Problem after Windows Update of today (July 10, 2012)

[Bobke57]

Hi all,
I have a problem after running the recent Windows Updates (on a Windows 7 Ultimate 32bit).
The updates seemed to run OK, and prompted me to reboot the PC. But after reboot, I keep getting the following error message when I want to start any application (Outlook, File Explorer, ...) :
'Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.'

I also noticed that it took several minutes before my antivirus (Vipre Antivirus) showed in the system tray, and my firewall (Online Armor) even never showed up. Also my Gadgets did not appear.
When I click on the Vipre icon, or try to open the Gadgets, I get the above error message.
When I open Task Manager, I see that only very few processes are running.

I do can open the Start Menu, but clicking any application results in the above error message.
I do can open the Control Panel, and some of the items there work, others don't. I managed to execute a System Restore, I did first to the Restore Point that was created before the Windows Update, but that did not improve the situation (I did get the icon 'Windows Updates available' in the system tray back, though). I tried to restore to an earlier Restore Point too, but still to no improvement.
This made me wonder if the Windows Updates are the real cause, I have to admit. Now my PC is luckily configured as a dual boot (Windows 7 and Vista), and booting in Vista works without any problem, so I guess it cannot be a hardware problem neither?

Can anybody please help?
Thanks in advance.

 

[NoelDP]

try a CHKDSK and SFC from either the original install disk, or from the 'Repair Your Computer' boot option.


Your best option in that case is to run the CHKDSK and SFC in offline mode from a Recovery Environment boot.

Reboot the computer, and tap the F8 key until you get the advanced boot menu up - one option should be 'Repair your computer'. Pick that one.

Log into your normal account.
You'll get a set of options - pick the Command Prompt one.
At the command prompt, type
DIR D:\
- if we're lucky this will bring up a listing of your normal C: drive contents, including the Program Files folder(s) and the Windows folder.
If not, try E:\ (etc. until you get the right letter - if you've tried F: and failed, try C: )

then type the following command

CHKDSK <drive>: /R

and wait for it to complete - it could take a few hours, depending on the size of the drive.
Once complete, type

sfc /scannow /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\Windows

where <drive> is the letter you found above.
Wait for the command to complete. (make a note of the response!).
Once it has, type EXIT and the pick the option to reboot.

 

[Bobke57]

Hi Noel,
Thank you for your quick reply.
I will give it a try, and report back to you.
Regards.

 

[Bobke57]

Hi Noel, I have run your suggestions with a Windows 7 Repair Disk that I have created in the past. The checkdisk reported: 'Windows has checked the file system and found no problems', but also: 'Failed to transfer logged messages to the event log with status 50'. Is this normal? The sfc command reported: 'Windows Resource Protection did not find any integrity violations' And after reboot, the situation is not improved. Maybe I also should mention that I have no password to log into my user-account, I am not sure if this matters. And I have a second user-account (also without password), and the same problem is occuring when I log in with that account. What else should I try? Thanks in advance for your help.

 

[NoelDP]

Yep - the failed transfer message is normal, as it tries to save teh log file to a non-existent folder in the RAMDrive.

I'll shout for help - WU problems are not my best suit

 

[Bobke57]

Problem solved

Noel, you have already been a great help, thank you. And I have learned the SFC-command from you, very interesting! BTW, my problem seems to be solved (need further testing to be 100% sure). I found the answer on another forum on the internet. Apparently it was my firewall Online Armor that was the cause, by blocking a new shell32.dll that was installed during the Windows Update. I could fix it by starting OA from Start - All Programs - Online Armor, using 'Run as administrator', then manually changed shell32.dll to Trusted in the OA-GUI. After reboot, everything works normal. But to my surprise, the recent Windows Updates are noted as being installed, although I know I had them removed by executing a System Restore yesterday. Now afterwards, after a second System Restore to an earlier point, I did an Undo System Restore, but in my mind it was only for that second execution of System Restore. Would it have done the Undo for both? Anyway, what is the best way to make absolutely sure that the Windows Updates are indeed installed at this moment?

 

[karlsnooks]

Bobke,

Windows Defender OFFLINE is OFFLINE anti-malware tool from Microsoft.


What all of that means is: Win 7 is never booted up. You boot from a USB stick or DVD which has WDO.

End result: none of your viruses even get a ghost of a chance to start.

