Windows 7 problem with booting(aswrvt.sys)

Viruses and worms
1

Hi!

Yesterday my laptop was working so slow after I downloaded a game. Avast is blocked something. After the block Avast is updated and my laptop is freezed. I restarted it but it won’t start in normal mode. I’ve tried the safe mod and every mod but still nothing. Everytime stoped the loading at aswRvt.sys. I’ve readed other posts but nothing worked. Please help :wink:

2

See: “If you cannot Boot the computer”
Instructions: http://forum.avast.com/index.php?topic=53253.0

3

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-07-2014 01
Ran by SYSTEM on REATOGO on 19-07-2014 19:11:24
Running from E:
Platform: Windows 7 Professional (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM.…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM.…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10754664 2011-07-07] (Realtek Semiconductor)
HKLM.…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-07-04] (AVAST Software)
HKLM.…\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [417792 2009-09-04] (Apple Inc.)
HKLM.…\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)
HKLM.…\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM.…\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\Gast.…\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [417792 2009-09-04] (Apple Inc.)
HKU\Gast.…\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [153136 2007-06-01] (Nero AG)
HKU\Gast.…\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\Gast.…\Run: [Facebook Update] => “C:\Users\xy\AppData\Local\Facebook\Update\FacebookUpdate.exe” /c /nocrashserver
HKU\Gast.…\Run: [SDP] => C:\Users\Gast\AppData\Local\FilesFrog Update Checker\update_checker.exe /auto
HKU\Gast.…\Run: [FLV Player] => C:\Users\Gast\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe
HKU\Gast.…\Run: [Overwolf] => C:\Program Files\Overwolf\Overwolf.exe -silent
HKU\Gast.…\Policies\system: [LogonHoursAction] 2
HKU\Gast.…\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\xy.…\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\xy.…\Policies\system: [LogonHoursAction] 2
HKU\xy.…\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: 00avast → {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
GroupPolicyUsers\S-1-5-21-1711965465-3240380818-1759584663-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1711965465-3240380818-1759584663-1003\User: Group Policy restriction detected <======= ATTENTION

4

Could you attach the log please

5

This one?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-07-2014 01
Ran by SYSTEM at 2014-07-19 20:28:24 Run:1
Running from E:
Boot Mode: Recovery

==============================================

Content of fixlist:

HKLM-x32.…\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190{c16c1~1\browse~1.dll [2691536 2013-07-26] ()
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
2013-08-01 22:59 - 2013-02-28 00:27 - 00000000 ____D C:\ProgramData\BrowserProtect
C:\Users\joerg\ntuserdirect_MSManager.dat

HKLM-x32.…\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) => Error: No automatic fix found for this entry.
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190{c16c1~1\browse~1.dll [2691536 2013-07-26] () => Error: No automatic fix found for this entry.
avast! Antivirus => Service deleted successfully.
aswFsBlk => Service not found.
aswMonFlt => Service deleted successfully.
aswRdr => Service deleted successfully.
aswRvrt => Service deleted successfully.
aswSnx => Service deleted successfully.
aswSP => Service deleted successfully.
aswTdi => Service not found.
aswVmm => Service deleted successfully.
“C:\ProgramData\BrowserProtect” => File/Directory not found.
“C:\Users\joerg\ntuserdirect_MSManager.dat” => File/Directory not found.

==== End of Fixlog ====

6

You used someone elses fix list

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Could you run FRST again please and attach the entire log

7

Before I used the fixlist.txt the laptop is restarted automaticaly and not ended the log. Now its run to the end.

8

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Download the attached fixlist.txt to the same location as FRST
Run FRST and press fix
Once completed try a normal boot

9

I’ve tried a normal boot but don’t start. Tried a safe mode and the loading stoped at AtiPcie.sys.

10

Could you download a fresh copy of FRST please and then run a fresh scan for me

11

Can you give me a link please?

12

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

13

Here you are

14

OK from the reatogo desktop select command prompt and type in the following :

chkdsk c: /r

When it has completed try a normal boot

15

Quote from command prompt:

X:\i386\System32>chkdsk c: /r
Cannot open volume for direct access.

X:\i386\System32>

16

Can you see your c drive from the reatogo desktop ?

17

No because it’s d drive :smiley: Now it’s working, but the laptop is restarted :frowning:

18

Weird… OK let me know if a reboot works after the d drive has run chkdsk

19

I’ll try again the chkdsk.

20

Aye the command will now be

chkdsk d: /r