Author Topic: reboot the system After clicking on the start repair? (Read 45893 times)

Gamezertruth · « **on:** August 19, 2012, 03:45:53 pm »

Today I've run this tool but overrun with each of the four steps successfully and try to start repair option then came a message that says, >(you haven’t created a restore point>..) however, I clicked on Yes but nothing happens except and this is something strange happening on my system or on this tool?
So I can not take a backup copy of the system and hope to be here answer..

Shane · « **Reply #1 on:** August 20, 2012, 11:15:17 am »

Use the tweaking.com registry backup in the program if system restore isnt working

My program doesnt replace any files, so a registry backup is only the thing really needed.

Shane

Gamezertruth · « **Reply #2 on:** August 20, 2012, 03:43:58 pm »

I've downloaded the registry backup program and extract the zip files and run the program and click on "Backup Now" and my system keep restarting the system Each time click on "Backup Now"?

What really hell is going on?

Shane · « **Reply #3 on:** August 20, 2012, 03:46:26 pm »

The volume shadow copy service on your system is corrupt. SO when the program starts the VSS it is causing the system to reboot.

So instead lets force my program to do the fallback backup

In the folder with the backup program is a files dir, go inside there and delete any file with "vss" in the name of it.

Now run the backup. The program will default to the fallback backup since VSS will fail for it now.

Shane

Gamezertruth · « **Reply #4 on:** August 20, 2012, 04:01:51 pm »

I Followed your instructions and this thing working ok .

Thank you for your help Shane.

Shane · « **Reply #5 on:** August 20, 2012, 04:02:28 pm »

No problem :-D

Shane

Gamezertruth · « **Reply #6 on:** August 20, 2012, 05:49:28 pm »

After forcing the program to take a backup for the first time seems like everything was okay but after taking a backup for the second time looks like a failed this time and after all this my system down - (this time after clicking on the "Backup Now" Get the blue screen of death .???

Shane · « **Reply #7 on:** August 21, 2012, 10:46:03 pm »

Did the backup try using the VSS again? If so there is something diffidently wrong with the VSS.

Before the system was set to reboot on a BSOD, but now it is set to not reboot so you see the blue screen.

Have you checked you drive for any bad sectors yet?

Shane

Gamezertruth · « **Reply #8 on:** August 22, 2012, 08:21:05 am »

As you said, I've I delete these files, which you mentioned, so I do not know what happened but I have checked the bad sector already

Shane · « **Reply #9 on:** August 22, 2012, 12:39:46 pm »

Lets find out what cased the blue screen

Run this program, it will tell you what file on the system caused the blue screen.

http://www.resplendence.com/whocrashed

Shane

Gamezertruth · « **Reply #10 on:** August 22, 2012, 02:27:46 pm »

here you go.

Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Tue 8/21/2012 12:22:14 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\Mini082112-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x21925)
Bugcheck code: 0xC000021A (0xFFFFFFFFE18AAB38, 0xFFFFFFFFC0000005, 0x7C9106C3, 0x129DD88)
Error: STATUS_SYSTEM_PROCESS_TERMINATED
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This means that an error has occurred in a crucial user-mode subsystem.
There is a possibility this problem was caused by a virus or other malware.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

Shane · « **Reply #11 on:** August 22, 2012, 09:14:49 pm »

OK so ntoskrnl.exe caused the blue screen.

I did some google searches on it and found that a lot of times it is either caused by a bad sector on the drive or a bad driver on the system
http://www.techsupportforum.com/forums/f299/solved-ntoskrnl-exe-bsod-479380.html

My program only access the Windows API and some of it services. It doesnt do anything out of the norm. So the fact that it is blue screening when you run the backup means it is triggering something.

Also since you did a chkdsk on the drive and did the flag to have it check for bad secotrs, can you post the log from it? It will bei n the event viewer.

Also when you ran the check for bad secotrs it should have take a while to finish. Did it take an hour or more or did it finish in only a few min?

Shane

Gamezertruth · « **Reply #12 on:** August 24, 2012, 02:15:44 pm »

Yes, this thing took about an hour and a half, but where can I find this log?

Shane · « **Reply #13 on:** August 24, 2012, 09:56:19 pm »

Here you go

http://www.sevenforums.com/general-discussion/96932-location-chkdsk-log-file-after-scan.html

Shane

Gamezertruth · « **Reply #14 on:** August 25, 2012, 01:28:03 pm »

hoping that the correct logs files.

And I have another error message blue screen.

Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Sat 8/25/2012 8:02:43 PM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\Mini082512-01.dmp
This was probably caused by the following module: aamw_regfilt.sys (Unloaded_AAMW_Regfilt+0x1630)
Bugcheck code: 0x100000CE (0xFFFFFFFF9EE21630, 0x8, 0xFFFFFFFF9EE21630, 0x0)
Error: CUSTOM_ERROR
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: aamw_regfilt.sys .
Google query: aamw_regfilt.sys CUSTOM_ERROR

Shane · « **Reply #15 on:** August 25, 2012, 08:20:22 pm »

OK chkdsk found a few errors and fixed them but no bad sectors.

Also I googled aamw_regfilt.sys and found nothing.

Have you ran tdsskiller.exe and combofix.exe yet by any chance?

Shane

Gamezertruth · « **Reply #16 on:** August 26, 2012, 05:15:16 am »

yep, i run both tools but no chance yet.

http://support.emsisoft.com/topic/9077-some-win-problem/#entry56498

Gamezertruth · « **Reply #17 on:** August 26, 2012, 10:28:10 am »

and look like a Trojan.Win32.Cosmu.aamw

http://www.securelist.com/en/descriptions/15157668/Trojan.Win32.Cosmu.aamw

and have this http://www.pc1news.com/files/1252301-aamw-guard-exe.html

http://www.threatexpert.com/report.aspx?md5=f226c8d14f7e5ea82b9a57fc86105ef3

more here http://file.feelcool.org/files/aamw_service.exe/111.html

Shane · « **Reply #18 on:** August 26, 2012, 02:37:58 pm »

OK so the blue screens look like they are caused by a virus. Where you able to get it cleaned out?

Shane

Gamezertruth · « **Reply #19 on:** August 26, 2012, 03:00:47 pm »

I have used many of the anti-malware / anti-spyware software, but most of these programs are unable to detect anything 'However I'm still trying to clean up my system using some other programs as you can see I'm trying to clean up my system with other Forum'

Shane · « **Reply #20 on:** August 26, 2012, 03:02:28 pm »

What version of windows are you on?

Shane

Gamezertruth · « **Reply #21 on:** August 26, 2012, 03:06:34 pm »

I'm using window xp pro.

Shane · « **Reply #22 on:** August 26, 2012, 03:07:12 pm »

Have you done a repair install yet?

Shane

Gamezertruth · « **Reply #23 on:** August 26, 2012, 03:11:36 pm »

Shane · « **Reply #24 on:** August 26, 2012, 03:35:12 pm »

A fresh install can be a lot of work, with drivers and reinstalling all programs.

What I would like to do is if you are able make a full backup image of it currently and save that image to an external drive.

The you wipe xp and install fresh. See if everything is fixed. If not we put back the image and the system to what it was before the reinstall.

If it fixes it then we know the virus was too deep and this was the only way (Or at least easiest way) to fix it. If it still have blue screen problems then we know it is hardware related

If you are not able to do this we can keep digging and see what we can do

Shane