Before I can proceed with any diagnosis, please carry out following:

HOW TO USE WINDOWS DEFENDER OFFLINE ON A USB STICK
Windows Defender Offline
· is a free standalone, bootable malware and virus remover from Microsoft.
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

Download Windows Defender Offline (about 764 kB)

You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
You will need an Internet Connection.
Insert 512 mB (Microsoft’s 256 mB is no longer accurate) or larger USB stick into a usb port.
Run the downloaded program--mssstool64.exe or mssstool32.exe
NEXT button
Choose the option On a USB flash drive that is not password protected
NEXT button
NEXT button
.
The install program will format the usb stick using the NTFS format.
The install program will download about 210 mB.
The install program will name the USB stick WDO_Media32 or WDO_Media64
The WDO_Media32 usb stick will have used space of 255 mB (268,140,544 bytes)
The WDO_Media64 usb stick will have used space of 282 mB (296,165,376 bytes)
You can expect the number of mB to increase as more malware appears.

UPDATE Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download about 66 mB (mssstool32.exe) and 68 mB (mssstool64.exe).

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.


RESULTS OF THE SCAN
The results will be in 4 log files on your computer's disk in:
\Windows\Microsoft Antimalware\Support

===================================================
===================================================

After completion and you fire up Win 7 normal like, then:

# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# **********************INSTRUCTIONS**************************
# STEP 1 *****************************************************
# RUN PowerShell as administrator
# START ORB | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 *****************************************************
# COPY, using CTRL+C, every line down thru both EXIT statements 
# PASTE into Powershell == Right-Click at the PowerShell Prompt
#  (Ctrl+V does not work)
# Start copying with first line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#       Lines starting with a # are ignored by PowerShell
# ************************************************************
#functions

function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}

$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime 
$b = $a | where {$_.extension -eq '.log'} |Select  mode, fullname, name, creationtime, lastwritetime,  lastaccesstime, length, extension
$b | out-file -append $fileinfo
$b | foreach ($_.fullname) {get-content -path $_.fullname} | out-file -append $fileinfo 
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#  Get-WinEvent: The system can not find the path specified
# you need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#   Run PowerShell
#   enter $host.version
#   you should see at least:
# Major  Minor  Build  Revision
# -----  -----  -----  --------
# 2      0      -1     -1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#   Run PowerShell
#   enter Set-ExecutionPolicy -executionpolicy remotesigned
#
# ************************************************************

 

[Bobke57]

Hi Karlsnooks,
Thank you for your elaborate post.
I even did not knew that Windows Defender exist in an offline version, always interested to learn something new.

But, before I execute this procedure, could you explain a bit more to me, to make sure I fully understand?
- What will this do, will it only check if my PC is contaminated with malware, or will it check if the Windows Updates are indeed installed?
Because I already did a scan for malware, starting from my Vista-boot (my PC is configured in dual-boot: Windows 7 and Vista). I scanned with both Vipre Antivrus and SuperAntiSpyware.
I also already have a Rescue-CD from BitDefender, and a second from Kaspersky. Have not executed those, but they are ready to be used.
So will Windows Defender Offline do more?
- I did not understand the end of your post. Is that a script I have to execute when I fire up Win 7 after the execution of Windows Defender Offline? Or are those steps (STEP 1, STEP 2 as instructions inside the script) that I need to execute manually?
If it is a script, do I have to copy/paste it on for example a Notepad-document, and change the name to a .bat ? (because the script is presented to me as a window within your post, I don't see a button to download it or so).

My apologies, these questions must sound very basic to you, but I really am a novice in these matters...

 

[karlsnooks]

I' referring you to an excellent article, which will provide many answers.

Also simply clicking on the link for WDO in my signature will answer many questions.

After you have carried out WDO, let me know.l

Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

 

[F5ing]

No single antivirus/antimalware program can be considered 100% effective so it can't hurt to run additional scans using supplemental programs, including the WDO that Karl mentions. Just like having another highly effective tool in your toolbox.

To help you ensure your system is up to date with patches and app versions you can use the following two programs:

Free Security Software Download - (PSI) - Secunia (The current version is newly released and is 3.0, but I'm on 2.0 and have installed 2.0 on quite a few machines. Both versions are available on that page.)

