Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on September 02, 2014, 10:26:44 PM
-
Last week one of our pc's crashed due to a power supply failure. Luckily, I could use an other power supply I had lying around. On the first boot after the crash, the (UEFI) BIOS repaired itself. But after that, I kept getting a BSOD on Windows (Home Premium x64) boot. Errorcode 0x0000007B flashes after the first "dots" of the Windows logo appear. I have already tried many fixes, but without positive results. When booting in safe mode, I saw it stopped on file aswRvrt.sys. When I searched for that file, I saw many people had similar problems with Avast installed.
Then I realized that Avast was also installed on this pc, that's why I asking for help on this forum even though the cause of the problem seems to be the power supply failure.
What can I do to fix this?
-
Go to this link and down to section about not being able to boot PC.
Follow instruction and attach FRST log.
I will PM Essexboy
https://forum.avast.com/index.php?topic=53253.0
However, if P/S failed I assume Windows crashed which could mean the O/S is corrupt.....but Essexboy can try a few tricks to at least restore the registry and see if that works.
Do you have a W7 Repair CD ?
If not, go to this link and scroll down.....get the 64bit version, burn CD.
http://maximumpcguides.com/windows-7/create-a-windows-7-system-repair-disc/
Do nothing further until Essexboy instructs you to.
-
Can you get to the command prompt on the safe mode menu without it crashing
-
I can get to the command prompt via advanced recovery options (don't know if it's the good translation, I'm Dutch). I've already tried to restore the RegBack registry, but it didn't help.
-
From the command prompt could you run the following command :
chkdsk c: /r
And then try a reboot
-
The prompt starts in X:\windows\system32
Do I have to run chkdsk on the Windows volume? I guess that is D:, not C:
I've just tried C:, but it didn't find much files. Normally, in Windows it is C:, but for some other fixed I also had to use D:.
-
I can get to the command prompt via advanced recovery options (don't know if it's the good translation, I'm Dutch). I've already tried to restore the RegBack registry, but it didn't help.
How did you restore the registry ?
.....and you want to run CHKDSK on the volume in which the Windows Installation is it is mapped to in the recovery environment.
It should be noted that when you boot into the Windows 7 Recovery Environment the drive letter for your Windows installation may not be the same. For example, if your Windows installation is normall on the C: drive, it may not be located at the D: drive. To determine what drive letter your Windows installation is located on, you can type this command press enter:
bcdedit | find "osdevice"
This command will display output similar to : os device partition=D:. The drive letter after partition= is the drive that your Windows installation is located.
-
I restored it this way: http://www.sevenforums.com/tutorials/139576-startup-repair-infinite-loop-recovery.html
So I have to do CHKDSK on the Windows volume? That would be D:.
-
So I have to do CHKDSK on the Windows volume? That would be D:.
Check with the BCDEDIT command........YES.
Just curious, how did you get to the Recovery Console ?
Also, did you try to hit F8 and try "Last Known Good Config" ?
-
No, I have not tried "Last know good config" yet. I did see this option.
What do you mean exactly with Recovery Console? I guess I was just lucky I got it on boot. Every time it shows something different like (Advanced) Recovery Options, Normal boot/recovery options, safe mode options, or even nothing and it just tries to boot Windows.
Right now I am running CHKDSK.
-
Tell us what CHKDSK does (errors found ? fixed ?).........once complete reboot.
Then wait for Essexboy's guidance.......he is the expert.
FYI...he is in UK....so FYI on time difference.
Do you know if this machine had System Restore enabled ?
-
CHKDSK didn't find any damaged sectors. Nothing repaired I guess. Windows still doesn't boot...
I don't know if System Restore is enabled.
To answer one of your first questions in this topic, I have got the original Windows installation DVD. Is this also the repair disc?
-
What can I try next? Or do I have to run FRST?
-
Download the following programme to a USB
Farbar Recovery Scan Tool x64 (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/)
Boot from the windows CD
Windows 7 and Vista screenshots
When you reboot you will see this.
