Series of BSODs now can't boot even in safe mode

[pgoughy]

I was getting recurring BSOD errors and now my computer won't boot at all, not even in safe mode.

I've tried heaps of stuff to fix it using bootrec, chkdsk and sfc (which doesn't work because it says there is a system repair pending). System repair does nothing. For some reason there is no restore points even though I should have some.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.01.2018
Ran by SYSTEM on MININT-P7VAE9T (14-02-2018 13:23:21)
Running from G:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
ATTENTION: Could not load system hive.
ERROR: The system has attempted to load or restore a file into the registry, but the specified file is not in a registry file format.

Here is the Farbar report if any of you use that

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-03] ()
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2018-01-04] ()
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18381792 2017-11-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3567936 2018-02-08] ()
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [5783328 2017-09-18] (IObit)
HKLM\...\Winlogon: [Shell] explorer.exe [3229696 2016-08-29] ()
HKLM-x32\...\Winlogon: [Shell] explorer.exe [2972672 2016-08-29] ()
HKLM\...\InprocServer32: [Default-wbemess] <==== ATTENTION
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] <==== ATTENTION
HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI] <==== ATTENTION
HKU\Default\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] ()
HKU\Default User\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] ()

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-14 13:22 - 2018-02-14 13:23 - 000000000 ____D C:\FRST
2018-02-13 21:16 - 2018-02-13 21:16 - 000024576 _____ C:\bcdbackup
2018-02-10 21:35 - 2018-02-10 21:35 - 000003624 ____N C:\bootsqm.dat
2018-01-28 21:55 - 2018-01-28 21:55 - 000000000 ____H C:\asc_rdflag

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-11 22:31 - 2016-10-01 22:19 - 000000000 ____D C:\Users\Philip Gough\Documents\Outlook Files
2018-02-11 22:31 - 2016-09-30 17:07 - 000000920 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2018-02-11 22:30 - 2016-10-01 01:16 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\qBittorrent
2018-02-11 22:22 - 2016-10-11 22:27 - 000000000 ____D C:\Program Files (x86)\Opera
2018-02-11 22:18 - 2016-09-30 17:07 - 000000916 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2018-02-11 22:17 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-11 22:16 - 2017-06-03 03:37 - 000000000 ____D C:\Program Files\TAP-Windows
2018-02-11 22:16 - 2016-11-16 06:14 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-02-11 22:16 - 2016-10-03 18:07 - 000000000 ____D C:\Users\Philip Gough\AppData\Local\HP
2018-02-11 22:16 - 2016-10-02 18:14 - 000000000 ____D C:\Program Files\Gramblr
2018-02-11 22:16 - 2016-10-01 07:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-11 22:16 - 2016-09-30 17:25 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\MyPhoneExplorer
2018-02-11 22:16 - 2016-09-30 17:07 - 000000000 ____D C:\Program Files (x86)\Dropbox
2018-02-11 22:16 - 2016-09-30 02:49 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\ProductData
2018-02-11 22:16 - 2016-09-30 02:44 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\vlc
2018-02-11 22:16 - 2016-09-30 02:12 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\IObit
2018-02-11 22:16 - 2016-09-30 02:12 - 000000000 ____D C:\Users\Philip Gough\AppData\LocalLow\IObit
2018-02-08 05:00 - 2016-11-21 00:57 - 000000000 ____D C:\Users\Philip Gough\AppData\LocalLow\Mozilla
2018-02-07 02:35 - 2016-10-30 13:31 - 000000000 ____D C:\Users\Philip Gough\AppData\Local\CrashDumps
2018-02-06 07:29 - 2016-09-30 02:14 - 000002190 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-02-04 21:58 - 2017-11-22 05:31 - 000002269 _____ C:\Users\Public\Desktop\Advanced SystemCare 11.lnk
2018-01-28 21:55 - 2016-12-06 22:27 - 088207360 _____ C:\Windows\System32\config\SOFTWARE.iodefrag.bak
2018-01-28 21:55 - 2016-12-06 22:27 - 000266240 _____ C:\Windows\System32\config\DEFAULT.iodefrag.bak
2018-01-28 21:55 - 2016-12-06 22:27 - 000024576 _____ C:\Windows\System32\config\SECURITY.iodefrag.bak
2018-01-28 21:55 - 2016-12-06 22:27 - 000024576 _____ C:\Windows\System32\config\SAM.iodefrag.bak
2018-01-24 01:26 - 2017-12-17 22:40 - 000000000 ____D C:\Users\Philip Gough\AppData\Roaming\DVDVideoSoft
2018-01-18 21:09 - 2016-09-30 02:49 - 000000333 _____ C:\users\Philip
2018-01-18 21:09 - 2016-09-30 02:12 - 000002274 _____ C:\Users\Public\Desktop\Driver Booster 4.lnk

