Windows 7 Ult 64 bit trapped by BSD and can not get out.

[satrow]

DRT = Driver Reference Table at Carrona.org, mirrored at Sysnative. A big list of the commonest drivers, often linking them to the originating site, where it might be possible to find drivers or further details.

If you're not using a piece of hardware, remove it or disable it from within the BIOS and that should prevent the driver from being loaded at Boot. (Here's how to determine which Broadcom device you have https://www.broadcom.com/support/ethernet-nic#determine_driver, it's a similar routine for other hardware drivers as well.)

I think you're running the old BitDefender 2015 version, uninstaller linked here. There's no single security software that's foolproof, most that claim to be are quite heavy and can interfere too much with eg. baked-in browser security, to the extent that you might be more at risk. Avast, Avg, Avira free versions are all quite good when they've been stripped down to remove the dross. Much depends on your PC usage though.

Now that Vista's fallen over the cliff, W7 is an older OS. MS' support for it has already declined, the latest CPU/motherboard chipsets don't support W7 - for older hardware, drivers are rarely updated.

The AMD drivers are likely to be good (though I'd still check for a more recent driver), Win32k.sys is a core Windows driver that sits between the graphics drivers, DirectX and GDI, and the Windows kernel. It's frequently updated to fix vulnerabilities - if it's compromised by some malformed fonts, for instance, it can lead to the PC being owned by the bad guys. It's not something that's possible to disable, without it, there's be no windows in Windows!

There are a few software programs that claim to find, and some might even install, updated drivers but they're not 100% accurate (neither are Windows' driver updates, even with W10), one bad driver and you might be back to BSODs.

Many drivers come as part of an installer package, so they're pretty much automated, others might need installing via the Device Manager (check the upper images in the above Broadcom links and you'll see Update Driver options in the menus).

[FreeCat]

I am lost with all the driver stuff from satnow.  I really want to thank him for all the information, but basically it tells me that the problem could be in 367 different places.  And getting each driver one is like eating spagetti that is in Italy with very long forks when I am in Florida.

I did scannow - complete 100% and said there were errors but log file did not have any errors.  I'd like to see those errors but log file is 0 bytes (great programming Mr. Softie. .

Either Jim, satnow or Boggin suggested some virus checker but I can not find the link (went through emails and forum twice).  I would like to try virus checker.

Then as a last resort, just go back to the checkpoints I made before the update.  I think I did registry back then also.  Or, if I knew how, just uninstall the Windows update.

Could this make this worse?

Thanks.

[Boggin]

Your BSODs seem to start after those updates so going back to before them with your restore points could just put you back to where you are now unless you hid them when offered again.

I only suggested you could have an infection if you didn't have AOMEI installed.

To identify which updates you got, go Start - type windows update and press enter then click on View update history where you can make a note of their KB numbers.

You will then need to go to Installed Updates, put the KB number into the top right search box and when it comes up, right click on it and select Uninstall, but it will be a slow process as each one will require a reboot and reconfigure updates.

It may not have been all of the updates that caused the BSODs.

You could use your restore points to go back to before them and when they are re-offered, just select one at a time and if things are okay after the reboot, create a restore point and do the same for the rest of the updates.

I think it was a year or so ago that some of six updates I got on my Win 7 laptop took out my audio and that is what I did to identify which ones.

The thing is though that you can't access Windows update in Safe Mode to uninstall a particular update if you end up with another BSO, but you will be able to use the new restore points you have created and then when you get that update again, right click on it and select Hide.

Change you update settings to Let me choose.. and then you will be able to vet them for single installs.

[satrow]

According to systeminfo.txt, the last 10 KBs installed:
[235]: KB3156019
[236]: KB3159398
[237]: KB3161561
[238]: KB3161949
[239]: KB3161958
[240]: KB3163245
[241]: KB3164033
[242]: KB3164035
[243]: KB3167679
[244]: KB3168965
[245]: KB3170455

[FreeCat]

Thanks for your help Boggin and satnow, but:

Grrrr.  In trying to use a restore point in safe mode, the systems says "no restore points have been created."

But, I definitely created some before the update.  Did a registry backup also.  See scannow message, attached.  Maybe with a reboot I can see the log file?

[satrow]

Can you load MSConfig (Start > Run 'msconfig' ) and choose Selective Startup + Load System Services, Apply and Ok, allow it to reboot - hopefully, it will start without a BSOD, so you can then begin checking those logs, trying to access System Restore, maybe begin uninstalls, ... ?

