transferred would be if you had bad sectors on a HDD - you're not likely to have bad cells on a new SSD.
Don't forget though - after you have clean installed Win 7 you will need to sit through all of the updates again before upgrading and make sure all of your drivers are up to date, including those in Device Manager/View/Show hidden devices/Non Plug and Play Drivers.
You just right click on each in each section, select Update Driver Software and use the default search online.
For the most part you'll probably get that you already have the latest driver, but there may be the odd one that will update.
-
Thanks, Boggin, but i am confused by your response.
Yes, I understand that win 10 over a clean and updated install of win 7 would hve no corruption as my "weirdo" Win 7 would nt be involved.
And, my "weirdo" win 7 now does have all the updates. So, you are saying that an install over it might make all corruption vanish?
And the probability of that is 20% 50% 80%.
I have no HDD errors. with chkdsk.
-
Yes, that's a possibility.
Do you feel that your Win 7 still isn't as it should be and if so, in what way ?
-
i GUESS IT IS ONLY THE TERRIBLE FEELING OF NOT BEING IN CONTROL AND NOT KNOW WHAT WAS HAPPENING LAST WEEK WHEN i WAS STRUGGLING JUST TO GET IT TO BOOT SO i COULD USE IT. i MEAN i ONLY MONKEY-FOLLOWED WHAT STACHAN WAS DOING BY GOING BACK TO RESTORE POINTS, THEN RUNNING IOBIT SOFTWARE AND TRYING UPDATES AGAIN UNTIL ALL THE UPDATES WORKED.
Sorry caps, but in a hurry now.
I have rebooted several times now and no problem, except Windows Explorer sometimes takes a long time to bring up programs, but does not happen often. I can live with that.
What else should I do to test if system is good enough to install W10? Thanks in advance. And, thank you, again, so very much for all your help on this issue.
-
What IObit software have you been running ?
The easiest way to test if the system is good enough is to upgrade.
When you upgrade, Windows creates a Windows.old folder which is everything you had previously installed and is what you can use to revert to Win 7 but I would create a system image to rely on.
When the freebie was properly on offer (2015 - 2016), you had 30 days in which to roll back and then Windows would remove the Windows.old folder.
In the advanced boot options you will see that option to revert to previous build.
-
Howdy,
I used the free edition of this: http://purchase.iobit.com/en/imf/newinstall.php?name=imf&ver=5.6.0.4462&lan=&to=newgift&ref=ffnewgift&type=free
OK, so I do not understand what it did, but things got fixed it seems.
Yes, I will make a Reflect backup of the good 7 as it stands before going to the 10; in fact I made one already as soon as 7 seemed fix; but, I will get rid of more stuff not needed and then just before upgrading to 10, I will make another.
-
So what is the free gift ?
-
I do not know. I just used the free version. Does three things according to the chart at the bottom of the page.
-
As it gets rid of adverts, did you find any problems when browsing as some sites won't allow you in without a warning if you're using an ad blocker.
-
ok, i HAVE NO IMPORTANT WINDOWS UPDATES (JUST ABOUT 8 OPTIONAL ONES) AND (sorry caps) just 7 optional ones. So, I am going to transfer my Win 7 to SSD.
So, you have very much helped me go from broken BSOD (due to Win 7 updates) to healthy (I think) system that is up to date.
Boggin, do you think I need any of these optional ones. I mean how do I know if it will interfere with converting to Windows 10. Is there anything in update history that I should make sure I have before going to Win 10. I read that the conversion can be "hairy".
I made a Reflect image of system as it is and will use that to restore to SSD.
Boggin, once W7 image is put on SSD will there be a boot option at startup to boot from SSD or existing drive?
Once I am on SSD, I intend to convert to W10.
THANKS, AGAIN VERY MUCH, BOGGIN.
-
I've never had a dual boot but I think you get the option for which OS to boot.
One thing to ensure before you upgrade is to ensure all of your drivers are up to date.
You can hide the Preview but most of those have caused problems for some.
KB3161102 is to remove Windows Journal but that wasn't without causing a problem for someone, so I'd hide that one as well.
KB3170735 is interesting because it was one of those that could have helped put Win 10 onto unsuspecting Win 7 users.
I'm not sure if that one would be beneficial or not, but you can hide the rest.
-
OK Boggin, I will hide them all based on what you said.
Or really: I guess I should just install the W10 over the W7 and it they shouw up again in W10 hide them.
