System won't boot, safemode hangs on aswrvrt.sys

Hi,

I happily recommended Avast to a friend a few months back and all went well - I’ve been using it for years - and then all of a sudden her computer stopped booting.

It’s a Windows 7 32 bit laptop and she’s given it to me to see what’s wrong.

It’s unable to boot to Safe mode, cant recover to a previous save point, and is hanging on the load of aswRvrt.sys.

Searching for this problem has brought to me your forums, as a number of others appear to all have had the problem in late July/August, which coincides.

Are you able to provide hints as to what it is that I should do to get the laptop booting again?

I can boot to a linux system repair, mount the windows HD disk, and edit content, if need be.

Thanks,
J

Hello support people?

Any hints on this one?

Are you able to access the recovery console for windows 7 ?

Download to a USB Farbar Recovery Scan Tool select 32 or 64 bit as applicable

Click repair my computer

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7275.jpg

Select your operating system

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277202.jpg

Select Command prompt

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277.jpg

Insert the USB with FRST

At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select “Computer” and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

https://dl.dropbox.com/u/73555776/FRST%20Start%20scan.gif

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Hi,

Thanks for the help.

The FRST.txt file is attached.

You have a partial zero access infection there, I will try to remove that first and see if it allows a boot

Download the attached Fixlist.txt to the same location as FRST
Run FRST as before and press fix
On completion reboot to normal windows and then run FRST again

Hi,

Thanks heaps for your help with the fixlist.txt

Sorry it took ages to run it - when I attempted it the first time it kept giving me an error starting frst - something about ‘unable to read script file’.

I’ve no idea what finally fixed this problem - just continual reboots and attempting to have windows ‘repair itself’ I believe.

FRST has just run now, and the FixLog.txt reads as below. The machine still won’t boot, so I’ve run FRST on it again, and attached the new FRST.txt

I’m off to learn more about FRST, but if you are able to provide a new fixlist.txt in the mean time that would be greatly appreciated.

J.


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-12-2013 01
Ran by SYSTEM at 2013-12-30 12:18:28 Run:1
Running from G:
Boot Mode: Recovery

Content of fixlist:


HKLM.…D6A79037F57F\InprocServer32: [Default-fastprox] C:$Recycle.Bin\S-1-5-18$70fcdb70c5b8d46645f03adef7c0c75c\n. ATTENTION! ====> ZeroAccess?


HKLM\Software\Classes\CLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\Default => Error setting value.

Ran FRST fix again, and got the log below, but still not bootable, in safe mode a boot is still hanging on/at/after aswrvrt.sys.

New frst.txt attached, which appears to show no problems.


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-12-2013 01
Ran by SYSTEM at 2013-12-30 15:26:15 Run:1
Running from G:
Boot Mode: Recovery

Content of fixlist:


DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


“C:\Program Files\Windows Defender” => Deleting reparse point and unlocking started.
“C:\Program Files\Windows Defender\en-US” => Deleting reparse point and unlocking done.
“C:\Program Files\Windows Defender” => Deleting reparse point and unlocking completed.

==== End of Fixlog ====

“essexboy’s” signature says that he will be offline from 12/23 to 1/2, so it may be a while.