Click repair my computer
(http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7275.jpg)
Select your operating system
(http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277202.jpg)
Select Command prompt
(http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277.jpg)
Insert the USB with FRST on it
At the command prompt type the following :
notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe or e:\frst.exe dependant on system
and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
(https://dl.dropboxusercontent.com/u/73555776/frst.JPG)
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
-
Here is the first part:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 01
Ran by SYSTEM on MININT-19R1DAQ on 03-09-2014 16:29:56
Running from F:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Nederlands (Nederland)
Internet Explorer Version 11
Boot Mode: Recovery
The current controlset is ControlSet001
[b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b]
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13423688 2013-02-26] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694040 2014-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2010-11-21] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\Patrick\...\Run: [AdobeBridge] => [X]
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174296 2014-03-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148016 2014-03-04] (NVIDIA Corporation)
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-21] (AVAST Software)
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356912 2014-07-19] (Microsoft Corporation)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-21] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-21] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-21] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-21] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-21] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-21] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-21] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-21] ()
S0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21584 2013-05-06] ()
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-03 16:29 - 2014-09-03 16:29 - 00000000 ____D () C:\FRST
2014-08-28 18:42 - 2014-08-28 18:42 - 00000000 ____D () C:\Windows\System32\config\tijdelijkRB
2014-08-28 17:00 - 2014-08-28 17:01 - 00000000 ____D () C:\Windows\System32\config\mybackup
2014-08-19 16:18 - 2014-08-19 16:21 - 00000000 ____D () C:\Users\Patrick\Documents\Peter Kuiper
2014-08-19 15:17 - 2014-08-28 20:49 - 00000000 ____D () C:\Program Files (x86)\HEMA Fotoservice
2014-08-19 15:17 - 2014-08-19 15:17 - 00001051 _____ () C:\Users\Public\Desktop\HEMA Fotoservice.lnk
2014-08-19 15:17 - 2014-08-19 15:17 - 00000000 ____D () C:\Users\Patrick\AppData\Local\HEMA Fotoservice
2014-08-19 15:17 - 2014-08-19 15:17 - 00000000 ____D () C:\ProgramData\HEMA Fotoservice
2014-08-19 15:11 - 2014-08-19 15:12 - 157652984 _____ ( ) C:\Users\Patrick\Downloads\HEMA_NL_Fotoservice.exe
2014-08-19 13:33 - 2014-08-19 13:33 - 06052529 _____ (Tim Kosse) C:\Users\Patrick\Downloads\FileZilla_3.9.0.3_win32-setup.exe
2014-08-15 09:11 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\System32\icardres.dll
2014-08-15 09:11 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 09:11 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 09:11 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\System32\TsWpfWrp.exe
2014-08-15 09:11 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\System32\icardagt.exe
2014-08-15 09:11 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\System32\infocardapi.dll
2014-08-15 09:11 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 09:11 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-15 09:10 - 2014-08-01 00:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-08-15 09:10 - 2014-08-01 00:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-15 09:10 - 2014-07-25 15:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-08-15 09:10 - 2014-07-25 15:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-08-15 09:10 - 2014-07-25 15:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-08-15 09:10 - 2014-07-25 14:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-15 09:10 - 2014-07-25 14:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-08-15 09:10 - 2014-07-25 14:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-08-15 09:10 - 2014-07-25 14:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-08-15 09:10 - 2014-07-25 14:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-08-15 09:10 - 2014-07-25 14:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-08-15 09:10 - 