Problems after last week's Windows 7 update

[VirtualChrissy]

Hi all
everything OK until the weekend when after what appeared to be a less than satisfactory Windows update I can not use System Restore to go back to last week (main problem signature 6.1.7600.16385). I started the process because I was not hearing sound despite all drivers etc being in place and working properly. I also can not get the wireless card to communicate with the router now (although I still have access with the wired desktop). I ran a CHKDSK /r overnight (results attached). I am naturally wondering if it is either a system corrupt or a virus (my suspicions were aroused here when a malwarebytes AV scan kept stopping after a few seconds in safe mode). Obviously there is a recommended list of workarounds for this but I would appreciate what the current line of thinking on this was? speccy profile below followed by edited extract (for space limitations) minitoolbox output as well as the appropriate attachments (NB CBS.zip too big to attach)

many thanks!

http://speccy.pirifo...4vWvrRyDdsxsEut

MiniToolBox by Farbar Version: 25-07-2015 01
Ran by Chris (administrator) on 28-10-2015 at 18:28:01
Running from "C:\Users\Chris\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Model: Dell System Inspiron N7110 Manufacturer: Dell Inc.
Boot Mode: Normal
***************************************************************************
========================= Event log errors: ===============================
Application errors:
==================
Error: (10/28/2015 05:30:33 PM) (Source: CVHSVC) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: There are currently no active network connections. Background Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error: (10/28/2015 05:22:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
Error: (10/28/2015 05:22:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
Error: (10/28/2015 05:19:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/28/2015 05:42:13 AM) (Source: AdvancedSystemCareService8) (User: )
Description: The interface is unknown
Error: (10/28/2015 05:42:13 AM) (Source: AdvancedSystemCareService8) (User: )
Description: The handle is invalid
Error: (10/28/2015 12:32:33 AM) (Source: CVHSVC) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: There are currently no active network connections. Background Intelligent Transfer Service (BITS) will try again when an adapter is connected.
Error: (10/28/2015 12:25:36 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
Error: (10/28/2015 12:25:36 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
Error: (10/28/2015 12:22:15 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (10/28/2015 05:45:42 PM) (Source: Service Control Manager) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.
Error: (10/28/2015 05:23:14 PM) (Source: Service Control Manager) (User: )
Description: The Dell Data Vault Wizard service failed to start due to the following error:
%%3
Error: (10/28/2015 05:22:38 PM) (Source: Service Control Manager) (User: )
Description: The Dell Update Service service failed to start due to the following error:
%%3
Error: (10/28/2015 05:22:34 PM) (Source: Service Control Manager) (User: )
Description: The Dell Data Vault Wizard service failed to start due to the following error:
%%3
Error: (10/28/2015 05:20:05 PM) (Source: BTHUSB) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
Error: (10/28/2015 05:18:57 PM) (Source: BTHUSB) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
Error: (10/28/2015 05:18:40 PM) (Source: Service Control Manager) (User: )
Description: The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error:
%%1058
Error: (10/28/2015 05:17:50 PM) (Source: BTHUSB) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
Error: (10/28/2015 12:27:56 AM) (Source: Service Control Manager) (User: )
Description: The Dell Data Vault Wizard service failed to start due to the following error:
%%3
Error: (10/28/2015 12:27:12 AM) (Source: Service Control Manager) (User: )
Description: The UPnP Device Host service depends on the SSDP Discovery service which failed to start because of the following error:
%%0

Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2012-06-01 23:20:50.954
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 17:31:16.116
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 17:03:17.092
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 13:55:15.214
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 13:28:28.500
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 10:27:13.095
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 09:54:34.705
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-06-01 00:18:31.962
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-05-31 23:18:20.124
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.
Date: 2012-05-31 22:57:22.127
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.


========================= Memory info: ===================================
Percentage of memory in use: 49%
Total physical RAM: 3990.17 MB
Available physical RAM: 2032.86 MB
Total Virtual: 7978.54 MB
Available Virtual: 5612.91 MB
========================= Partitions: =====================================
1 Drive c: (OS) (Fixed) (Total:446.13 GB) (Free:56.24 GB) NTFS
2 Drive d: (RESOURCE_CD) (CDROM) (Total:1.69 GB) (Free:0 GB) UDF
3 Drive e: () (Removable) (Total:0.93 GB) (Free:0.92 GB) FAT
========================= Users: ========================================
User accounts for \\CHRIS-LAPTPQ17R
Administrator Chris Guest

**** End of log ****

 

[noshadchaudhry]

General Advice: If you suspect Windows Update is a factor in your problem see this from the Windows7Forums moderators.
Windows Update Specific to Each User http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html


Specific Advice:

You should disconnect your computer from the Network, or the virus could download other viruses.
Do not download anything that has a chance of having a virus.

(1) I know you think a virus is the problem, but try using Startup Repair from the boot menu or your Windows DVD, its more in depth then SFC.exe.
The Microsoft article below, although applying to Vista recommends using Startup repair when System Files validation fails.
I'm not sure if Startup Repair will work on Microsoft Office files, but in any case should reinstall Microsoft Office after backup up personal files.

References You can use:
Event ID 3002 — User-mode Protected Media Path File Validation https://technet.microsoft.com/en-us/library/cc734001(v=ws.10).aspx
Startup Repair Walkthru: Troubleshoot Startup Problems with Startup Repair Tool in Windows 7 & Vista


(2) Run a different Anti-Virus solution that won't itself have a virus and get Microsoft System Internals tools.
Microsoft Safety Scanner. Microsoft Safety Scanner - Free Virus Scan with the Microsoft Safety Scanner
Windows Defender Offline https://blogs.microsoft.com/cybertr...free-security-tools-windows-defender-offline/
Microsoft System Internals Tools https://technet.microsoft.com/en-us/sysinternals/bb545021.aspx
Anti-Virus Article What to do if your antivirus software stops working

You can use System Internals Tools ProcExp.exe to help track what Apps, Processes, Images .dll are running.
If something is suspicious then Kill the process. What happens though is the virus restarts itself. In Process Explorer you can see this because
everytime a new process starts up it shows up in a color in the UI of the Application. So this tool is really helpful in finding what is a Virus.

To remedy the fact that a virus restarts itself is easy you just have to uninstall it. If the uninstaller doesn't work or there isn't one you have
to delete the files and registry entries.
This is another reason to use ProcExp.exe. You will be able to find in depth information to help you delete registry entries.

 

[MoxieMomma]

Hi:

Is this the same computer as the one HERE and HERE?

If so, it can be confusing, counter-productive, inefficient and sometimes dangerous/damaging to work on the same computer problem simultaneously in multiple venues.
I suggest sticking with ONE place to get help for your issue.

<just a suggestion>

Cheers,

 

[Layback Bear]

A very good suggestion.

To many cooks in the kitchen. Left hand doesn't know what the right hand is doing sort of thing.

One thread on one forum on one computer problem at one time.