==================== Known DLLs (Whitelisted) =========================


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe
[2016-10-11 19:36] - [2016-08-29 06:55] - 002972672 _____ (Microsoft Corporation) 4B9F2F4AF9A3B4B68A07F7ABAC74DEC0

C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION
C:\Windows\System32\services.exe IS MISSING <==== ATTENTION
C:\Windows\System32\User32.dll
[2016-12-14 01:39] - [2016-11-10 08:32] - 001009152 _____ () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\User32.dll => D41D8CD98F00B204E9800998ECF8427E (0-byte MD5) <==== ATTENTION
C:\Windows\SysWOW64\User32.dll
[2016-12-14 01:39] - [2016-11-10 08:19] - 000833024 _____ () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\SysWOW64\User32.dll => D41D8CD98F00B204E9800998ECF8427E (0-byte MD5) <==== ATTENTION
C:\Windows\System32\userinit.exe
[2010-11-20 19:24] - [2010-11-20 19:24] - 000030720 _____ (Microsoft Corporation) D41D8CD98F00B204E9800998ECF8427E

C:\Windows\SysWOW64\userinit.exe
[] - [] - 000000000 _____ () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\SysWOW64\userinit.exe => D41D8CD98F00B204E9800998ECF8427E (0-byte MD5) <==== ATTENTION
C:\Windows\System32\rpcss.dll IS MISSING <==== ATTENTION
C:\Windows\System32\dnsapi.dll IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\dnsapi.dll IS MISSING <==== ATTENTION
C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION
C:\Windows\System32\codeintegrity\Bootcat.cache IS MISSING <==== ATTENTION
C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION

==================== Association (Whitelisted) =============


==================== Restore Points =========================


==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 8152.92 MB
Available physical RAM: 7538.92 MB
Total Virtual: 8151.12 MB
Available Virtual: 7525.34 MB

==================== Drives ================================

Drive e: (Windows_7_Home_P_64_Bit) (CDROM) (Total:2.96 GB) (Free:0 GB) UDF
Drive f: (Windows_7_Home_P_64_Bit) (Removable) (Total:14.93 GB) (Free:11.87 GB) NTFS
Drive g: () (Removable) (Total:14.54 GB) (Free:14.53 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Files) (Fixed) (Total:2048 GB) (Free:0 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: E16B9613)
Partition 1: (Active) - (Size=2048 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 14.9 GB) (Disk ID: 0BB85321)
Partition 1: (Active) - (Size=14.9 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 14.6 GB) (Disk ID: 0186C971)
Partition 1: (Active) - (Size=14.6 GB) - (Type=0C)

==================== End of FRST.txt ============================

 

[mrjimphelps]

Go to another computer and create a Linux install DVD (or a Linux install flash drive). You can go to the following web site and choose one of the links:
https://linuxmint.com/download.php

Now go to the problematic computer, put the DVD into the drive (or plug in the flash drive), and see if you can boot into Linux. Nothing will be installed on your computer when you do this; you will be running Linux entirely from the boot disk / flash drive.

If you can work normally in Linux, then there is no hardware issue with your computer. If your computer has any hardware issues, they will show up in Linux as well as in Windows.

If there are no hardware issues, then you will either need to do a reinstall of Windows or perhaps get a new hard drive. One (or both) of those is the problem.

To see if the hard drive is the problem, try installing Windows to it. If this solves the problems, then it wasn't the hard drive. But before you install Windows, I suggest that you disconnect all drives (including all flash drives) except for the one you want to install Windows to. Then after you have installed Windows, you can reconnect all drives.