But, how do I know if all the drivers are up to date?
-
If Windows thinks your drivers are all up to date then that should be okay.
Go into Device Manager/View/Show hidden devices then expand each section and right click on the adapter and select Update Driver Software and use the default search online.
For the most part you will get that you already have the latest driver installed, but there may be the odd that has an update.
-
Hi boggin. I found this from a friend. Says it is asier. https://www.iobit.com/en/driver-booster.php
What do you think?
-
No - I once tried that program and it gave me a wrong network driver.
Also, if you use Nvidia graphics then it could download the wrong driver because they can sometimes be OEM modified and if it gave you one from Nvidia then that could result in a BSOD.
I've also tried Slimdrivers which is another driver updater program and it would usually say the same drivers were out of date.
I no longer advocate driver updater programs.
-
Thanks Boggin. Unfortunately, I did not see this until now. I awoke earlier and tried it. Still cranking. Hope you are in correct. hehe :|
-
So how many drivers is it telling you that need updating or is it in the process of updating ?
However, you should have your restore points to fall back on if needed.
-
Yes, I have restore points and made a Reflect image yesterday.
It looks like it updated the video drivers and now it is paused wanting money, I guess, to do more.
Here is screen. lol
-
It didn't used to be like that as the freebie did the job as well - I'd get rid of it.
Java and Adobe Air aren't critical but if you have Java installed then it's best to keep it up to date, but most disable Java in browsers.
You can do that by going Start - type java and select Configure Java then under the Security tab uncheck the top box and follow the prompts.
However, that box needs to be checked while you update it.
Check the drivers the way I've advised.
-
OK, thanks, Boggin.
Drivers are up to date and still no important W7 updates --- only the 7 optional one and I am not doing anything with them unless you tell me specifically.
I am not attempting to put my w7 hdd image onto my Samsung ssd.
First I tried to just connect my ssd but on the boot "no mbr" found. So, my conclusion is that machine is looking to boot from ssd and ssd is empty.
So then i install virgin w7 onto dds booting from distribution disc. That went OK. I expected the startup boot would give me the option of booting from my hdd w7, but no: Machine only booted from ssd --- virgin w7 installation.
Then, I booted from the Reflect rescue disk and was going to restore my reflect image from a few days ago to the ssd. But, just as I was about to begin that I realized that there were some program and data updated I did earlier that were not on that Reflect image.
Then, I disconnected the data line of the ssd (I left the power wires connected) and rebooted normal from my hdd w7. I figured once w7 was up, I could connect the data line from the ssd and get access to write a reflect image of the current - good - hdd w7 onto the ssd.
But, ssd is not visible in explorer. Is there w ay to make the SSD visible so I can do this?
The Samsung ssd is visible in the Device Manager and Disk Management as ATA Samsung SSD 860. Please see next post.
-
Here is an image of status after connecting the ssd after booting from the normal w7:
-
OK, false alarm. I assigned a disk letter and now it is visible. sorry to have bothered you Boggin.
I just update Reflect to v7.1.3169 and have started the Clone operation of w7 hdd to ssd.
After a few minutes I got a message from the Disk Management section of Computer Management saying "action failed to complete". I noticed that the assigned letter of Drive K was now gone from the disk management window, BUT the reflect was still operating --- progress bar moving.. Drive K is also missing from the explorer view of all disk drives.
Overall Progress 1% and Current Progress 1% of Reflect. So, I guess that Refect works at the raw device level and does not care about K anymore. Hope I am right and not wasting our time here. I will report when it be done.
-
It should put it onto the SSD however you had it set up on the HDD as it is an image of the HDD.
Is the SSD the same size as the HDD ?
When I replaced a 640GB HDD with a 1TB HDD and put the image from the 640GB onto the 1TB I ended up with about 335GB Unallocated space but because Win 10 puts a 450MB Recovery partition immediately to the right of C: I was unable to extend that to C:
I had to factory reset back to Win 7, restore with the image I'd created before I upgraded to 10 and then do it - sat through Windows Updates and then had to bring various programs back up to date and add my personal stuff back.
I then put Win 10 back on.
-
UGG. Sound bad. OK, my Win7 C is a 2 TB drive (1.21 free of 1.81 TB). The SSD is (now) blank 2 TB - I have a picture here. Will I have the same problem?
