Windows 7 Ult 64 bit trapped by BSD and can not get out.

[Boggin]

Yes, remove from quarantine would have put them back.

A lot of those type of programs include adware.

FreeFixer does find a lot of stuff but you don't check the boxes on all to remove, otherwise you would end up with problems.

Any that has a removal box next to it and you aren't sure what it is, then click on the more info link.

Where it has file not found next to it, you can check the box for removal.

Did you run the Bitdefender Uninstaller as there is still some residue showing in there.

FastPCTools - did you install this program or is it something else that has ended up installed on your computer ?

AVG Secure Search - I've seen this add-on stop someone from connecting to the Internet and wouldn't have it installed.

jusched is just an updater for Java.

LogMeIn - have you ever had someone remote connect to your computer ?

I wouldn't worry about the red entries in FreeFixer.

Have you managed to uninstall those Windows Updates as you are still getting the BSOD 0x03b stop code.

[FreeCat]

Congratulations, Bloggin and Satnow!

W7 up and only because of your help. 

Sorry, but yesterday, since I was out of work for 3 days, I had to go in so could not do it and did not get back till I had to sleep.

So, first thing I got the update screen showing and uninstalled the 3 updates; I thought there were 4 plus 2 .NET updates but prolly mistaken.

The screen showing them is attached.

I also got some kind of Malware bytes message, but I am not currently using that; I remember installing it and using for one day about a year ago; but, I thought I uninstalled it.
(also attached)

The machine came up very slowly, but seems ok for now.

Of course, there is more to do.

This is what I see: 

1 - I should run the scannow to find bad / missing files; but I am not sure what parameters to use.

2 - I should install some anti-virus.  MS Windows Defender?  I think it is very slow.  AVG?  I saw what you said about AVG security so that, I guess is out.  I just dunno.

3 - Reinstall AOMEI and backup system.

4 - Figure out what went wrong with the updates so they can be installed.  Here I am totally lost.

5 - Figure out what is going on with this disk error you pointed out (pasted below).  I have tow two Hitachi 2 TB Raid0 drives as my C drive.  and I though they were OK based on the CHKDSK with 0 errors a few days ago.  There is one other drive on the system;  I am not sure what this is exactly but if I try to get to it with the explorer it looks like the attached "140" picture (the D drive in the picture is on the two Hitachi drives a one virtual drive).  The drive I am speaking of is the "J" drive which is unassailable if I try to drill into it but it is somehow connected; but, there is a message index corrupt and accessible.  I notice this drive in 2013 right after the Dell guy left when he was taking out my W7 Pro and installed V7 Ultimate.  I called Dell to ask about it and I could not get the same guy, but they told me if everything else is working ok, don't worry about it.  lol  So, I stopped thinking about it.

So, thanks again, gentlemen for all your help and guidance.  I will wait to hear from you before doing anything else.

Here is what you said about it previously which mentions a "Volume 4" and to my knowledge I do not have a volume 4:

You also have a couple of these but I think you've already run a chkds /r haven't you ?

Log Name:      System
Source:        Ntfs
Date:          09/08/2017 01:35:30
Event ID:      55
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      M764-140-DQ64G3
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume4.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">55</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-08-09T00:35:30.902472700Z" />
    <EventRecordID>1205144</EventRecordID>
    <Channel>System</Channel>
    <Computer>M764-140-DQ64G3</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>\Device\HarddiskVolume4</Data>
    <Binary>0C000C000200380002000000370004C000000000020100C000000000000000000000000000000000EE0C14001A00000000000100</Binary>
  </EventData>
</Event>


I do not use this drive that I know of.

[Boggin]

While I can't see all of the drives in your pic - I've never seen any with a red bar or alerting to an infection and not to boot.

What do you use those for ?

To perform a chkdsk on another drive - you would enter chkdsk x: /f or /r parameter where x is the drive letter.

So for drive J: you would enter chkdsk j: /f

I would just use the /f parameter for now because if /r finds and tries to repair bad sectors it could be running for quite a long time and the /f report would say if it found any bad sectors or would give you an error message that it was unable to continue.

The choice then would be yours to run a chkdsk /r but any drive that shows bad sectors then it is time to back that up for its pending complete fail.