 

[torchwood]

Hi phil,

there is something seriously wrong with the current state of your computer set up,
im not just talking about W7 - WHAT is your current set-up
(dont believe its a hardware problem)

note
Allthough many decry the use of Iobit programs it certainly would NOT cause the problems being reported in the Farbar, (FRST) reports

There are too many missing core files, which it does not change/remove
It also reports that it (Farbar) was run on the "G" recovery drive also unusuall
WHAT HAVE YOU BEEN DOING TO YOUR HIVES
You've actually caused even more problems
as well as 3 Active partitions - way wrong
you also have a problem with your VPN's
and have boot files on your X & Y drives

Even following mrjimphelps advice, very good actually, I do not believe it will resolve your problemS

Back soon checking something

Please Update your system specs make/Model etc
I also NEED to know if your dual booting in any way

When SIW2 provided the repair install link how did you do it - Repair of clean install


Roy

 

[mrjimphelps]

If he has that much missing/wrong with his Windows setup, sounds like he needs to wipe everything clean, then do a clean install of Windows.

 

[torchwood]

mrjimphelps
Very True

but we also need to know if its a Dual boot set-up causing the problem


Roy

 

[pgoughy]

I've actually managed to seemingly resolve this. I disconnected my SATA drive and then repaired the SSD using bootsect. I also replaced the components, sam, security, software, system and default files using backups.

I then plugged in the SATA drive and everything seems to be working fine.

I am not using a dual boot system. I haven't done anything to the hives.

What problems do I have?

I have 2x4GB DDR3 RAM cards, 3rd generation i5, 2b graphics, 240GB SSD, 3TB SATA but the motherboard only detects 2TB, it's an ASRock Motherboard (not sure what model).

should I run another scan?

 

[torchwood]

Hi Phil,

based on your reply there were 3 distinct problems
BIOS - BOOT - HIVES ( =components, sam -security - software -system - default)
Which you fixed

Looks like it was tying itself up in knots.

No need to post any further logs unless you start getting more BSOD's

not sure why its only identiying 2TB's, possibly a really old Motherboard thats only 2TB capable

If you want to dig into your system specs try
Hwinfo or Belarc

Roy

 

[pgoughy]

I just had anothe BSOD (7A) relating to ntfs.sys and now it won't bood again. The BIOS and WRE are not detecting my SSD again. What could be causing that? The way I resolved this last time was by unplugging the SATA drive then booting in the WRE which was now allowing me to access the SSD. Then I ran a Bootsect command and got it working. I am having problems with memory shortaged btw.

 

[mrjimphelps]

Here is a post which deals with the issue you are seeing:

Regular BSOD , ntfs.sys common

In this user's case, there was a bad memory stick. However, some other users have reported the following:

Related to ctac32k.sys Creative AC3 SW Decoder Device Driver (WDM) from Creative Technology.

 

[axe0]

Drive not being detected is commonly due to a bad drive, bad cable or with bad luck a bad port.

 

[pgoughy]

I disconnected the SATA drive again which allowed me to access to the SSD via Windows Recovery Environment. I then ran a system restore but now it's just loading up to a black screen and mouse (before it reaches the login screen). I can boot in safe mode, just not sure where to go from here.

 

[axe0]

Easiest option would be to reinstall Windows, but you'll lose everything on the disk if you can't boot in normal mode.

Could you run sfc /scannow from an admin command prompt in safe mode.

 

[pgoughy]

I got it working again. We'll see how long for.

 

[axe0]

I would recommend a repair install, or at least a SFC scan.

 

[pgoughy]

Now I am getting a disk read error on boot and CHKDSK tells me my drive is RAW

 

[axe0]

Either the drive itself or the motherboard is going bad, or both, I suspect. Both are best tested through replacement.

 

[pgoughy]

Well, I waa trying to enter windows recovery environment via USB and it would often juat load to a cursor or not load advanced recovery options. Could that insicate motherboard?

 

[axe0]

With everything else included, yes.

 

[pgoughy]

I used memtest86 and got 4 passes, I also downloaded crystaldiskinfo that said my SSD was 93% good. Often when I get a BSOD my BIOS will stop recognising the SSD and I have to unplug the storage drive to get the SSD working. I am usually able to get it working again temporarily but BSODs end up coming back (7A seems to be the most common). I am trying to work out what I will need done before I sent it off to a technician because I don't have a lot of money.

 

[axe0]

The recommended minimum passes is 8 with the memory test.