-
Not when you are going from 2TB to 2TB but while you are in Win 7 there wouldn't have been any problems extending that to C: if you were going from smaller to larger as I did.
-
OK, Boggin. Just talking about w7 here.
The reflect completed, but theres does not seem to be any change in performance. See attached.
What could be wrong.
-
more 1
-
I don't know what's gone wrong there or what those Network Locations are for.
Did you create a normal Macrium system image rather than a clone you can restore with ?
If you haven't then perhaps you should put the old HDD back in and create one - that should give you what you had before.
-
I did a clone to the ssd of the win7 c drive at the time of the clone the ssd was drive K. See Reflect screens above. So, W7 should be on SSD. I booted with ssd and system slow. Seems slower than hhd (or maybe about the same).
-
Also, I did a performance monitor and the result is 5.9 --- the same number as the hhd number.
-
A SSD should be a lot faster on boot but I don't know how they should perform in relation to a HDD during normal operation.
How many items do you have enabled under Startup in msconfig ?
They can slow things down by taking up memory which can impact performance.
I've never cloned before but know what restoring with a system image does when transferring onto a new HDD.
I think I would still try that.
Download Novabench and that will tell you what the write speeds are.
You could put your old HDD back in and compare Novabench performance results.
https://novabench.com/download
-
OK, so maybe i should " restoring with a system image".
How do I do that with reflect?
-
You'd plug in the ext. HDD to what you want to save the image to, open Macrium and then select Image this disk to the right of Clone this disk.
I only ever do this for my images.
-
OK, but is the image bootable or just image to be restored and then be bootable?
-
I guess what I am wondering is: Do I have to tell w7 that i am on an ssd? There must be some way to definitely tell if i am on ssd or hdd.
-
It will sense and automatically enable TRIM - https://www.digitalcitizen.life/simple-questions-what-trim-ssds-why-it-useful
To restore or put the image onto the SSD you would boot as normal with the WPE disk, plug in the ext. drive and then search for images where you'll see the images by date.
-
What's the Windows Experience Index (WEI) score for your drive now? Control Panel\All Control Panel Items\Performance Information and Tools.
Run a benchmark on your SSD with =http://www.hdtune.com/HDTune Pro (http://=http://www.hdtune.com/HDTune Pro) and attach the screenshot, please.
Trim being enabled by the OS doesn't necessarily mean that the Trim calls are reaching the drive(s), a 'bad' Controller driver can block the calls (even drivers from the hardware maker or Windows Update have been known to do this). If you can update the firmware on the drive(s) successfully, Hard Disk Sentinel (https://www.hdsentinel.com/) or Trimcheck (https://github.com/CyberShadow/trimcheck) report that Trim is active (https://www.hdsentinel.com/faq.php#trim) or that it's working, then Trim is almost certainly enabled and active.
-
Howdy Satnow and Boggin,
WEI for drive is still 5.9 while all else is at 7.9. Somehow (even thought I F12) booted from Samsung SSD I am stil on the HHD. I discovered some tools in Reflect that might help, but I do not yet feel knowledgeable enough to use them. I will study them. There is a thing also call Samsung Magician --- another item to understand. Thanks for all your help.
-
If you used F12 to select the boot then this probably isn't it but run a cmd prompt as an admin and enter powercfg -h off
This will turn Hibernate off and to turn it back on, just repeat the cmd changing off to on
-
Thanks, Boggin, but I do not understand. What does hibernate have to do with the SSD?
-
If it's holding in memory what it was last booted from then that could be why it's going to the HDD.
Turning off Hibernate could eliminate that, but as I've said, it may not be that.
Do you have a choice of separate SSD and HDD in the BIOS or are they just lumped together as SSD/HDD in the Boot order ?
-
Can you show us a screenshot of Disk Management so we can see the full Status details, please?
-
HOWDY,
Yes, below.
K is the Samsung.
H is a drive I use for backup only.
C is main W7 drive.
-
That looks a complete mess, cf. my C: status flags with your current Windows drive K:
Whilst your system can be repaired, it requires an expert to provide the rather complicated list of steps (and checks) to restore your PC to something suitable to be upgraded to W10. That's me out, I've been sticking with the KISS principles for disk management for the last 15 years.
I'd go the clean install route with W7, only the SSD installed, check that TRIM is active after updating Windows (WU might install an 'upgraded' driver that 'blocks' Trim - W10 did it to me after the AU Update - rolling back the drivers to the default W7/10 version will reactivate Trim), upgrade to W10 and then re-attach your HDDs and get it setup to your liking. Don't forget to create clones/backups before any major upgrade or change.