I would install the free version of MBAM again as it's a very good antimalware scanner and you can use the Custom scan to select the drives you want it scan, so you can include those showing as in red.

It only shows C: and D: on mine but hopefully it will pick up on those on your machine to check the boxes for.

Hit the Download Free button - https://www.malwarebytes.com/mwb-download/

Click on Scan in the left pane and then on Custom/Configure Scan and then check the boxes for the drives.

I don't know why satrow's list of updates didn't include those, but I have KB4019990 as being installed on my Win 7 on 27th July, KB4014596 on 18th May and don't have KB4025341 installed.

After each month's updates I run Disk Cleanup as an admin which cleans out obsolete updates.

You would do that by going Start - type disk cleanup - right click on Disk Cleanup and select Run as administrator and that will do the system files.

Mine cleaned out 0.98GB of updates this month - normally it's just 2 or 300MB but if you've never run Disk Cleanup as an admin then it will probably clean out a few GBs.

I'd then do a defrag with the elevated cmd defrag /c which will do all of your drives, but don't run that cmd until you've run an antimalware scan on those other drives.

I'm not really sure about advising on a free antivirus program.

I've seen people complaining about AVG becoming bloated, Shane has no time for Avast but I've also seen where people swear by them.

I use Norton Security Deluxe which is a paid for program and that covers installation on up to 5 machines but if you shop around you can usually get it cheaper than what Norton want to charge you for it.

Kaspersky is also another paid for program which has a very good rep and I think cheaper than Norton, although because it is of Russian origin, there's the suspicion that it could be used for spying on people - I read that the US gov. is refusing to use it or anything Kaspersky.

[FreeCat]

Howdy Bloggin,

The red bar is my Synology NAS telling me that the drive is near 90% full; it is not a virus or anything bad.

All of my drives are in the jpg image that I sent to you; maybe scrolling would show them to you. 

So, do you thin that "volume 4" error is on my C drive?  Is there a way to tell from the dump info you have me?  Anyway, I will just take the "J" drive out of my machine the next time I open it up.

When I look for MBAM I get some bit locker program from MS and Malware bytes.  You must beam MalwareBytes.
BTW, do you just have the free version and run a scan weekly? or the personal live version?

So, I will use MBAM.  When uo mention Shane has no time for Avast, what does that mean?  I have time to explore once I get machine in shape.  Might it be worth exploring?

Thanks for this information.

But, now I am wondering how to fix whatever stopped my machine with the updates.  Should I run the scannow and with what parameters to find out if some Win 7 file has problems.  Will scannow fix the problem when it finds it?  What parameters to use for scannow?

Thanks again for you help.

[Boggin]

You don't use any parameters for sfc /scannow which only scans system files, so may not snag what else could have caused the BSOD.

When those updates present themselves again, create a restore point and just check the box for one at a time to see which if any can cause a BSOD.

You now know how to get out of that by either using the restore point or uninstalling that update in Safe Mode.

If one of the updates was responsible for the BSOD then when it is presented again, check its box, right click on it and select Hide.

You may not get the one for KB4025341 again as I don't have it installed, so it could have been withdrawn.

I'm going to have to shoot off now but will be back later.

[satrow]

The J: is the drive flagged as having file system errors according to your logs.

If you'd like to stress test your drivers for stability now, you can - but it's not without risks and will usually trigger a BSOD, sometimes as a False Positive or occasionally pointing to a hardware problem. It might also make Windows unbootable - you need to have a Restore Point set and tested before utilising it.

https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/29-driver-verifier-blue-screen-death-related.html. Study this and double-check everything before trying it out. Personally, I'd want to get the PC fully cleaned/patched up before using it.

[FreeCat]

Howdy,

I ran the SFC and posted the results here twice, but they did not poste.  What could be wrong?

[FreeCat]

Howdy here are sfc results again - attached one at a time --- first is beginning and end of log file plus sfc cmd stream messages..
Re-posting as maybe the combined attachments were too big.
My question, when you have time, is is SFC complete?
Should it be run again?
What cause it and what can I do to stope these errors in the future?
Thanks.

[FreeCat]

Here is the CBS.log itself --- attached.

[Boggin]

My eyes blur over trying to read a full CBS log.

