Windows repair error (trying to use standalone)

[sueandco]

Hi
I dont know what this error is and also what my next step should be as I am having a problem with my Win 7 32 which goes to bluescreen then restarts at the end of any large download (which is not completed)
Here is windows repair error System error &H8007007E (-2147024770) the specified module could not be found.
Any help welcome
Thanks Sue

[Boggin]

I'm not sure why you should be getting this error when downloading the Windows Repair program as this error can be generated with other programs.

Let's see what a sfc /scannow reports.

Go Start - type cmd then right click on cmd and select Run as administrator - accept the UAC then at the prompt type sfc /scannow and press enter.

This will take about 20 mins to run and give its report at the end.

If it reports it is unable to repair some files then copy & paste the following cmd to the prompt and press enter.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt

That will put an icon onto the desktop which when double clicked will display the CBS file in Notepad which you can then copy & paste into your reply box.

[sueandco]

Hi,
there were errors which were corrected by sfc /scannow
on restart I got message
"Failed to connect to the system event notification service this problem prevents standard users from logging on to the system"
What does this mean? i have done nothing else but restart.
Thanks for your help so far
Sue

[sueandco]

Hi
here is CBS log
Thanks
Sue

[Boggin]

Sorry I'm a bit late in getting back - had to go out.

Can you boot up into the advanced boot options by tapping F8 (usually) as you switch on and use the cursor keys to select Safe Mode with Networking and press enter and then run the cmd prompt as an admin again and enter these cmds to see if you get the same error message after the reboot.

netsh winsock reset catalog

shutdown /r /t 00

[sueandco]

Hi
the same message ha come back after safe mode and cmd commands as listed and reboot.
Thanks
Sue

[Boggin]

I believe satrow who is a member is going to take you through steps to post a minidump file to see what was causing the BSOD, but you will need to do it in Safe Mode with Networking.

He is experienced in dealing with BSODs.

[satrow]

Hi Sue.

Let's see if we can get some clues as to what's been happening and hopefully get a handle on the cause.

Minidumps are stored in a hidden folder within the main Windows directory: C:\Windows\Minidump where the minidumps have a .dmp file extension (though by default, extensions, and this folder, are hidden). Show hidden files and folders.

Once you can see the dumps, copy them to a new folder on your Desktop, zip the contents of that folder (right-click > Send to > Compressed folders) and attach the resulting compressed/zipped file to a Reply.

We'll need some background info + error messages etc. as well: Start > Run > MSInfo32 > Enter. This should start the collection process for the System Information viewer, it's likely to take several minutes, maybe longer - to check that the info is fully loaded, work through the subsections and check they (almost, a few won't have data) all contain code/details. The main section I'm interested in is the final one, Software Environment > Windows Error Reporting (WER), though many of the others will provide useful info too.

When you're happy that the viewer is fully populated, File > Save > MSInfo32.NFO (the default) to your Desktop, zip it as above and attach the zip file to your Reply.

[sueandco]

Hi Satrow,
Here is minidump only one listed.
When i tried to get system information I get this: Can't Collect Information. Cannot access the windows management instrumentation software. Windows management files may be moved or missing.
Thanks for your help
Sue

[Boggin]

Can you boot into Safe Mode again to run a cmd prompt as an admin and enter these cmds to see if they resolve the WMI problem.

winmgmt /standalonehost

winmgmt /resetrepository

If they don't do it then try these other two cmds -

regsvr32 wmisvc.dll

winmgmt /resyncperf

Enter exit to close the cmd window.

[sueandco]

Hi
second command did it.
here is system info file
Thanks
Sue

[satrow]

Okay, it looks like the Zemana zamguard32.sys driver was involved with or caused this BSOD, though I don't see a Zemana entry in the Programs list; did you use/uninstall this software previously? Can you see it in Add/Remove Programs to uninstall it?

[sueandco]

Hi Satrow
I did uninstall zemana, it is not listed in any programs I did a search and it is listed in a regrunlog.
here is a copy.
I get no errors on restart.

Thanks
Sue

[satrow]

It looks like your (Trial?) version of Zemana AM required the user to disable the auto-running sections before uninstalling, though that was probably not made clear.