2014-07-25 14:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-08-15 09:10 - 2014-07-25 14:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-08-15 09:10 - 2014-07-25 14:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-15 09:10 - 2014-07-25 14:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-08-15 09:10 - 2014-07-25 14:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-08-15 09:10 - 2014-07-25 14:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-08-15 09:10 - 2014-07-25 13:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-08-15 09:10 - 2014-07-25 13:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-08-15 09:10 - 2014-07-25 13:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-08-15 09:10 - 2014-07-25 13:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-15 09:10 - 2014-07-25 13:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-15 09:10 - 2014-07-25 13:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-15 09:10 - 2014-07-25 13:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-15 09:10 - 2014-07-25 13:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-08-15 09:10 - 2014-07-25 13:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-08-15 09:10 - 2014-07-25 13:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-15 09:10 - 2014-07-25 13:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-08-15 09:10 - 2014-07-25 13:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-15 09:10 - 2014-07-25 13:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-08-15 09:10 - 2014-07-25 13:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-15 09:10 - 2014-07-25 13:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-15 09:10 - 2014-07-25 13:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-08-15 09:10 - 2014-07-25 13:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-15 09:10 - 2014-07-25 13:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-15 09:10 - 2014-07-25 13:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-15 09:10 - 2014-07-25 12:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-15 09:10 - 2014-07-25 12:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-08-15 09:10 - 2014-07-25 12:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-15 09:10 - 2014-07-25 12:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-08-15 09:10 - 2014-07-25 12:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-08-15 09:10 - 2014-07-25 12:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-08-15 09:10 - 2014-07-25 12:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-15 09:10 - 2014-07-25 12:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-15 09:10 - 2014-07-25 12:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-15 09:10 - 2014-07-25 12:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-08-15 09:10 - 2014-07-25 12:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-15 09:10 - 2014-07-25 12:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-15 09:10 - 2014-07-25 12:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-15 09:10 - 2014-07-25 12:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-15 09:10 - 2014-07-25 11:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-08-15 09:10 - 2014-07-25 11:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-08-15 09:10 - 2014-07-25 11:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-08-15 09:10 - 2014-07-25 11:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 09:10 - 2014-07-25 11:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-15 09:10 - 2014-07-25 11:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-15 09:10 - 2014-07-16 04:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2014-08-15 09:10 - 2014-07-16 04:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-08-15 09:10 - 2014-07-16 03:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-15 09:10 - 2014-07-16 03:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 09:10 - 2014-07-16 03:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-08-15 09:10 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2014-08-15 09:10 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-15 09:10 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2014-08-15 09:10 - 2014-06-03 11:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-08-15 09:10 - 2014-06-03 11:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2014-08-15 09:10 - 2014-06-03 11:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\System32\msihnd.dll
2014-08-15 09:10 - 2014-06-03 11:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\System32\consent.exe