[FreeCat]

Howdy,

I did what you said satnow, but got another BSOD, attached

[satrow]

Another 0x3b with access denied relating to win32k.sys. It's late here, see what Boggin comes up with later, he might be online again in ~5 hours.

[FreeCat]

Thanks, Satnow.

[Boggin]

Restore points being wiped out can be a cause of an infection, but you need to see if they are still enabled.

Can you go to System protection and check that it's still showing as On.

In your opening post I've noticed that you say you are using Pro Ultimate - which is it, Pro or Ultimate as they are two separate versions and did you download and create a new install disk as I'd laid out in my Reply #1

If you hadn't then as you can now get Safe Mode with Networking, you'll be able to do it on your own machine.

With that you can perform an offboot sfc /scannow but it isn't guaranteed to repair what a normal sfc /scannow was unable to.

The steps for that are in my Reply #1.

To view the CBS log produced by a sfc /scannow, enter this cmd which will produce a desktop icon which when double clicked will open the log in Notepad.

You can copy & paste the cmd to the cmd prompt but it is best done straight after a sfc /scannow as the CBS log can be volatile.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt

This produces a cut down version of the CBS log showing what it could and couldn't repair.

Downloading and running SFCFix.exe straight after a sfc /scannow may have some success but will produce its own log, but it must be run straight after a sfc /scannow.

http://www.majorgeeks.com/files/details/sfcfix.html

You can copy & paste both those reports into your reply box.

Is Event Viewer still showing the same errors or have any more been produced with the change of the stop error code ?

To rule out an infection, I want you to run a scan with the free ESET Online Scanner while in Safe Mode with Networking.

https://www.eset.com/uk/home/online-scanner/

Hit the SCAN NOW box.

Click on Advanced settings and check those boxes except for Archives and Proxy - it can take a while to run.

There's also a box to uninstall on completion if I remember rightly.

[Boggin]

Forgot to add this but you can uninstall those updates that satrow has listed by going Start - type installed updates and press enter.

Click on the top right search box and enter the update in full - i.e. KB3156019 and that will come up in the main pane along with its install date.

Right click on each in turn and select Uninstall.

You can defer the restart until you have uninstalled all of them which will boot you back into normal mode and not sure if you'll be back with the BSOD, but it will go through a partial reconfigure before it shuts down and then restarts.

[satrow]

It's W7 x64 Ultimate SP1.

Info for the PC from systeminfo.txt/MSInfo32:

Code: [Select]

OS Name:                   Microsoft Windows 7 Ultimate
OS Version:                6.1.7601 Service Pack 1 Build 7601
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Organization:   
Product ID:                xxxxx-xxx-xxxxxxx-xxxxx
Original Install Date:     6/11/2013, 12:03:35 PM
System Boot Time:          8/7/2017, 8:44:07 PM
System Manufacturer:       Dell Inc.
System Model:              Precision WorkStation T7500 
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 26 Stepping 5 GenuineIntel ~2926 Mhz
                           [02]: Intel64 Family 6 Model 26 Stepping 5 GenuineIntel ~2926 Mhz
BIOS Version:              Dell Inc. A14, 7/6/2012
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-05:00) Eastern Time (US & Canada)
Total Physical Memory:     65,534 MB
Available Physical Memory: 61,120 MB
Virtual Memory: Max Size:  131,065 MB
Virtual Memory: Available: 126,708 MB
Virtual Memory: In Use:    4,357 MB

[FreeCat]

Thanks, Boggin and Satnow.

OK, I have a lot of stuff to do, so I will give you answers and outline what I understand.

System Protection is turned off.  I will leave it off until you tell me to turn it on.
(I have never touched it previously; did not know it was there.)

Yes, I have Ultimate.  Pro was on system when purchased, but Dell wiped it and installed Ultimate.
(Sorry for confusion on this.)

I have begun the eSet AV scan; looks like it will take a while; 5% done, so far so good.  Re Virus Scann:  Bloggin, I saw that in May 2017 you tried Bitdefender.  Did you like it?  What were those others you suggested; I looked through the log but got lost and could not find them.

I saved the event viewer, but I am not sure if this is what you can see (ATTACHED).  Last time I did it screen by screen and it took over an hours; let me know if this is good or tell me a way to get it to you without screen by screen --- there must be a way.

