Scan Interrupted, Can No Longer Boot to Visible Logon Screen

[lmitchell]

I,ve been having some issues with my laptop crashing which I went into at length on another forum (http://forums.majorgeeks.com/index.php?threads/frequent-explorer-exe-crashing-then-opens-libraries-or-my-documents-windows-long.301020/). In light of getting no response and as a last-ditch effort to avoid a risky upgrade install, I decided to try th Tweaking.com utilty since I had success with it in the simpler previous version. I actually have great hopes it might help.

However, as mentioned in the MajorGeeks thread, partway through the MSI repair it bluescreened. By then this had been running nearly 32 hours and I was reluctant to just stop it fearing the consequences.

My worst fears were realized because now I can only boot to a black screen with moveable cursor,  either  regular or safe mode.

[lmitchell]

I have a recovery disk and a bootable usb install image. I've rooted around with the cmd in both Safe Mode and Recovery environments and even tried to start your app via command line.

I made registry and system restore  backups through the program before running it and have no idea how to access either. Last, when the system disk is listed in recovery environment or Diskpart it's now appended with "/regserver". SFC doesnkt run due to a "pending repair". I've restarted multiple times.

I really need your timely help on this. I'm self-employed and have lost the last two weeks to the initial problem, now this. I have expenses piling up. I can't afford any more multi day scans (3 18-hour chkdsks in the last week). How do I restore my system to where it was when I started running the repair. Then I'll either skip step 2 (which took 24 hours) and maybe 5, or all just forget the whole thing and do an upgrade install

[Julian]

https://m.youtube.com/watch?v=VbN0eWR9HMs
Here is a video Shane made to restore with registry backup from a live cd

[lmitchell]

What about the fact that my hard drive got renamed from its original label to "/Regserver" ("Volume in drive D is /Regserver", according to cmd window in Recovery mode). Is that indicative of a bigger issue or something that needs to be resolved first, before I take the chance of bricking my OS? What about the "pending repair" (according to SFC) that won't go away? Are either of these preexisting conditions going to affect the success of the registry restore?

In the meantime I'll watch the video. I had to do manual reg restores frequently back when I had Windows 2000. It was really volatile and manually was the only way to fix it

[lmitchell]

Julian, thanks for the pointers to the video. I happen to have a Linux live CD but mentioned that I have a bootable Windows  USB and a Windows repair CD.

Linux looks easier. I've watched the Linux and Windows videos. Problem is I only have use of a years old Android flip phone with a 3" screen and can't read the commands or file labels in the videos. I'm ready to restore pending if you can type out the folder/file names/commands and knowing that the issues I mentioned in my last post are't cause for concern.

[lmitchell]

I've watched the videos a few more times, can see what needs to be done and will run dos_restore.cmd in Windows.  Just need to find out if those other issues might be a problem.

[lmitchell]

I restored the registry via Windows and the cmd file in the Regbackup subfolder. I'm still booting to a black screen with moveable cursor (where the login screen should be), both in Safe Mode and regular boot, my OS drive is still labelled "/Regserver".

Something is happening despite the black screen because I can hear the hard drive working and the cursor momentarily shows the green "wait" circle.

When I start in Safe Mode the list of loading drivers stops at classpnp.sys.before going to the black screen with cursor. I have no idea if more drivers are supposed to load.

Trying to run System File Checker in Recovery mode is still telling me there is a pending repair (even after attempting the fixes "dism.exe /image:d: /cleanup-image /revertpendingsactions" and "dism.exe /image:d: /scratchdir:d: /cleanup-image  /revertpendingactions" - slashes are missing because they aren't on the phone keyboard).

What am I supposed to do now? The backup was made by TWR three days ago, just before running TWR and getting into this mess.

2

[lmitchell]

It's very disheartening to return to this forum after a sleepless night Googling every possible solution that I could find, only to see at least one thread with multiple pages of assistance while I've gotten one stock answer, Youtube video links with registry restore instructions.

Based on the problem I described in my first post, black screen / mouse cursor and being completely unable to see anything past boot except in Recovery Mode, that was the least of my problems.