We'll need to prevent the following from auto-starting:
zam32.sys
zamguard32.sys

I'm sure someone would be able to write a script to disable these but I do it manually - CAUTION: mistakes made using this method could make your PC unbootable. You need to have a recent computer image and the tested means to boot and replace the broken image; I don't know whether a Windows System Restore would work.

Right-click My Computer > Manage > Device Manager. View > Show hidden devices > Non-Plug and Play drivers -> find the entry that refers to the zamguard32.sys and double-click it, switch to the Drivers tab - check the details are correct - click Stop if it's Started and then change the Startup type to Disabled.

With the Guard driver hopefully now stopped, you should now be able to use the same routine for zam32.sys.

Check after a reboot to see whether both settings have stuck.

(I've PMed @Boggin to ask whether he can find/create a script for this).

If all goes well, we'll move on to try to discover what (if anything) was causing ZAM to try to take action and trigger the BSOD, and try to clean up/update some very old drivers (2004 - 2007, was this an upgrade from XP?) that might also trigger BSODs.

[sueandco]

Hi Satrow
I have found 2 Zam entries
"ZAM Guard Driver" and "ZAM Helper Driver"
Both are started shall I stop and then disable Them
Thanks
Sue

[Boggin]

They may reinstate themselves after a reboot.

There are some suggestions in this article in how to fully uninstall, but create a restore point before making any changes to the registry.

https://ugetfix.com/ask/how-to-uninstall-zemana-antimalware/

[satrow]

They may reinstate themselves after a reboot.

Only if their Registry entries are still in place, which I believe would have been taken care of by the original uninstall, and if disabling them from starting failed. If the Guard driver is stopped and disabled, the Helper driver can then be stopped and disabled, since the Guard driver wasn't running to prevent this 'interference'.

[sueandco]

Hi
I did
"Repeat the same steps by entering Registry Editor and deleting HKEY_CURRENT_USER\Software\Zemana\ and HKEY_LOCAL_MACHINE\SOFTWARE\Zemana\
Reboot the computer."
 it started as it should and they are no longer listed in the device manager.
I dont remember if this was an upgrade from xp sp3 or if it was a reinstall. There is a Windows.old.000 file on C

[satrow]

Good work.

It looks like your base hardware is all pretty old, and I'd guess it must have been originally on XP. I doubt that there's any W7-specific drivers available for it.

Do you still use dial-up or fax? If not, your SmartLink modem can be uninstalled and physically removed. This should prevent the 2004 drivers loading (slntamr.sys, SlWdmSup.sys, Mtlmnt5.sys and RecAgent.sys).

I don't think we can do anything about the 2007 driver, sisagpx.sys AGP (GART) driver). The latest drivers I see are of the same XP/Server2003 vintage.

The WER logs showed signs of BSOD/program crashes involving at least two different torrent programs, these are pretty notorious for hogging resources and clashing with security drivers. I would fully uninstall any torrent software, or at the very least, prevent them from running at startup.

I don't see any known bad drivers loading otherwise.

Ensure you keep the common malware target software fully updated, Windows obviously, Adobe Reader/Macromedia Flash/Java (are you really sure you still need Java? Uninstall it if you're unsure, if any other program fails to run because it needs Java, look for alternatives to them).

[sueandco]

Hi Satrow.
Thanks for that I shall remove the fax if I can.
and follow the rest of your advice.
Thanks again
Sue

[satrow]

No trouble

I did bump into a site which might have more recent drivers for some parts of your PC, don't use their Driver updater/utility, try to check your file versions against the ones listed for your W7 32-bit components here before downloading the package to install it, it's not uncommon to find older drivers inside a newer wrapper: https://www.driverscape.com/manufacturers/fujitsu/laptops-desktops/ga-8sgxlfs/9084 < it's not a Fujitsu site, so take care.

[sueandco]

Hi,
Thanks for all your help problem solved.
Sue

[satrow]

Five days can be a little too early to be sure a BSOD is really fixed but if we pinned down the cause correctly, you might be right

Thanks for the feedback!