Next I am going to try to uninstall the updates as per Satnow's list.

Then, I will work on the scannow stuff as it seems more complicated than un-install of update.

Thanks again for your help, Satnow and bloggin.

Jim, mentioned this hotfix for the scannow problem;  I have been told that hotfixes are dicey and should be used only as a last resort:

"There seems to be a hotfix for that – but defiantly coming back to something with your drivers is not happy with the update at all.:
 
https://support.microsoft.com/en-us/help/980932/stop-error-code-0x0000003b-system-service-exception-on-a-computer-that
 
 

[FreeCat]

Hi Bloggin,
I went to un-install the first update but no results found.  See attached.  Maybe I did it incorrectly.

BTW, eStat still no errors.

The Bitdefender uninstall did not uninstall it.

[Boggin]

You would need to clear Start from the box before you enter the KB number.

Did you go Start - type installed updates to get that window because it looks more like Windows Explorer.

It's strange that you should mention Bitdefender as I've seen an entry for BDVEDISK in the event log.

I'm in the middle of composing a fuller reply.

[Boggin]

You should have system protection turned on.

BTW - Is jpm (Jim) emailing you these Hotfixes ?

I wasn't overly impressed with Bitdefender because it was slow to start on boot and Windows Defender was kicking in (Win 10).

I used IObit Uninstaller to uninstall Bitdefender as Windows Uninstall which is supposed to uninstall it tends to leave residue.

However, you should be able to remove BDVEDISK using FreeFixer. - http://www.freefixer.com/

You can also use FreeFixer to remove anything else that has a box next to it where it says the file is not found - these are residue.

I gave Windows Defender a go but wasn't sure just how effective it was so went back to my paid for Norton Security.

You don't have a lot of Errors recorded but I did notice one for BDVEDISK not being able to load.

That belongs to Bitdefender, so have you had it installed at one time ?

Looking at this article, BDVEDISK can cause a 0x03B BSOD but it would have BDVEDISK.sys in the stop code.

http://www.fixoserror.com/fix-bdvedisk-sys-blue-screen-error-step-by-step.html

This article is for info only - don't go clicking on any download buttons.

I've gone down past that error and haven't been able to find it to copy & paste.

I'm not sure what this error means - perhaps satrow may have an idea.

Log Name:      Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Source:        Microsoft-Windows-Windows Firewall With Advanced Security
Date:          09/08/2017 01:36:28
Event ID:      2011
Task Category: None
Level:         Information
Keywords:     
User:          LOCAL SERVICE
Computer:      M764-140-DQ64G3
Description:
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Reason:      The application is a system service
Application Path:   C:\windows\system32\lsass.exe
IP Version:   IPv4
Protocol:   TCP
Port:      49154
Process ID:   664
User:      SYSTEM
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Windows Firewall With Advanced Security" Guid="{D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85}" />
    <EventID>2011</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2017-08-09T00:36:28.762974400Z" />
    <EventRecordID>178597</EventRecordID>
    <Correlation />
    <Execution ProcessID="1068" ThreadID="1140" />
    <Channel>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</Channel>
    <Computer>M764-140-DQ64G3</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="ReasonCode">1</Data>
    <Data Name="ApplicationPath">C:\windows\system32\lsass.exe</Data>
    <Data Name="IPVersion">0</Data>
    <Data Name="Protocol">6</Data>
    <Data Name="Port">49154</Data>
    <Data Name="ProcessId">664</Data>
    <Data Name="ModifyingUser">S-1-5-18</Data>
  </EventData>
</Event>

[Boggin]

You also have a couple of these but I think you've already run a chkds /r haven't you ?

Log Name:      System
Source:        Ntfs
Date:          09/08/2017 01:35:30
Event ID:      55
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      M764-140-DQ64G3
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume4.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">55</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2017-08-09T00:35:30.902472700Z" />
    <EventRecordID>1205144</EventRecordID>
    <Channel>System</Channel>
    <Computer>M764-140-DQ64G3</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>\Device\HarddiskVolume4</Data>
    <Binary>0C000C000200380002000000370004C000000000020100C000000000000000000000000000000000EE0C14001A00000000000100</Binary>
  </EventData>
</Event>

[satrow]

The last Hotfix doesn't apply here, it's an older 'fix', pre-SP1.

