Windows files broken after a series of unsolicited shutdowns

[Steve06]

Thanks. I think at this point I will go down route 2) to speed things up a bit. Some of the other software seems to be broken too, so I will reinstall / repair install it one by one where necessary.

I guess restoring from system restore points is not a viable alternative, is it?

Also, I'm looking to avoid such a mess in the future- do you think this was just caused from an uncontrolled power off or some virus, or something else?

Will do the repair install tomorrow and report back how this went.

 

[NoelDP]

I suspect that it's simply the machine power-cycling at the wrong time during the install of a batch of updates.

Having said that, check the disk using CHKDSK /R and see what it reports, and an offline virus scan never hurts

Good luck with the repair install!
http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

 

[Steve06]

Ok, is there a specific offline virus scanner / boot CD you would recommend?

 

[Golden]

Try this:
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

 

[NoelDP]

Windows Defender Offline
Avira Rescue disk
Emsisoft Emergency Kit

at a pinch...
ESET Online scanner

 

[Steve06]

Thanks, will try Win Defender Offline and Avira Rescue and report back. Almost done downloading Win 7 with SP 1 ISO for later repair install.

Just one question guys: Would you also consider upgrading to Windows 8 (either after the repair install or as a clean re-install)? I know it takes time to get used to it but have also read a lot of good things in terms of security and performance. I have it in a virtual machine on my Mac laptop and find it ok to use even though it certainly has a learning curve.

 

[Golden]

Mmm... its really a matter of personal preference. I tried it in the RC days but never could get used to it.

I recommend a visit to our sister forum and read a bit more to get a clearer picture:
Windows 8 Forums

 

[Steve06]

I have run Win Defender Offline & Avira Rescue CD and they found a few suspect files, essentially within archives, but nothing likely to have created this mess.

After trying to restart after completing the Avira full scan, though, the system hang had to be reset. Next time Windows loaded, it did not reach the user selection menu but restarted after a BSOD screen so fast that I could not read it. It remains this way every time I restart.

I do not seem to be able to collect the dump/log file with the message as the OS does not start anymore.

Windows proposes to start the system start repair tools but they do not find anything and propose to send the information to Microsoft, saying that the tool cannot repair the system start automatically. In the problem details, it indicates "corrupt volume".

This leads me to think that the Intel 520 SSD (with dreaded Sandforce controller) might be defective after all, even though the Intel SSD Toolbox confirmed that its firmware was up to date and that the drive is fine. This is particularly annoying since I was willing to pay the premium in order to get an expensive Intel SSD rather than a cheaper competitor.

I will next try the repair install. If the corruption remains or reappears, I will definitely move to a Samsung 840 or Plextor drive.

Of course I will file a RMA complaint with Intel, but I just can't afford to send in the drive and wait weeks for it to come back.

 

[VistaKing]

Steve06

Lets get started with this tool. It is much better than Windows Defender Offline

   Warning

You will need a USB FLASH DRIVE

   Tip

Download the Tool from a non infected PC or a WORKING PC

Download Farbar Recovery Scan Tool

Here :ar: Farbar Recovery Scan Tool Download

Click on the Download Now button that goes with your bit version

   Note

Click the Windows icon orb, and then right-click Computer .Select Properties .Look for System Type: which will say 32-bit Operating System or 64-bit Operating System

Plug the flash drive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:
Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

   Note

Replace letter e with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file
Please copy and paste both logs in your reply.(FRST.txt and Addition.txt)

 

[Steve06]

Ok, here it is.

 

[VistaKing]

Steve06

I do see something in the log . I will have to have someone come up with a fix for you

 

[Steve06]

Thanks. I'm very concerned with how things seem to keep getting worse. First my main user account was unusable, now I cannot even log onto any account.

I was also shocked to see that the command prompt in the system recovery options indicates more than 15GB of free space than, as if a big chunk of data had been swallowed.

EDIT: Are you sure there is a simple "fix" to that apart from a repair install or fresh re-install? When do you think you would have that?

UPDATE: Tried to run SSD Life (portable version) from the system recovery command prompt to have a second opinion on the SSD's health but it can't be started from there - seems to only work within Windows.

 

[VistaKing]

Lets see if we could fix the problem with Kaspersky rescue

:ar: How to create a bootable USB with Kaspersky Rescue and boot from it

:ar: How to Scan for Viruses with Kaspersky Rescue

 

[Steve06]

Ok, started in graphics mode and ran the updates. Now its scanning and will take about 2h, or so it says.

 

[VistaKing]

Ok let's see what Kaspersky locates . It's a much better rescue software than WDO .

 

[cottonball]

Steve06,

Looks like a few serious problems were pointed out earlier on this thread, and you mentioned a Windows 7 install, or possibly Windows 8.

You ran AntiVirus checks using: MSE, AVG Free, and Bitdefender Rescue CD, and nothing was detected.

There are some unusual entries in the FRST report, however, if you wish to pursue this route, you will need to run FRST once again and post its result after running the Kaspersky Rescue CD. Also, the FRST report had some garbled entries, apparently from a failed translation.

If the BitDefender Rescue CD found nothing, would be surprised if Kaspersky did, but, you never know.

At this point in time, the problem does not appear to be a malware issue.

 

[Steve06]

At this point in time, the problem does not appear to be a malware issue.

I agree. One hypothesis is that the SSD got defective, but these Intel SSDs are generally known to be very reliable drives. I did a Google search on "intel 520 ssd failure" and the most common problem seems to be that the drives are not recognized anymore on a SATA level - which is not the case her.

On the other hand, I have never seen such a sudden devastation in an earlier very well-functioning system.
The alternative hypothesis seems to be that a sudden power off (of unknown cause) destroyed all these system files - but then I don't understand how it got worse and worse (I can't even log onto Windows anymore) although there were no new unexpected shutdowns.

UPDATE: Kapersky finished and did not find anything special.

 

[Steve06]

It seems that now that I cannot boot into Windows anymore a repair install is not an option anymore.

At least when I boot from the Win 7 SP1 DVD and choose to upgrade I am asked to remove the disk and restart the computer to start setup from within Windows.

I have now been able to capture the BSOD that appears for not even a second by recording the boot process with my digital camera.

The BSOD has the following message:
"STOP: c000021a {Fatal system error}
The initial session process or system process terminated unexpectedly with a status of 0x00000000 (0xc0000001 0x00020f08).
The system has been shut down."

 

[cottonball]

Since there are some unusual entries in the FRST report, if you wish, you can run the following script. However, there is no guarantee that it will solve all the problems at hand, but, at this point...

On a clean computer, please open: Notepad
Copy/paste all the contents of the quote box below to Notepad (do not copy the word 'Quote').
Save it on the flash drive as: fixlist.txt

start
HKLM-x32\...\Winlogon: [Userinit] [x]
HKLM\...\Winlogon: [Shell] [x ] ()
HKLM-x32\...\Winlogon: [Shell] [x ] ()
HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!
Last Boot: 2013-05-05 01:35
end

WARNING: This script is written specifically for Steve06, for use on this particular computer.
Running the script on another computer may cause damage to the Operating System.

Now, in the infected computer, plug in the USB flash drive, and enter System Recovery Options as you did before.

Run FRST again, but this time press the Fix button just once, and wait.

When done, the tool makes a log on the flash drive. This time it is called: Fixlog.txt
Please post Fixlog.txt in your reply.

 

[Steve06]

Alright, here it is.

I'm currently building a BartPE CD in order to run SSDLife from it.