Run the sfc /scannow again and if it reports it is unable to repair all files then copy & paste this cmd to the prompt and press enter.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt

This will put an icon onto the desktop which when double clicked will open the CBS log in Notepad with what it could and couldn't repair.

You can then copy and paste that into your reply box.

[FreeCat]

Howdy Bloggin and Satnow,

I did what Bloggin suggested with the  findstr.  I double checked it and did it twice but could not get the icon or the condensed results from the CBS.log.  Screen print of what I did is attached.

So, I ran the sfc /scannow again and am sending that log.

Also Malware bytes found 33 threats which I quaranteened.  It also found hundreds of the stuff that I do not understand.  I printed the report several ways so you could read it easier and including a grahpic.

Looking to hear from you.  Have not rebooted the machine yet.  What are my next steps to repair this machine so I can apply updates?

Thanks in advance, fellas, for all your great help. 

[FreeCat]

Bloggin, I sense that there is some way to identify the lines in CBS.log that will tell you useful information.

If you give me specifs on what to look for there, I can search and find them for you; then, I will list them out all together and send to you.

[Boggin]

I would reboot to get rid of those Trojans but for that findstr command to work, it has to be run from the same command prompt as you ran the sfc /scannow from and not a standard cmd prompt.

This is what a standard cmd prompt looks like -

Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\KAM4>

As you can see, it comes up with c:\ and the computer username but when you run the cmd prompt as an admin you get the prompt showing as system32

Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>

Run another sfc /scannow after the reboot and then if the sfc /scannow reports it is unable to repair some files then immediately copy & paste that findstr cmd.

This is because the CBS log can be volatile.

There's one other program you can run which I find is better at getting rid of adware and that is AdwCleaner.

http://www.majorgeeks.com/files/details/adwcleaner.html.html

Scroll down and view the vid tutorial and that will save me from explaining things.

In the lower pane where you see those items checked, sometimes AdwCleaner will snag smaller programs as PuPs that you have installed - just uncheck the box for any you want to keep before you hit Cleaning.

[FreeCat]

Howdy Bloggin,

Thanks for your help.

I rebooten and only checked two PUPs as those ere the only ones I knew for sure were useless.

I did my best to tructions about how to run the sfc, but I do no result.

Image of the CMD screen is attached. 
I even tried some stuff of my own after I saw that it did not work.

any, I have enclosed the whole CBS file and I have another copy with all before the very last run of scf is clipped off to make it easier for you to see.

I will await further instructions.  Whe did I do incorrectly?

[Boggin]

Hmmm.... it looks like it can't find your profile or it could be corrupt - I wonder if you will need to create a new admin account.

Create a system image onto external media then scroll down to Fix Corrupt User Profile in Windows 7 in this article to create a new admin account and transfer your data to the new account.

https://neosmart.net/wiki/corrupt-user-profile/

Ignore the MS easy fix it link as it has been withdrawn.

When you've done that, run another sfc /scannow and if it still reports it is unable to repair all files, copy & paste that cmd again to see if it works with the new account.

I just cannot work my way through that CBS log in its current form.

[FreeCat]

Bloggin,

I have another user account "Administrator".
Could I just fo there and try it there?

[Boggin]

Yes, you can.

[FreeCat]

OK, Bloggin.  Done!
It is attached. I await further instructions.
Thanks y9ou for your help.

[Boggin]

It just seems to be the MSDTC.Log that is being snagged.

I don't know what effect this has on the system and from a Google, even taking ownership of it and deleting it for Windows to create another hasn't worked.

What I suggest is a repair install that won't affect your personal stuff or installed programs but you will need to reinstall Windows Updates and will need an install disk that includes SP1.

I don't think you confirmed if you created a new install disk on your friend's or your computer.

If you didn't then go to https://www.microsoft.com/en-gb/software-download/windows7 and scroll down the page to enter your product key which when verified as a genuine retail key will release the ISO download for your version.

This download is ~3.09GB so can take some time to download.

Select Save and when complete, download Windows USB/DVD Burner Tool to create either a bootable USB if your computer can boot from an USB or create a bootable DVD.

http://wudt.codeplex.com/

Select Browse then go to your Downloads folder - click on the ISO then on Open and follow the prompts to create the bootable media.

Go Start - Computer - insert the DVD or USB and double click on the drive.