Try the latest BitDefender Uninstall tool: http://www.majorgeeks.com/files/details/bitdefender_uninstall_tool.html

[FreeCat]

Thanks for this.  I will get to it as soon as anti-virus eSet finishes.

[Boggin]

Just a reminder, go Start - type installed updates and press enter when View installed updates comes up.

Has ESET found anything yet - it usually tells you as it progresses.

Have you previously run a chkdsk /r ?

[FreeCat]

Howdy Bloggin and Satnow,

Yes I did run chkdsk 0 errors and I believe the /R was the parameter.

eSet still running (10+ hours so far) and 7 threats found.  I hope these 7 threats are listed with some option to delete them when eSet is done.  :|

So, I guess it is best to wait before proceeding with the other suggestions like attempting the uninstall of W7 updates.

BTW, I did have BitDefender and it worked too well interfering with my life streaming data.  so I attempted to uninstall it over a year ago; some of it stopped working; but there was always a ghost of it running.   I remember one was AVG and there were two more; what were the other two?

I will prolly try  the other one you mentioned once I get out of this mess.

Yes, Jim is mailing me these hotfixes.

I will turn on system protection.

I just ran the new BitDefender un-install so hopefully it is now totally gone.

I do not understand the disk error you pointed out (volume 4?).  As I said the chkdsk ran and said 0 errors as per the long printout from yesterday.  I am pretty sure that the /R parameter was used.  Is there way to tell from the log?

Does not the Tweaking all in one tool clean things up like the left over BitDefender scrap?

I am trying the uninstalls as soon as eSet is done.

[FreeCat]

OK - eSat just ended so th's like 15 hours.

Good.  But, after selecting all and delete selected eSet seems to be doing nothing - just sitting there no message that it is  working, etc.

See attached screen and list of what it found.

BTW, WIREDTOOLS seems to be where most of the virus was.  I tried to uninstall it and got message "program does not exist."

What do you suggest?

[Boggin]

The chkdsk Event Viewer entry was some hours older to your last boot and it didn't reappear during the latest boot that was recorded but thought I should mention it.

It's been a while since I ran ESET but I think it should give you a box to check to uninstall the program on completion.

I'll run it on my Win 7 laptop and as I don't expect it to find anything, it could still run for an hour or so, but will get back to you on that.

I think the longest it has ran on mine was about 1¾hrs.

One of the boxes that you checked was to clean automatically, but I'll see how that goes on mine.

I should have said to also check the top button of those two options as well as those in the Advanced settings.

I can't advise what to do with ESET until it completes on mine.

This article which includes a download link will show you how to remove the WiredTools.dll using FreeFixer.

http://www.freefixer.com/library/file/WiredTools.dll-139610/

As for the ones in Program Files(x86) - go Start - click on Computer - double click on Windows (C: ) then double click on Program Files (x86) and scroll down to look for any folders with the name WiredTools - right click on them and select Delete.

Unless you had installed WiredTools, it could have been installed as an unwanted bundled program when you downloaded something else.

When downloading anything you should always look to see if there are any boxes auto checked before hitting Next or Install.

Windows Repair can repair damage caused by infections but not until the infection has been removed.

[Boggin]

It's finally finished after 1hr 31mins with no threats found on a summary page with a box to Delete application's data on close.

If still nothing has happened for you, then use the X to close the window and see if it gives you a message.

[FreeCat]

Howdy Bloggin and Satnow,

I did it all; I was confused at times but got thru all you suggested; I think. 

the eSet ended after about 15 hours.  It found 10 things --- all were related to Wiredtools;  I do not remember installing any Wiredtools --- even (on my NAS I keep the install files for everything that I install in my "1 DOWNLOADS" folder --- nothing there).   I selected remove all and ended eSet with remove files from quarantine and remove applications files.  "Remove from quarantine" lead me to believe maybe put back where they came from; but, I guessed right, I am hoping.

Still could not go into protect mode and could still not run scannow, but I figured I might try after a reboot with the new instructions; but now, I am sending you all this up-to-date stuff before I loose track of it.  So, doing that right after I send this.

I deleted the Wiredtools in the Program Files (x86) folder.  Image attached.

Filefixer found an enormous amount of stuff.  I got to believe that what it found is some kind of mistake.  But, I dunno.  I did not check any boxes.

I have zipped the collection of stuff which is attached along with the BSOD (still the win32k) that I can after running all this.