Belarc Advisor - Free Personal PC Audit, for software, hardware and security configuration information on your computer. Software license management, IT asset management, cyber security audits, and more.

Try them both. Both monitor Windows updates, but PSI also checks that your third party apps are up to date whereas Belarc focuses more on hardware, network and product licenses/keys.

 

[karlsnooks]

Actually, you need only one anti-malware, namely, WDO.

The two programs F5ing listed for keeping your system up-to-date are excellent. I've used and use both occasionally to make sure that I've not missed an update.

 

[karlsnooks]

Bobke,

Run WDO.

When finished, report back and I will walk you thru reading, cutting and pasting.

 

[karlsnooks]

Bobke,

I did not understand the end of your post. Is that a script I have to execute when I fire up Win 7 after the execution of Windows Defender Offline? Or are those steps (STEP 1, STEP 2 as instructions inside the script) that I need to execute manually?

Yes. That's a script to execute when you fire up Win 7 after execution of Windows Defender Offline.

I'm including herein the instructions.

Actually, since all lines with # are ignored, you can copy that entire script with CTRL + C and then paste using right-click.


You fire up POWERSHELL.
You paste the script into PowerShell by right-clicking at a powershell prompt.

Ctrl + V does NOT WORK. Annoying feature of PowerShell.

Now here's the explanation:

# **********************INSTRUCTIONS**************************
# STEP 1 *****************************************************
# RUN PowerShell as administrator
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the resulting PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" from the resulting list
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
# for the guru:
# WIN key | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 *****************************************************
# COPY, using CTRL+C, every line of script down thru both EXIT statements
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
# Start copying with first line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--Get-WinEvent: The system can not find the path specified
# you need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter Set-ExecutionPolicy -executionpolicy remotesigned
# ************************************************************

 

[Bobke57]

Hi F5ing,
Thanks for your reply. Those are very interesting tools!
But, if you don't mind, I will first follow the advise of Karlsnooks to execute WDO. So it will be a while before I can try PSI or Belarc. But I surely will!

 

[F5ing]

Hi F5ing,
Thanks for your reply. Those are very interesting tools!
But, if you don't mind, I will first follow the advise of Karlsnooks to execute WDO. So it will be a while before I can try PSI or Belarc. But I surely will!

That's perfectly fine. Always good to run another malware check!

 

[karlsnooks]

Bobke,

Since I moved the instructions out of the script, then here is the script without the instructions:

# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# ************************************************************

function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}

$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime 
$b = $a | where {$_.extension -eq '.log'} |Select  mode, fullname, name, creationtime, lastwritetime,  lastaccesstime, length, extension
$b | out-file -append $fileinfo
$b | foreach ($_.fullname) {get-content -path $_.fullname} | out-file -append $fileinfo 
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ************************************************************

 

[dwarfer66]

No offence guys but are you being paid by microsoft to tell everyone to use WDO, I have noticed that every problem concerning viruses etc, that is about the only thing you now recommend. Just curious.

 

[karlsnooks]

No offense taken. We just believe in recommending the best.

 

[Bobke57]

Hi Karlsnooks,
I have run WDO.
When I selected Full Scan, I did not see an option to select drives, so I just started the scan.
I presume it did all of them, since it took several hours.
When that was finished, I exited WDO, pulled out the USB-stick, and let it reboot to Windows 7.
I do see that there is indeed a folder \Windows\Microsoft Antimalware\Support.

I copied your script in Powershell, following the instructions. I used the first version that you posted, I was not aware at that time that you have posted a new version without the instructions, but I presume this does not matter.

The Powershell window closed almost immediately, and then it must have run in the background, no displayed window, I see nothing happening anymore.
Did it run well? What is the result of the script?

I also can confirm that I have Powershell version 2.0, when I checked that (earlier), I got the response:
Major Minor Build Revision
----- ----- ----- --------
2 0 -1 -1

One other thing. When I typed powershell after pressing the Win key, there were 3 different lines in the list:
Windows Powershell
Windows Powershell ISE
Windows Powershell Modules
I used (right-clicked) the first one. Was that the correct choice?

What to do next?

 

[karlsnooks]

# ************************************************************
# Zips up your log files from Windows Defender Offline
# and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# ************************************************************


# in the resulting PROGRAMS list, right-click on WINDOWS POWERSHELL |