If using a DVD then the process should start but if using an USB that will open the files where you can either double click on setup Application or right click on it and select Run as administrator.

[FreeCat]

Howdy Bloggin,

OK, I will do this, but I am very afraid of doing this procedure; it feels to me like some sort of open heart surgery where the patient has to die and be brought back to life.

This feeling , I guess is based on several issues.   About two years ago on this machine (I call 140) I suddenly began getting messages that it was not genuine even though it had been working fine for years.  I called Softie and it took them a call that lasted a very long time (and maybe there was a second call that same day) and finally they gave me a code to enter (they gave me about 6 and the last one worked) which made it genuine again.

Then, about 9 months ago my 135 (again W7 Ult 64b - a Dell also but less powerful) machine became not genuine after working fine for years.  Since this machine was in limbo, I decided to call Sofite on that.  I was on the phone for over an hour and he logged on and tried about 10 codes to no avail.  Then after a reboot, we lost connection.

And, now that Softie regards W7 as a a geezer about to die, I fear for support.  This last guy sounded like he was about 7 years old.

These experiences weigh on my mind.  I remember in the install with the Dell guy on 140, there was trouble reading the original disc and he had to boot with some kind of copy that he made; then, continue with the original disc.  It was a nightmare to me.  I thought he would be living here; it took two days.  But, he impressed me that he really knew his stuff, and finally, the machine worked fine. 

So, Bloggin, I will begin looking for the discs as I still have not unpacked from my move a few months ago.  Since I feel this might take a while, do you suppose I could use the machine for work this week --- just not do any updates.  It seems to be working OK right now.  Then, next weekend begin Saturday AM and go through the operation you outlines for me.  And, BTW, thanks again to you and Satnow for all your help!

Incidentally, when this is all done, does the Tweaking forum provide for any way to print a log of all posts to this incident as I feel I would like to have access to all the good suggestion made in the future?

Thanks, again.
 

[Boggin]

You don't need to dig out any old install disks unless you require it for the product key, although there are a couple of programs that will display that key for you but if MS have overridden your original key, then that may no longer work to free up the ISO download which will include SP1.

The free version of Speccy is one such program http://www.majorgeeks.com/files/details/speccy.html

When it has installed click on Operating System where it will have your product key at the top.

Try this key on that website to see if it will accept it as genuine to release the download.

If you ever get the not genuine message again, there is a series of commands that will rebuild the licence store which is a known fix for that error message.

Go Start - type cmd then right click on cmd and select Run as administrator - accept the UAC and enter these cmds -

net stop sppsvc
(wait until the service has stopped before entering the following lines)

CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

REN tokens.dat tokens.bar

net start sppsvc

slui.exe

After a couple of seconds the Windows Activation dialog will appear.

You may be asked to re-activate and/or re-enter your product key, or Activation may occur automatically.

Then reboot.

You can copy & paste that long one to the cmd prompt.

[FreeCat]

OK.  Good.  Thanks.  I will do what you said.
But, just thinking about my work situation.  Could I put doing this off until next weekend and just use my computer the way it is for a week as long as I do not do any updates?
BTW, what is the "portable" version of things; I see this a lot and do not understand what they mean.
Thanks, again, Bloggin.

[Boggin]

That's not a problem if your computer is working okay.

Portable is when you install a portable version onto something like a Flash drive.

Before you perform the repair install, create an image onto external media and run Windows Repair in Safe Mode and then see if a sfc /scannow still reports it cannot repair that MSDTC Log, as that could have been the result of those infections.

It's probably prudent to create a system image now before you eventually go ahead with those updates and then you'll have something to fall back on.

[FreeCat]

OK, Bloggin.
I have downloaded the ISO twice onto two separate drives and will make a DVD today.
And, also, I will make a AOMEI Backeruppper image today.
Next weekend, I will perform the restore steps you outlined and report back here when done.
I would like to save this case with all the postings; does the Tweaking Forum provide for that?
Thanks again, Bloggin and Satnow for all your help.  God Bless your both.

[Boggin]

You could save one of your email notifications so when you click on that, it will bring you straight to your thread.

The thread auto becomes locked after 30 days of the last reply, but if you want to add to it after that, just PM me and I'll unlock it.