Using an old Windows Boot Genius disk I renamed my hard drive back to its original label. I have no idea if that relabelling was evidence of a more sinister condition that might linger despite the correction.

I finally managed to get SFC to run via Dism and offline switches.

The first registry restore did not change anything regarding login problem. I went back one further (made 10 minutes prior to the last from within TWR) and think that is what allowed Startup Repair to run. The errors if found could not all be corrected and I don't understand the log.

At this point I'd be happy to do the upgrade install that I was trying to avoid initially, but from waht I understand it can only be done from inside the user accounts? And shame on me to attempt to clear up a major annoyance before I backed
up the disk. I could not have anticipated this since I haven't had such catastrophic results from using a third-party program in my twenty years of owning computers.

Now I'm going to manually set permissions on all the system files and folders using online instructions since 8kve found threads where this is the cause of this problem, and TWR spent 20+ hours doing so in my 1Tb drive. This is my last resort barring any knowledgeable intervention from a moderator, before 8 have to spend another week or so to clean install and restore my system back to where it was so that just maybe I won't lose any more income.

[Julian]

Woah hold on a second im sorry I did not get back to you. Lets see im going to read everything you posted as I just got on the forums now. Give me a moment to reply.

[Julian]

Hmmm okay so explorer is crashing lets see can you make another user via recovery environment command should be net user /add username
Next command should be net localgroup administrators /add username
I want to see if its just your user profile corrupted. Next thing is if you can run chkdsk /f /r I want to see if it reports 0kb in bad sectors. Im currently away from my computer and im on my phone im sorry for the slow typing.

[Julian]

Oh almost forgot Can you get me that bluescreen log. I want to see what it says..

[lmitchell]

The problem with getting a log is that I'm working on an old feature phone. The Android version is too old to support the Google cloud apps and I can't update its browser.

If youtell me where to look, I can probably find the file but no way to send it. I'm not able to get into  the safe modes because all the log in screens are black with the mouse cursor. So, Safe Mode with Networking is ruled out. If the file is not too big for Notepad to handle I'll have to just retype what seems relevant

[lmitchell]

Adding a user triggered the message:

"The user or group account specified cannot be found.
The user was successfully created but could not be added to the USERS local group.
More help is available...."

Adding an administrator (I used the same name as above) returned "5he command completed successfully."

I wasn't sure if the first task was to be checking for *my* account. I'm guessing it would say the user already exists if it hasn't been corrupted. And if that were confirmed, then add me as an admin? My main account is assigned admin priveleges, then there is Administrator and acouple of decoy Guest accounts for theft tracking apps.

Let me know if I need to do the tasks using my current user name.

[lmitchell]

I'm going to run chkdsk now. I know there are bad sectors, 16 or so. I think the data is not in there. I ran two chkdisks the past week, once on my own and once prompted by some other maintenance program. Everything has been happening too quickly to get another drive and move everything.

They take a long time for me - 1TB drive usually at least 90 full, and therecent sector problem equals about 16 - 18 hours. I'm hoping it'll be faster than usual if nothing gets in the way of my running it.

[Boggin]

It's possible that your boot sector is in the bad sectors, but as you can get into the Recovery Environment - see if this Win 7 tutorial will help fix the MBR -

http://www.sevenforums.com/tutorials/20864-mbr-restore-windows-7-master-boot-record.html

If you are unable to read all of the bits on your phone, do you have access to another computer such as a friend, relative, library or internet café where you will be able to make notes or even print it out.

[Julian]

What users pop up when you type net users

[lmitchell]

It's 6:30PM EST and chkdsk has been running for about 1.5 - 2 hrs. Stage 4, Verifying File Data, has been running about an hour and is at 82percent, having started at 80percent. Judging by past experience it will be done between 10 PM - 2AM. There are about 3.3 million files to process and its currently at about 210 thousand.

No problems reported in the first three stages of the scan, just the usual processing. If it'll save time I can look up results of the last chkdsk, done Monday or so, if told where to find the file.

[Julian]

If the chkdsk displays anything but 0kb in bad sectors the hdd is dying because if windows sees it then yeah its dying...