2014-08-15 09:10 - 2014-06-03 10:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 09:10 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 09:10 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-08 10:17 - 2014-08-08 10:16 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-08 10:17 - 2014-08-08 10:16 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-08 10:17 - 2014-08-08 10:16 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-08 10:17 - 2014-08-08 10:16 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 19:07 - 2014-08-06 19:07 - 00000000 ____D () C:\Users\Patrick\Documents\Tosca
2014-08-06 14:06 - 2014-08-06 14:10 - 00000000 ____D () C:\Users\Patrick\Documents\Gerwin Wilkens
2014-08-04 23:14 - 2014-08-04 23:14 - 25931642 _____ () C:\Users\Patrick\Downloads\Autocross Ten Boer 1997 (Low).mp4
2014-08-04 17:54 - 2014-08-04 17:54 - 06004615 _____ (Tim Kosse) C:\Users\Patrick\Downloads\FileZilla_3.9.0.2_win32-setup.exe
-
Second part (due to message size limit):
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-03 16:29 - 2014-09-03 16:29 - 00000000 ____D () C:\FRST
2014-08-28 20:49 - 2014-08-19 15:17 - 00000000 ____D () C:\Program Files (x86)\HEMA Fotoservice
2014-08-28 20:49 - 2013-11-13 18:41 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\IrfanView
2014-08-28 20:49 - 2013-11-13 18:32 - 00000000 ____D () C:\Windows\System32\Macromed
2014-08-28 20:49 - 2013-11-13 18:30 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Adobe
2014-08-28 20:49 - 2013-11-11 19:16 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-28 20:49 - 2013-11-11 18:22 - 00000000 ____D () C:\users\Patrick
2014-08-28 20:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-08-28 20:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-28 18:42 - 2014-08-28 18:42 - 00000000 ____D () C:\Windows\System32\config\tijdelijkRB
2014-08-28 17:01 - 2014-08-28 17:00 - 00000000 ____D () C:\Windows\System32\config\mybackup
2014-08-27 16:30 - 2013-12-27 16:04 - 00000000 ____D () C:\Users\Patrick\Documents\Outlook-bestanden
2014-08-27 08:16 - 2013-11-11 18:19 - 01994445 _____ () C:\Windows\WindowsUpdate.log
2014-08-27 08:12 - 2013-11-13 17:29 - 00001054 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-27 08:12 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-27 08:12 - 2009-07-14 05:51 - 00178505 _____ () C:\Windows\setupact.log
2014-08-26 22:09 - 2013-11-13 17:29 - 00001058 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-26 21:28 - 2013-12-28 21:05 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\ObviousIdea
2014-08-26 20:32 - 2014-04-18 14:29 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\FileZilla
2014-08-26 08:38 - 2009-07-14 05:45 - 00022064 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 08:38 - 2009-07-14 05:45 - 00022064 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 08:37 - 2011-04-12 14:00 - 00764394 _____ () C:\Windows\System32\perfh013.dat
2014-08-26 08:37 - 2011-04-12 14:00 - 00160042 _____ () C:\Windows\System32\perfc013.dat
2014-08-26 08:37 - 2009-07-14 06:13 - 01710684 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-08-26 08:31 - 2009-07-14 05:45 - 08238520 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-08-20 10:46 - 2013-11-13 18:32 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-20 10:46 - 2013-11-13 18:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-19 16:21 - 2014-08-19 16:18 - 00000000 ____D () C:\Users\Patrick\Documents\Peter Kuiper
2014-08-19 15:17 - 2014-08-19 15:17 - 00001051 _____ () C:\Users\Public\Desktop\HEMA Fotoservice.lnk
2014-08-19 15:17 - 2014-08-19 15:17 - 00000000 ____D () C:\Users\Patrick\AppData\Local\HEMA Fotoservice
2014-08-19 15:17 - 2014-08-19 15:17 - 00000000 ____D () C:\ProgramData\HEMA Fotoservice
2014-08-19 15:12 - 2014-08-19 15:11 - 157652984 _____ ( ) C:\Users\Patrick\Downloads\HEMA_NL_Fotoservice.exe
2014-08-19 13:33 - 2014-08-19 13:33 - 06052529 _____ (Tim Kosse) C:\Users\Patrick\Downloads\FileZilla_3.9.0.3_win32-setup.exe
2014-08-15 16:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 09:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-15 09:12 - 2013-11-13 16:46 - 99218768 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-08-15 09:12 - 2013-11-13 16:46 - 00000000 ____D () C:\Windows\System32\MRT
2014-08-14 09:10 - 2013-11-13 17:29 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-13 22:26 - 2014-08-13 22:26 - 138174757 _____ () C:\Users\Patrick\Downloads\blijham deel 1 (Low).mp4
2014-08-13 17:04 - 2013-11-11 20:35 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-09 17:22 - 2010-11-21 04:47 - 00199724 _____ () C:\Windows\PFRO.log
