Windows files broken after a series of unsolicited shutdowns

[VistaKing]

After running the fix are you able to login to windows ?

 

[Steve06]

Yes it does! You're (EDIT: I mean "cottonball is") a genius.
So now I can go log back to my secondary account (main account is still black) and run SSDLife directly as well as a repair install if we do not find another solution.

 

[VistaKing]

What do you mean its still black ? No icons on the main user account ?

I'm not the genius that goes to Cottonball who created the fix .

 

[Steve06]

Yes, nothing to do in the main user account except move the mouse cursor or hit Ctrl-Alt-Del to log out of it or start the task manager. Windows key does not open the Start menu.

However, I can now start the second user account on the machine again - logging in had become impossible after running Kapersky for reasons I ignore.

Here's now the feedback from SSDLife attached. The drive has 100% health and 8 years in front of it, according to the tool. This is in line with the result from the Intel SSD Toolbox.

I'm going to sleep now and will resume tomorrow, probably by performing a repair install, in absence of a better suggestion.

Thanks to all contributors to this thread who have followed me so far.

 

[VistaKing]

When you open the task manager what Processes are running ?

 

[Steve06]

Here come two smartphone pictures of the process list of the main (unusable) account (couldn't use the snipping tool). No applications appear in the application tab.

Any suggestions before I proceed to the repair install, anyone?

 

[VistaKing]

Steve06

I don't see explorer inside the Task Manager . Or I'm blind

Lets see something .

Can you open up the task manager in the account . Click on File -> New Task(Run…) type in explorer.exe in the Create New Task window . Then click on the OK button .

If that doesn't work

From the task manager click on File -> New Task(Run…) type REGEDIT and click on OK

Inside the registry navigate to

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Get a scrnshot of that .

 

[NoelDP]

,,,or even run the command

REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

and post the results (save bandwidth! )

 

[Steve06]

@Vistaking:
I can confirm that explorer.exe is not loaded by default. When I start it as a new task, it appears in the process list for a few seconds and then disappears again.
The registry entry you mention contains indeed "explorer.exe".
So there must be something forcing the explorer to quit.

@Noel: When I type this into New Task dialog there's a command prompt window appearing for only a couple of milliseconds. Can't read it, sorry.

 

[cipley]

@Vistaking:
I can confirm that explorer.exe is not loaded by default. When I start it as a new task, it appears in the process list for a few seconds and then disappears again.
The registry entry you mention contains indeed "explorer.exe".
So there must be something forcing the explorer to quit.

@Noel: When I type this into New Task dialog there's a command prompt window appearing for only a couple of milliseconds. Can't read it, sorry.

...seems like it also affected the USER registry
you can try the steps from here: Troubleshooting Explorer.exe Crashing Issues

 

[NoelDP]

open the command prompt window first....

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[cipley]

open the command prompt window first....

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

As the explorer.exe did not start at all, there won't be any start button though
Can run via task manager, though. File > New Task (Run...) > type "cmd" (without quotes) then hit Enter/click OK

the rest is as Noel posted

@NoelDP
sorry for barging in. Cheers

 

[NoelDP]

Those commands can be run from any account - the HKLM hive is a global one.

 

[cipley]

Those commands can be run from any account - the HKLM hive is a global one.

ah yes...HKCU isn't. my bad

 

[Steve06]

Ok here it comes (executed from secondary account since it does not matter ):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    Userinit    REG_SZ    C:\Windows\system32\userinit.exe,
    VMApplet    REG_SZ    SystemPropertiesPerformance.exe /pagefile
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ
    LegalNoticeText    REG_SZ
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    ShutdownWithoutLogon    REG_SZ    0
    WinStationsDisabled    REG_SZ    0
    DisableCAD    REG_DWORD    0x1
    scremoveoption    REG_SZ    0
    ShutdownFlags    REG_DWORD    0x27
    AutoAdminLogon    REG_SZ    0
    DefaultUserName    REG_SZ    Fred
    DefaultDomainName    REG_SZ    FREDCUBE
    ForceAutoLogon    REG_SZ    0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExten
sions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLog
onChecked

EDIT: However, thinking again about it, I suspect the exercise might not reveal a lot since given that these entries are global and that they obviously DO work well for the secondary account (otherwise I could not work with it), the issue of the explorer.exe failing to load (or to remain loaded) within the secondary account might not have to do with these global entries.

 

[NoelDP]

There's a couple of odd values here.

1) ShutdownFlags REG_DWORD 0x27
2) DefaultUserName REG_SZ Fred
DefaultDomainName REG_SZ FREDCUBE

The first indicates some kind of problem on shutdown (I'll have to research that)
The two names don't normally exist in a system unless it's connected to a Domain server, so far as I know - is this the case here?

Please run the following commands, and post the results.

NET USER
NET LocalGroup Administrators

 

[Steve06]

2) This is the username of the main user account (the one with the black screen) and the second is the network name of the computer. The computer is included in a small home network, nothing special.

The net user command just lists all user accounts and the second command terminates with system error 1376 and saying that this local group does not exist.

 

[cipley]

Ok here it comes (executed from secondary account since it does not matter ):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    Userinit    REG_SZ    C:\Windows\system32\userinit.exe,
    VMApplet    REG_SZ    SystemPropertiesPerformance.exe /pagefile
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ
    LegalNoticeText    REG_SZ
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    ShutdownWithoutLogon    REG_SZ    0
    WinStationsDisabled    REG_SZ    0
    DisableCAD    REG_DWORD    0x1
    scremoveoption    REG_SZ    0
    ShutdownFlags    REG_DWORD    0x27
    AutoAdminLogon    REG_SZ    0
    DefaultUserName    REG_SZ    Fred
    DefaultDomainName    REG_SZ    FREDCUBE
    ForceAutoLogon    REG_SZ    0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExten
sions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLog
onChecked

EDIT: However, thinking again about it, I suspect the exercise might not reveal a lot since given that these entries are global and that they obviously DO work well for the secondary account (otherwise I could not work with it), the issue of the explorer.exe failing to load (or to remain loaded) within the secondary account might not have to do with these global entries.

can you open Event Viewer from the primary account?
from task manager File > New Task (Run...) > eventvwr > enter/ok
go to Windows Logs > Application, and see if there is any error log regarding explorer.exe
it might help to narrow down the problem scope

also, can you do REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" just like Noel asked before?
this time, in the primary account.
this will bring up list of program that will be automatically run when the user log in. One of them might be causing the explorer.exe to crash...

 

[NoelDP]

,, You can ignore the ShutdownFlags value - that's normal

 

[NoelDP]

2)
The net user command just lists all user accounts and the second command terminates with system error 1376 and saying that this local group does not exist.

There's your problem then!
The question then becomes how to recreate that group without access to the registry.
VK - any ideas??