PC won't boot aswrvrt.sys

Viruses and worms
1

I’m guided by this thread - https://forum.avast.com/index.php?topic=53253.0

Obviously I cannot run MBAM as the PC isn’t booting?

I just booted from USB in a recovery environment where I ran Farbar Recovery Scan Tool, I’ll attach FRST.txt but I don’t seem to have Additions.txt?

I also tried running ‘aswMBR.exe’ whilst in the recovery environment but that gives me “The subsystem needed to support the image type is not present”

So that’s about the height of it. A little background, I have a SSD (boot drive) and a partitioned HDD (SSD backup / Work files)

Initially I tried the recovery environment and it say it fixed it, got me to reboot and and was actually running from my backup image of my SSD on my HDD. Therefore I powered down and disconnected the HDD SATA cable so it doesn’t complicate matters further.

I’ll await your guidance, thank-you in advance.

EDIT : Just to be clear, i’ve booted Windows 7 from USB and selected ‘Repair my computer’, it tries to fix things but ultimately cannot, then i select ‘Advanced options’ and finally ‘Command Prompt’, from there i am able to run ‘FRST64’.

2
I just booted from USB in a recovery environment where I ran Farbar Recovery Scan Tool, I'll attach FRST.txt [b]but I don't seem to have Additions.txt?[/b]
Did you tic > addition.txt before scan?
3

I pressume that you couldn’t boot into Safe Mode. Am I correct?

4

No, my apologies, I didn’t see it. I just booted again from my Windows 7 USB and it attempted to repair and failed, finally allow me to go in to the Command prompt and re run FRST64. I see no option to tick ‘addition.txt’.

All I see is the following;

Whitelist section, Registry (ticked), Services (ticked), Drivers (ticked), Known DLL’s (ticked)
Optional Scan section, List BCD (unticked), Drivers MD5 (unticked), 90 day files (unticked)

Unfortunately no safe mode, same error

5
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
S0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [87944 2019-02-19] ()
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on root of USB drive
  • Boot again into recovery mode and run FRST
  • Click on Fix.
  • fixlog.txt should be genereted on USB drive. Attach it your post and wait further instructions.
6

Obviously no start button, however I navigated to D:\Windows and then typed notepad to get Notepad running, in the recovery command prompt C:\ is System reserved. I did however type everything exactly as instructed…

Results attached

7

Can you boot now in safe mode?

8

Unfortunately not :o

Now it’s pausing on Windows\System32\drivers\aswArDisk.sys

9
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad

S0 aswArDisk; C:\Windows\System32\drivers\aswArDisk.sys [37104 2019-02-19] ()
S1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [205400 2019-02-19] ()
S1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriver.sys [225680 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S0 aswbidsh; C:\Windows\System32\drivers\aswbidsh.sys [196072 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S0 aswblog; C:\Windows\System32\drivers\aswblog.sys [320696 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S0 aswbuniv; C:\Windows\System32\drivers\aswbuniv.sys [57960 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys [42288 2019-02-19] ()
S2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [167304 2019-02-19] ()
S1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [112312 2019-02-19] ()
S0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [87944 2019-02-19] ()
S1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1034432 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S1 aswSP; C:\Windows\System32\drivers\aswSP.sys [474456 2019-02-19] ()
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [216784 2019-02-19] ()
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on root of USB drive
  • Boot again into recovery mode and run FRST
  • Click on Fix.
  • fixlog.txt should be genereted on USB drive. Attach it your post and wait further instructions.
10

Thanks, here’s the new log…

11

Can you now boot Windows?

12

Sorry, I never even tried, I was awaiting instructions… OK, so just tried to boot Windows and even though I was holding down F8 it didn’t prompt me with a menu and went straight into loading ‘normal mode’ Windows 7, the animated Windows icon appeared for a fraction of a second and then it rebooted. I let it do this twice to make sure it wasn’t loading ‘normal mode’ Windows 7. The third attempt I choose ‘Safe mode’ and it started to load (with all the white writing coming up on screen) and then a few seconds later it rebooted itself.

Sorry, it won’t load Windows at this point…

13

Any suggestions please?

14

Please post new FRST log.

15

Thanks and attached…

16
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
S0 aswVmm; system32\drivers\aswVmm.sys [X]
S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [6758976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [357304 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
HKLM...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [259976 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
HKLM-x32...\RunOnce: [20161024] => C:\Program Files\AVAST Software\Avast\aswRunDll.exe [1900936 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
HKLM-x32...\RunOnce: [20161125] => C:\Program Files\AVAST Software\Avast\aswRunDll.exe [1900936 2019-02-19] (AVAST Software s.r.o. -> AVAST Software)
HKLM-x32...\RunOnce: [SBrowserCheck] => C:\ProgramData\Avast Software\Avast\SecureBrowser\avast_browser_setup_checker.exe [4788840 2018-04-04] (AVAST Software s.r.o. -> )
HKLM...\RunOnce: [SBrowserCheck] => C:\ProgramData\Avast Software\Avast\SecureBrowser\avast_browser_setup_checker.exe [4788840 2018-04-04] (AVAST Software s.r.o. -> )
HKLM-x32...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\418cfbf1-a134-4cbf-b40e-c7efde5b9477.exe [183232 2015-06-23] (AVAST Software a.s. -> AVAST Software)
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on root of USB drive
  • Boot again into recovery mode and run FRST
  • Click on Fix.
  • fixlog.txt should be genereted on USB drive. Attach it your post and wait further instructions.
17

Thanks (again) and attached…

18

Sorry to be a pain but I see my fixlog hasn’t been downloaded yet?

I really need to get my computer back up and running again and I really appreciate your assistance.

19

Can you now boot?

20

Sorry, have I missed an instruction? As I’ve said previously, the animated Windows icon appeared for a fraction of a second and then it rebooted. I let it do this twice to make sure it wasn’t loading ‘normal mode’ Windows 7. The third attempt I choose ‘Safe mode’ and it started to load (with all the white writing coming up on screen) and then a few seconds later it rebooted itself.

Sorry, it won’t load Windows at this point…