2014-08-09 10:23 - 2013-11-13 20:29 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-08 10:17 - 2014-01-17 22:06 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-08 10:16 - 2014-08-08 10:17 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-08 10:16 - 2014-08-08 10:17 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-08 10:16 - 2014-08-08 10:17 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-08 10:16 - 2014-08-08 10:17 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 19:07 - 2014-08-06 19:07 - 00000000 ____D () C:\Users\Patrick\Documents\Tosca
2014-08-06 14:10 - 2014-08-06 14:06 - 00000000 ____D () C:\Users\Patrick\Documents\Gerwin Wilkens
2014-08-05 08:20 - 2010-11-21 04:27 - 00270496 _____ (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-08-04 23:14 - 2014-08-04 23:14 - 25931642 _____ () C:\Users\Patrick\Downloads\Autocross Ten Boer 1997 (Low).mp4
2014-08-04 17:54 - 2014-08-04 17:54 - 06004615 _____ (Tim Kosse) C:\Users\Patrick\Downloads\FileZilla_3.9.0.2_win32-setup.exe
Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\Temp\Creative Cloud Helper.exe
C:\Users\Patrick\AppData\Local\Temp\CreativeCloudSet-Up.exe
C:\Users\Patrick\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Patrick\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Patrick\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Patrick\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Patrick\AppData\Local\Temp\LMkRstPt.exe
C:\Users\Patrick\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Patrick\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Patrick\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Patrick\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Patrick\AppData\Local\Temp\nvStInst.exe
C:\Users\Patrick\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Patrick\AppData\Local\Temp\_isE7DE.exe
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Restore Points =========================
Restore point made on: 2014-08-03 09:19:42
Restore point made on: 2014-08-05 09:22:34
Restore point made on: 2014-08-08 10:14:53
Restore point made on: 2014-08-08 10:16:46
Restore point made on: 2014-08-13 09:22:12
Restore point made on: 2014-08-15 09:10:56
Restore point made on: 2014-08-19 12:06:11
Restore point made on: 2014-08-27 08:16:02
==================== Memory info ===========================
Percentage of memory in use: 7%
Total physical RAM: 16271.96 MB
Available physical RAM: 15069.29 MB
Total Pagefile: 16270.16 MB
Available Pagefile: 15066.95 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:88.55 GB) NTFS
Drive e: (GSP1RMCHPXFREO_NL_DVD) (CDROM) (Total:2.97 GB) (Free:0 GB) UDF
Drive f: (MEMORYSTICK) (Removable) (Total:0.48 GB) (Free:0.48 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Door systeem gereserveerd) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: E77FCD23)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 500 MB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=500 MB) - (Type=0B)
LastRegBack: 2014-08-27 08:36
==================== End Of Log ============================
-
You can attach the logs that makes it easier
Nothing apparent showing at this stage so we will try this first :
Download the attached fixlist.txt to the same location as FRST
Run FRST as before
Then try a normal boot
If that fails then run start up repair three times rebooting after each
-
It succesfully restored the RegBack hives. First boot BSOD with the same error as usual.
1st startup repair: was scanning for problems for a few minutes, but computer could not be repaired, error: StartupRepairOffline
2nd startup repair: scanning was done in a few seconds, computer could not be repaired
3rd startup repair: also done within a few seconds, computer could not be repaired
I looked into the activity logs and noticed the last item (translated):
Recovery Operation: Control and restore integrity of system files
Result: Failed. Error code = 0x490
Duration: 178824ms
-
Can you go into the BIOS and let me know whether it is set to SATA, AHCI or IDE for the hard drive
-
Perhaps a video explanation along the lines of Essexboy thinking............
https://www.youtube.com/watch?v=ObRLHDy3JIk
Essexboy, depending on OPs answer blow away Avast install via Farbar and boot into Safe Mode and change the IDE in Device Manager ?
{Learning mode question from me and just brain storming}
-
No I do not believe it is Avast. This is a common windows problem although it normally stops on the classpnp if Avast is not installed
-
I cannot do the fix from the video, because I can't boot into safe mode.
SATA mode is set to AHCI. Other options: IDE or RAID
I also want to mention that the pc had four 2TB drives in RAID 10 at the moment of the crash. These drives are currently in an other pc for file recovery. The only drive left is an Samsung 840 EVO 250GB drive with Windows and programs on it.
