Windows Security Center won't turn on

[Kaktussoft]

After doing to copy *.* .. it says Overwrite... \default, yes, no or all. Yes?

Overwrite them ALL

 

[Jackie1]

dism /image:D:\ /get-packages |more

What has been installed last few days? Which one are pending?

how do I make that |more character??? The "|"

Also, I found a dism log file in windows/logs? Want me to attach?

 

[Kaktussoft]

It's on your keyboard. On mine it's above the \ sign.
Maybe better:

dism /image:D:\ /get-packages >d:\package.txt

Put file d:\package.txt on usb stick and post it here

 

[Kaktussoft]

After post #58.... sfc /scannow /offbootdir=d:\ /offwindir=d:\windows still same problem?

 

[Jackie1]

It's on your keyboard. On mine it's above the \ sign.
Maybe better:

dism /image:D:\ /get-packages >d:\package.txt

Put file d:\package.txt on usb stick and post it here

I couldn't get that command to work, but I copied windows/logs/dism/dism.log, hope this is same thing? Also, I haven't rebooted yet. DISM.LOG below

 

[Jackie1]

It's on your keyboard. On mine it's above the \ sign.
Maybe better:

dism /image:D:\ /get-packages >d:\package.txt

Put file d:\package.txt on usb stick and post it here

Ok, got that command you said to work, here is packages.txt

 

[gregrocker]

Jackie -

There must have been a hundred times before where I have stepped back to watch files attempting to be repaired sometimes for days in an HP Factory Preinstalled Win7 and there is nothing that is ever done to resolve it other than breaking free of the corrupt bloatware to do a Clean Reinstall - Factory OEM Windows 7.

In this case it's due to serious infection that may not even be cleaned up yet, which must be done first anyway before files can be repaired.

Even if you cleaned up the infection and miraculously repaired all the files to get back to what you had before, with HP that's the worst possible install of Win7 one can have. Why not invest the same amount of time now in getting a perfect install to experience for the first time native Window 7 performance?

 

[Jackie1]

After post #58.... sfc /scannow /offbootdir=d:\ /offwindir=d:\windows still same problem?

When I do that I get... see below. I don't know if I'm doing something wrong... That what I'm going screenshots. Please read carefully and see if I did commands correctly

 

[Kaktussoft]

you did offboodir+ instead of offbootdir=


The packagelist didn't show any relevant info. As Greg said.... heavily corrupt system. Backup inmportant files and do a clean install

 

[Jackie1]

When you get done with Kactussoft and gregrocker, please do the following:

RogueKiller did not identify malware, so let's press on with FRST64, and run another fix.

Please open notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the code box below (Do not copy the word 'code') to Notepad.
Save it to the pen drive where FRST64 is located, and name it: fixlist.txt

[COLOR=black]start[/COLOR]
[COLOR=black]S2 WindowsSVC; C:\Windows\SysWOW64\winthemes.dll [151552 2014-04-11] ()[/COLOR]
[COLOR=black]2014-04-11 06:40 - 2014-04-11 06:40 - 00151552 _____ () C:\Windows\SysWOW64\winthemes.dll[/COLOR]
[COLOR=black]2014-04-11 06:40 - 2014-04-11 06:40 - 00062464 _____ () C:\Windows\SysWOW64\common2.dat[/COLOR]
[COLOR=black]2014-04-11 06:40 - 2014-04-11 06:40 - 00062464 _____ () C:\Windows\SysWOW64\common1.dat[/COLOR]
[COLOR=black]DisableService: MsMpSvc[/COLOR]
[COLOR=black]DisableService: NisSrv[/COLOR]
[COLOR=black]DisableService: MpFilter[/COLOR]
[COLOR=black]DisableService: NisDrv[/COLOR]
[COLOR=black]DisableService: MpNWMon[/COLOR]
[COLOR=black]HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)[/COLOR]
[COLOR=black]end[/COLOR]

NOTICE: This script is written specifically for this computer!!!
Running this on another computer may cause damage to the Operating System.


Now, with the pen drive( containing FRST64 and fixlist) connected, restart the computer, and once again enter System Recovery Options and select: Command Prompt

Get to FRST, as you did before, and press the Fix button, just once, and wait.


