Windows 7 (home premium 32 SP1) stalled after aswRsvt

Viruses and worms
1

Hi everybody espcially the "überevangelist"s and especially ESSEXBOY​,

And please forgive my poor English… I try to do my best !

  • The PC is a notebook ASUS K50I (property of one of my friend who doesn’t feel very concerned by security (until now) => no regular backup, no care about viruses so, I try and I TRY to bring back the PC to live)

  • The problem : black screen with mouse cursor in the middle of it (normal boot or "without error)

  • Historical : The PC had probably been under influence of virus(es) but I didn’t find any activ (most were in .jar). I found them with K…SKY Rescue Disk v.10

  • I clean manually (del *.tmp, *.dll, *.htm, *.cvr, *.dss, *.od, *.exe) this directory C:\Users"Username"\AppData\Local\Temp
    There I found remaining ose00000.exe wich resist to del. I finally use the File Browser of the rescue Disk to suppress it.

  • I run FRST64.exe (FRST.txt attached. Where I notice only two “[ x ]”)

Can’t run OTL whatever the method -on bootable SD card or -OTLPE bootable CD (2 downloads, 2 OTLPE burnt, => same result splendid “blue screen”) so no OTL.txt possible. Sorry !
Can’t run aswMBR.exe (message in french : “Le sous-système requis pour prendre en charge le type d’image n’est pas présent” 32b versus 64b ???) Sorry x 2 !

  • On the opposite I join last ntbtlog.txt (don’t know if it helps)

I would be pleased by some external view and help !!!

Thanks by advance !
Jean-Luc

2

Hi,

Open notepad.

[*]Click Start
[*] Type notepad.exe in the search programs and files box and click Enter.
[] A blank Notepad page should open.
[] Copy/Paste the contents of the code box below into Notepad.


LastRegBack: 2013-11-10 11:00

[*] Save it to your USB flashdrive as fixlist.txt

Boot into Recovery Environment

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens …

[*] Press the Fix button once and wait.
[*] FRST will process fixlist.txt
[*] When finished, it will produce a log fixlog.txt on your USB flashdrive.

Exit out of Recovery Environment and post me the log please.

Try to boot Windows normally…

3

Hi TwinHeadedEagle !

I fear I’m a bad student… your process was perfectly CLEAR but I did it TWICE…

I don’t know why the flash card was protected when I ran 1rst FRST64 and I didn’t think to the Fixlog writen on the Hard Disk… silly !!

So ??? Don’t know if the 2nd fixlog.txt is relevant or not or if I should proceed again.

Boot (Normal or Safe mode) is not OK. Ends with blue screen “STOP: c0000135 The program can’t start because %hs is missing from your computer. Try reinstalling the program to fix this problem”.
I started a look on the internet. This message seem to be quite usual but solutions no frequent. I go on searching.

Thanks again, Jean-Luc

4

Ok, let’s try again

Open notepad.

[*]Click Start
[*] Type notepad.exe in the search programs and files box and click Enter.
[] A blank Notepad page should open.
[] Copy/Paste the contents of the code box below into Notepad.


Restore point made on: 2013-11-13 16:06:11

[*] Save it to your USB flashdrive as fixlist.txt

Boot into Recovery Environment

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens …

[*] Press the Fix button once and wait.
[*] FRST will process fixlist.txt
[*] When finished, it will produce a log fixlog.txt on your USB flashdrive.

Exit out of Recovery Environment and post me the log please.

Try to boot Windows normally…

5

Here is the (3rd) Fixlog.

And I “Try to boot Windows normally…” but, again, the result is “STOP: c0000135 The program can’t start because %hs is missing from your computer. Try reinstalling the program to fix this problem.”

Jean-Luc

6

Ok, another try…

Open notepad.

[*]Click Start
[*] Type notepad.exe in the search programs and files box and click Enter.
[] A blank Notepad page should open.
[] Copy/Paste the contents of the code box below into Notepad.


C:\Program Files\Alwil Software
HKLM-x32\...\Run: [avast] - C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4858968 2013-08-30] (AVAST Software)
S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
C:\Windows\System32\Drivers\aswFsBlk.sys 
C:\Windows\system32\drivers\aswMonFlt.sys
C:\Windows\System32\Drivers\aswrdr2.sys
C:\Windows\System32\Drivers\aswRvrt.sys
C:\Windows\System32\Drivers\aswSnx.sys
C:\Windows\System32\Drivers\aswSP.sys
C:\Windows\System32\Drivers\aswTdi.sys
C:\Windows\System32\Drivers\aswVmm.sys

[*] Save it to your USB flashdrive as fixlist.txt

Boot into Recovery Environment

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens …

[*] Press the Fix button once and wait.
[*] FRST will process fixlist.txt
[*] When finished, it will produce a log fixlog.txt on your USB flashdrive.

Exit out of Recovery Environment and post me the log please.

Try to boot Windows normally…

7

Here is the (4th) Fixlog.

And I “Try to boot Windows normally…” but, the result is “STOP: c0000135 The program can’t start because %hs is missing from your computer. Try reinstalling the program to fix this problem.”

Wasn’t Avast ?

Jean-Luc

8

Can you post fresh FRST report…

9

Sorry being late TwinHeadedEagle and by the way I’m really greatful for spending your time on my problem !!!

I met some problem for booting on the flashdrive… but here we are

10

Boot back into the recovery Environment and run FRST like you did before

Type the following in the edit box after “Search:”.

LPK.dll

Click Search File(s) button and post the log (Search.txt) it makes to your reply.

11

Here is the Search.txt (LPK.dll)

LPK.dll seems to be a part of Windows (Language Pack ?). I found one on the bootable flashdrive (in Windows\System32, size 41 984, date 2009-07-14)

Waiting for your tips

12

Hi TwinHeadedEagle,

I suppose you will be disappointed (so am I !!) but because of the pressure coming from my friend I try this :

  • copy LPK.dll from the bootable to the two directories where it missed
  • boot => no blue screen, no message “STOP: c0000135 The program can’t start because %hs …”
  • but black screen with mouse in the middle is back again

So as I discover an old system backup (12 2012 on external forgoten disk) in the middle of the night (),

  • I’m trying a Microsoft system restore (with disk erase) at the moment (boot on the flashdrive).
  • 1rst Boot is Ok, hope it will go on
  • I stil wondering if there was a rootkit that we cannot detect or a more “simple” problem

Sorry wasting your time. I learnt a lot but we didn’t win against adversity on this trick.

I really-really thank you TwinHeadedEagle,
Yours sincerely,
Jean-Luc

13

I think we should win by changing these missing files. There is no Rootkit or malware here, system somehow got damaged, probably by Avast.

If you still need my assistance, I am here. Cheers :slight_smile: