Windows 7 wont start to user profile after MSE update of 3 April

[Racehunter]

Hi,

I haven't posted for a while now as everything had been running great, however I now have a problem.

My PC installed an update on shutdown yesterday morning, but when I came to boot it up again a little later, it seemed OK up to the screen with the user profile icons. When I clicked on my icon to log in, all the icons disappeared and I was left with the background only. Rebooted a couple of times, but still the same (apart from sometimes I got to enter my password and then it just 'hung'), so at the next start up booted to safe mode with networking.

From here I was able to go to system restore and noted that the problematic download was an update for MSE (it actually said MSE 4.4.304.0), so a restore to before that event enabled normal start up. The trouble is that at the next shut down/reboot cycle, it re-installed the MSE update and I was back to carrying out a restore. This is the cycle I am now in and need to fix it! I have even removed MSE and re-installed with the latest updates as part of that process, but this little 'important update' keeps coming back to play!

I have not yet followed the 'Windows Update Posting Instructions' to find error codes as I assumed these might not be there with my continual restore actions.

As always, any help would be appreciated in solving this frustrating problem.

Steve

 

[Ranger4]

MSE update 4.4.304.0 was installed on my computer on 13 Nov. 2013. The latest MSE update I have is 4.5.216.0 which was installed on 26 March 2014.
You could try uninstalling MSE & then download another copy from Microsoft & reinstall it. After uninstalling reboot your computer as it seems to help clearing the uninstall.
After reinstalling a lot of updates will get installed so hopefully it does not end up with the same problem as before.

 

[Racehunter]

Well, it now shows that the update is 4.5.216.0, so don't quite know why the earlier one was showing up!

Anyway, I have tried uninstalling MSE, rebooting, reinstalling and updating via MSE, but every-time I restart the PC, it stalls ether at the log on screen or just after logging on. Then I am back to restoring to an earier time in 'safe' mode. Pretty frustrating scenario

 

[NoelDP]

This sounds as if you may have a bad rootkit infection.
I suggest that you download (on a known-clean machine) the full What is Windows Defender Offline? and run the tester - once complete, follow any instructions, then reboot and re-download and reinstall MSE.

 

[Racehunter]

Thanks, I will give that a try, although if it is a rootkit infection, why does carrying out a restore to an earlier point, make the PC usable again (until switched off)?

 

[NoelDP]

... because it removes the active infection source until the system reinfects itself again by other means (supposition!)

 

[Racehunter]

Ran defender (twice) and it found no problem. Uninstalled MSE again, re-installed, updated through the programme and still, when I shutdown, and reboot, it hangs either after entering the logon details, or the user icons disappear when clicked on. Have to restore every time. I have downloaded the SURT and it seemed to install (talked of update hotfix?) and still I have the problem. This really does seem to be linked to MSE as after removing it, then rebooting, all is well, until I re-install MSE again.

Suggestions please?

 

[Racehunter]

Latest Update

I have now run the sfc/scannow command and collected the logs before restarting the PC. This time it restarted normally, but I don't know if this is a result of scannow operation or just luck. I have attached the sfc specific log for information. I did try to attach the full CBS.zip log file but at 12.4MB, it was not possible!

If anyone is able to look at the log and feed back any observations that would be very useful in my journey down the road of Win 7 discovery

Steve

 

[NoelDP]

The critical part of the SFC is this...

2014-04-07 14:15:43, Info                  CSI    00000307 [SR] Repairing 2 components
2014-04-07 14:15:43, Info                  CSI    00000308 [SR] Beginning Verify and Repair transaction
2014-04-07 14:15:43, Info                  CSI    00000309 [SR] Repairing corrupted file [ml:70{35},l:68{34}]"\??\C:\Windows\SysWOW64\wbem\en-US"\[l:24{12}]"aaclient.mfl" from store
2014-04-07 14:15:43, Info                  CSI    0000030a [SR] Repairing corrupted file [ml:70{35},l:68{34}]"\??\C:\Windows\system32\wbem\en-US"\[l:24{12}]"aaclient.mfl" from store

... why it's double-up like that, I'm not sure - the file appears also to have occurred twice in the earlier parts of the log.

Please post the complete CBS.log file and CheckSUR.log file (both in the C:\Windows\logs\CBS folder) - you'll have to copy the CBS.log file to your desktop before you can compress it for upload (it can be rather too large, otherwise!)

 

[Racehunter]

Here they are!

 

[NoelDP]

You had a couple of errors in the SFC scan, which it appears to have fixed (as I said before).
CheckSUR was clear.

I can see no other significant errors in the logs - there are a number of anomalies there, however, which we would normally ignore, but may be relevant here.


Before I go off on a tangent on this, however, I'd rather check a few things,
What currently happens on the reboot?
Have you ever used any form of registry cleaner on this machine?
What other Anti-virus programs have ever been installed?

I've had a couple of problems with recent engine updates for MSE myself - although I couldn't localise and prove them, they went away with a slightly later update, so I tend to sympathise with the idea

 

[Racehunter]

Hi Noel,

Start up now performs as it should, so it would seem that the registry repairs seemed to work. To answer your other questions, since doing a full wipe of the drives some 18 months ago, I have never used anything other than MSE and have never used a registry cleaner. Fingers crossed all is now well (until the next update )

 

[NoelDP]

See how it copes with today's updates, and let me know