I have also tried something to "reset" the drivers. I used this guide: http://www.askvg.com/how-to-change-sata-hard-disk-mode-from-ide-to-ahci-raid-in-bios-after-installing-windows/
-
Could you now set in the BIOS IDE mode as opposed to AHCI save the changes and reboot
-
Set to IDE mode, but still 0x0000007B.
-
This will disable Avast could you let me know the result please
Download the attached fixlist.txt to the same location as FRST
Run FRST as before
Then try a normal boot
-
Do I first have to set it back to AHCI mode?
-
You could try that although I feel it will have no effect
-
Fix was successfully executed. But still getting the BSOD on boot...
-
I am afraid it is time for a re-install as there is little else I can do
-
I was afraid of that. But thanks anyway for your help!
What would be the best way to recover files/documents from the SSD? Can I just connect it to an other pc and use ReclaiMe for example? Because I'm afraid the "faulty" drive might damage the other pc.
-
What would be the best way to recover files/documents from the SSD? Can I just connect it to an other pc and use ReclaiMe for example? Because I'm afraid the "faulty" drive might damage the other pc.
Couldn't you just boot using the Farbar stick and then copy files ?..........depending on how many/size ?
.....after you've recovered your files........since nothing to lose you can try..........long shots for sure but never know.....
Go ahead a get back into the recovery console and try to do a startup repair again.
Yes, I know you tried prior....but want to see now that Avast is deleted.
Also try an offline system file check of O/S: http://www.winhelponline.com/blog/run-sfc-offline-windows-7-vista/
Try to rebuild the BCD: http://pcsupport.about.com/od/fixtheproblem/ht/rebuild-bcd-store-windows.htm
Past that I'm out of ideas.......the O/S really crashed hard with the P/S failure.
-
I've tried some other things, but without success. Eventually I have recovered the files on the SSD, formatted it and re-installed Windows. Before installation, I also connected the four RAID drives to the mobo. But even after installing all the drivers, Windows doesn't recognize the RAID array properly.
Windows Device Manager shows "Intel Raid 1 Volume SCSI Disk Device" as first item. Then the SSD followed by two times "ST2000DM 001-1CH164 SCSI Disk Device".
What can I do to fix this (without losing data)?
-
Your D and E are showing as raw, that means they are not formatted
-
I was hoping it was more "plug and play" because the drives are back in the same configuration using the original hardware and software. If I'm going to format them, all data will be lost, right?
-
If you format it, you lose whole previous content; to recover NTFS partition, you might try tool named testdisk but it's rather advanced and I can hardly recommend it without any prior knowledge. I don't want to be a pessimist but I would reserve a day to reinstall Windows and restore data from backup (you have backup, right?).
And never ever use RAID without UPS (or at least disable drive and RAID cache), I experienced very similar loss myself and was barely able to recover my most important data.
-
I have already reinstalled Windows, and I'm now trying to restore/recover/rebuild the RAID 10 array. I've read somewhere that it wouldn't be a problem if I were using the same hardware and software again. The drives are also in the same order as before the crash. I find it strange that two drives are recognized as RAID 1, while the other two drives are listed as single drives.
-
Did you use built-in Intel RAID or do you own dedicated RAID controller? You need to pair disks exactly same they were. If you are lucky, you might be fine. If not, well ... I wasn't even able to recover two disks in RAID 1 because a controlled had an ingenious idea to overwrite first 128 MB of the disks ...
-
I used Intel RAID/Rapid Storage Technology. I can't remember configuring anything in BIOS (using CTRL-I at boot). Disk 1 and 2 are recognized as RAID 1, while disk 3 and 4 are listed as single drives. I actually used disk 1 and 3 to recover files using ReclaiMe, so at least these two drives seem to function correctly.
-
SOLVED!! I was able to restore the RAID array without losing any data.
I used the following guides:
http://www.overclock.net/t/1227636/how-to-change-sata-modes-after-windows-installation
http://www.overclock.net/t/478557/howto-recover-intel-raid-non-member-disk-error/60#post_16869100
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step