W7 can be installed on a single partition; as my C: shows, W10 requires, I think, 3x partitions; you'll need to make allowances for that according to the current recommendations during the W7 install, which would then likely make use of 2x partitions with unallocated space left for the W10 upgrade 'hidden data' partition.
-
Thanks Satnow. Sad to hear, but I have mcuh to learn. W7 updated 100% --- no problems with it. maybe I will call Samsung. Will let you know.
-
I wasn't suggesting that the Windows installation was faulty, just that the initial steps currently needed to boot to Windows open you up to a breakdown in the future, perhaps with your next OS upgrade, a BIOS glitch or hardware malfunction.
My disk layout ensures that I can remove all but Drive 0, the C: containing Windows, and still have a fully functioning System. You cannot do that, your layout needs at least 2 of those installed drives to boot up.
The reason your WEI scores are unchanged since adding your SSD is that WEI tests only the drive where Windows is installed, namely the K:
-
Thanks for the info.
OK, so now I am several days into using this SSD. Problems every once in a while. Rebooted in the middle of working last night at 8:45 PM. But, came back OK.
Occasional messages about files missing, etc --- but it may be the app I am using; support for that app does not unerstand them.
Samsung, the SSD manufacturer, has a "Magician" that is supposed to support the SSD, but it does not work with the SSD version I have and they have no answer when it will be fixed.
I am using Reflect to make backup images; it seems OK; this is what I used to create (move) W7 to SSD.
I want to let this "settle" for a while before updating to W10.
Again thanks for ALL your help. I will keep you posted of changes, etc.
-
The SSD is working and has W7 on it. I had to disconnect the HDD W7. Samsung magician still does not recognize the Samsung SSD. Dunno what to do about this. Samsung has no answer. Will use it the way it is for a while. It seems stable. Took latest important updates with no problem. More to come.
-
If the SSD isn't being recognised by Samsung Magician, try rolling back the drivers for the SATA ports to the default MS AHCI versions; these will allow Magician to see the drive, the firmware to be updated and Trim to work. The downside is that the drive(s) may not be quite as fast.
-
Thanks, Satrow, but I do not understand how to do this. I have a good Hitaghi 2 TB drive that is labeled H, and the SSD is C. I tried swapping the SATA channels but when I went to boot I got the message No MstrBook. I switch back again and now it boots.
I am fearful that I may damage machine. I have GFS backup running each evening, but I have never restored from that and am worried it is is OK.
Samsung says that Magician just does not support the drive I have. I find that very weird; I just do not know how they can sell a drive with no support tools.
-
Roll back the SATA drivers as per my previous post, this will allow Magician to 'see' your drive.
The problem with changing your drive order using the cables as it stands is that the only working Windows install is accessed by the boot sequence 'bouncing' from one drive to another - not good long term, way too complex.
-
OK, I am going to do what you suggest Satnow, but firts I am gong to attempt restore of system to another machine so that I know I can get back to where I am in case something goes wrong. I may take more than a few days to find a machine which is stuitable for restore.
-
OK, machine has been stable for almost a week. I did one windows update for my Android phone connection.
while applying it, the machine re-booted.
I figured that there was a required re-boot that I did not see.
But after re-booting, I saw something else that was on my machine years ago. Machine was asking to me to insert the NaturalReader CD ROM.
I canceled this and continued to use my machine. One of the programs I use is xxxxxx HD. the xxxx part is something I can never remember so I normally just type in hd at the start search box. Once I did that, the screens went blank and the keyboard and mouse went out (I.E. no light on the KB for caps log or numb lock).
I thought this was strange so I had to reboot by taking out power. This time I did nothing else after canceling the NaturalReader dialog.
Now I am un-installing the NaturalReader to see what happens.
OK, so after un-installing NaturalReader typing HD and pressing enter did not re-boot machine. Avast report still 13 registry enteries for NaturalReader are there. Should I just forget about them?
I do not understand this. I have not used NaturalReader for years. What could have happened?
Could it be that HD <enter> is some kind of Windows command that I am unaware of?
-
Howdy - Another two weeks have gone by with no updates needed and things going smoothly.
Hoping to get update from Samsung on software to get around NO BOOTRCD..