[lmitchell]

Right now I'm seeing nothing about bad sectors. "CHKDSK is verifying file data  (stage 4 of 5), xx percent completed." If a bad sector result was supposed to appear in the previous sections' results I,m clear so far, otherwise the other details don't appear until completion, correct?

I'm saying there were "bad" sectors but it could have been something else, I can't remember the terminology but something not ordinary.

As far as users, I've opened a second cmd window and am being denied access to D: because the scan is running. X: shows Administrator, Guest and the new account I created. However, when logging in to the Recovery environment (remember, the only place I can see the logon), Administrator, Guest, HomeGroup and my regular (preexisting) account all show up in the dropdown. There are others (User, Default, and some system-created .NET related ones) that don,t show up anywhere except in the "Users" folder.

[Boggin]

You won't be able to do this while chkdsk is running but for info - from the cmd prompt in the recovery environment enter eventvwr - that should take you to the Event Viewer.

Expand Windows Logs - click on the name Application/Action/Find then in the Find box type chkdsk or wininit and press enter.

Cancel the Find box and read the report in the scrollable window.

This will be academic though as by the time you will have access to the cmd prompt, the current chkdsk will have completed.

[lmitchell]

One last thing to mention is that I have permissions set so that users don't have to enter their user name to log on, just their password. Thus the logon windows shows four icons/avatars with user names - Administrator, two Guest accounts (decoys) and my user account (which has admin rights). *If* my user account were corrupted (and I won't be able to confirm until the D: drive scan is over) would that alone be enough to disrupt the logon screen common to all accounts?

I could probably open another cmd windows and work on the MBR (since it's on another partition) but will play itsafe and wait until chkdsk is done, as well as weigh in you thoughts on the scan results and bluescreen log (once I,m told where to find it).

[lmitchell]

I,ve read the MBR restore info and it's readable an understandable, but just to clarify --

As far as i can tell the system is booting. Where the logon screen is nothing but black and a mouse cursor. Moving the cursor sometimes.effects the black "brightness". I hear all the normal drive activity as if something is happening, just can't see anything. I've even blindly pushed the button sequence to select my user avatar, enter my password and logon. I hear the activity that is customary to my desktop loading, but still nothing but black and a cursor. I can even bring up the Sticky Keys prompt and the monitor selector in the customary places prior to logon.

By contrast, the true non-boot might be the black screen with the blinking line cursor in the upper left corner. This is defrinitely not that. I see the swirl startup, the goes to black screen where the intro screen and logon would normally come up.
 
Another reason I think the boot may be functional (although not visible) is because from the start Last Known Good Configuration has completed by going to the black / mouse cursor screen. If the boot was broken shouldn't LKGC be presenting a result different than what has already occured?

[Boggin]

If the backlight or the inverter had gone, you wouldn't even see the white cursor.

The chkdsk x: /r will be scanning all of the disk which will include partitions.

When you have access to the cmd prompt again, enter eventvwr and check to see what Errors there are which may be able to ID what else is going on.

[lmitchell]

"Free space verification is complete.
CHJDSK discovered free spqce marked as allocated in the Master File Table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

(Then disk space stats, including
... total disk space
... in ... files
817564 kb in 345263 indexes
8 kb in bad sectors
... in use by the system
... occupied by the log file
3995956 kb available on the disk

4096 bytes in each allocation unit
... total allocation units on the disk
... allocation units available on the disk
Failed to transfer logged messages to the event log with status 50.

Sorry for the late reply. I fell asleep waiting for the scan to finish.

The lst line is new. I don't remember that result in orevious scans.

The bad sectors message is new. Now that I see the results I can recall that the previous message was not bad sectors but something about reallocation

[lmitchell]

 Boggin, when I did chkdsk I had changed the prompt to D.  I didn't know better. I'll scan the boot sector separately.

Julian, I've run net users from the D prompt. It shows the same results as from X, unless I'm doing something wrong:

User accounts for // (the slashes actually go the other way)
___________________________________________________
Administrator        Guest          (newly created user)
The command completed with one or more error.

So none of my preexisting users are showing. The same message shows whether I use X, C or D prompt.