When done, the tool creates a report on the pen drive called: Fixlog.txt


Please post the Fixlog.txt in your reply.


Let us know if the computer boots to Windows.

Did it. This time is gave me options to do safe mode, or "start windows normally. I chose "start windows normally" same result. Black screen with pointer.

 

[gregrocker]

Does it offer Startup Repair? Accept it.

If it's Safe Mode then will it enter Safe Mode?

If you reboot and tap the F8 key vigorously, will it offer Repair My Computer? Try several times.

If repair is offered, accept and reboot. If not or it still won't start, reboot into Repair to open a Command Line to confirm Partition Marked Active is System REserved (preferred) or C, then run Startup Repair - Run 3 Separate Times.

Remember that it may not repair or start if not fully cleaned up so you'll want to complete the clean up with Cottonball as soon as he gets online.

 

[Jackie1]

f8 got me startup repair, but says couldn't detect any problems. Safe mode just goes to black screen with pointer after it loads files... That fix I applied... Is it lost everytime I reboot?

 

[gregrocker]

Will it enter Safe Mode?

Try System Restore from the F8 System Recovery Options.

Remember that it may not repair or start if not fully disinfected up so you'll want to complete the clean up with Cottonball as soon as he gets online.

Did you run SFC /SCANNOW Run in Command Prompt at Boot
at least three times?

Did you run Startup Repair - Run 3 Separate Times?

 

[Jackie1]

It says no restore points still... I don't want to give up.

 

[Jackie1]

I have a small rant... When I had windows Xp, there was a boot disk you could burn called "Roadstarter boot cd". This thing would boot any pc, pre windows 7. What the heck doesn't something like this exist for win 7.

 

[Jackie1]

Does it offer Startup Repair? Accept it.

If it's Safe Mode then will it enter Safe Mode?

If you reboot and tap the F8 key vigorously, will it offer Repair My Computer? Try several times.

If repair is offered, accept and reboot. If not or it still won't start, reboot into Repair to open a Command Line to confirm Partition Marked Active is System REserved (preferred) or C, then run Startup Repair - Run 3 Separate Times.

Remember that it may not repair or start if not fully cleaned up so you'll want to complete the clean up with Cottonball as soon as he gets online.

I just saw this now.. I followed the Partition Marked Active link and followed instructions for cmd prompt. I made "partition 3" active, that's the one with the most space left and where windows in installed. That's the one you I was to select, yes? same issue after reboot, black screen mouse pointer

I ran startup repair 3 times after hitting F8, even though it says everytime that it "couldn't detect a problem"

 

[gregrocker]

First Try System Restore from the System Recovery Options. Use the disk if required.

Do you have the 100mb System REserved partition which as I wrote is preferred to be marked Active. If so you should try it first?

In some HP's the Recovery partition could also be the partition marked Active. Did you note which one was already marked Active?

If not then mark each one Active and try 3 separate Startup REpairs to see if it will start.

 

[Jacee]

This item S2 WindowsSVC; C:\Windows\SysWOW64\winthemes.dll is a part of the Win32/Sefnit family of trojans. It can give a malicious hacker access to your PC, download files, and use your PC and Internet connection for click fraud.
It can also use your PC to mine Litecoins.
This type of threat can be downloaded by other malware, or bundled with other software and downloaded through peer-to-peer file sharing networks.

 

[Kaktussoft]

System restore doesn't work. Startup repair doesn't find problems (system is booting fine). SFC says "patch install is pending". Display what's pending (offline with DISM) fails.

Not much we can do anymore in my opinion.

Expensive lesson... make backups!!

 

[Jackie1]

First Try System Restore from the System Recovery Options. Use the disk if required.

Do you have the 100mb System REserved partition which as I wrote is preferred to be marked Active. If so you should try it first?

In some HP's the Recovery partition could also be the partition marked Active. Did you note which one was already marked Active?

If not then mark each one Active and try 3 separate Startup REpairs to see if it will start.

There are no restore points shown in system restore.

Ok, see screen shots. I manually selected each partition and made each active, all within the same cmd session. Correct? or did you want me to make partition 1 active first, then reboot and repair 3 times, then go back and makes 2 active, etc, and so on? This time, I made all 3 active together, then rebooted, hit f8 and ran startup repair 3 times. Same thing.