Windows will not boot - stops at aswrvrt.sys

Viruses and worms
1

I need help trying to fix a 2nd computer. Windows will not boot. Viewing the files that loads, it stops at aswrvrt.sys. I saw another post about this and ran FRST.exe from flash drive. I’m not sure how to start a “new thread” so will try it with a new post. The following is a result of running FRST. What do I do next?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-05-2013 04 (ATTENTION: FRST version is 6 days old)
Ran by SYSTEM on 01-06-2013 10:26:28
Running from F:
Windows Vista ™ Ultimate (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: RecoveryAttention: Could not load system hive.
ERROR: The configuration registry database is corrupt.

==================== Registry (Whitelisted) ==================

HKLM.…\Run: [RtHDVCpl] RtHDVCpl.exe
HKLM.…\Run: [Skytel] Skytel.exe
HKLM.…\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-05] (Apple Inc.)
HKLM.…\Run: [APSDaemon] “C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe” [59720 2013-01-28] (Apple Inc.)
HKLM.…\Run: [iYogi Support Dock] “C:\Program Files\iYogi Support Dock\iYogiSupportDock.exe” [2303904 2012-09-17] ()
HKLM.…\Run: [avast] “C:\Program Files\Alwil Software\Avast5\avastUI.exe” /nogui [4767304 2013-02-28] (AVAST Software)
HKLM.…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM.…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM.…\Run: [Adobe ARM] “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe” [946352 2012-12-02] (Adobe Systems Incorporated)
HKLM.…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” [152392 2013-02-20] (Apple Inc.)
HKLM.…\RunOnce: [aswAhAScr.dll] “C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe” “C:\Program Files\Alwil Software\Avast5\AhAScr.dll” [140544 2013-02-28] (AVAST Software)
HKLM.…\RunOnce: [aswasOutExt.dll] “C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe” “C:\Program Files\Alwil Software\Avast5\asOutExt.dll” [302736 2013-02-28] (AVAST Software)
HKU\Administrator.…\Run: [Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized [ 2012-07-13] (Skype Technologies S.A.)
HKU\Administrator.…\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\Administrator.…\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [ 2012-11-16] (SUPERAntiSpyware.com)
HKU\Administrator.…\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103472 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C)” -“http://www.nabiscoworld.com/games/game_large.aspx?gameid=10036”
BootExecute:

========================== Services (Whitelisted) =================

==================== Drivers (Whitelisted) ====================

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-01 10:23 - 2013-06-01 10:26 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders ========

2013-06-01 10:26 - 2013-06-01 10:23 - 00000000 ____D C:\FRST
2013-06-01 10:15 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\LogFiles

Other Malware:

C:\Users\Administrator\GoToAssistDownloadHelper.exe

==================== Known DLLs (Whitelisted) ============

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM.….exe: exefile => OK
HKLM.…\exefile\DefaultIcon: %1 => OK
HKLM.…\exefile\open\command: “%1” %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-26 11:49:08
Restore point made on: 2013-01-07 11:53:26
Restore point made on: 2013-01-08 11:45:29
Restore point made on: 2013-01-11 12:01:42
Restore point made on: 2013-01-11 12:04:55
Restore point made on: 2013-01-13 10:52:53
Restore point made on: 2013-01-17 13:03:53
Restore point made on: 2013-01-17 13:22:07
Restore point made on: 2013-01-21 06:09:55
Restore point made on: 2013-01-21 06:29:34
Restore point made on: 2013-01-22 10:18:27
Restore point made on: 2013-01-22 10:41:24
Restore point made on: 2013-01-24 14:12:23
Restore point made on: 2013-01-26 13:15:25
Restore point made on: 2013-01-27 08:29:14
Restore point made on: 2013-01-30 14:34:45
Restore point made on: 2013-01-30 17:26:30
Restore point made on: 2013-01-30 17:31:27
Restore point made on: 2013-02-01 15:23:44
Restore point made on: 2013-02-02 12:52:23
Restore point made on: 2013-02-03 08:01:36
Restore point made on: 2013-02-05 11:56:29
Restore point made on: 2013-02-07 14:29:24
Restore point made on: 2013-02-08 15:41:56
Restore point made on: 2013-02-08 15:59:16
Restore point made on: 2013-02-11 13:10:05
Restore point made on: 2013-02-12 00:00:19
Restore point made on: 2013-02-12 08:31:34
Restore point made on: 2013-02-14 05:51:08
Restore point made on: 2013-02-21 06:00:10
Restore point made on: 2013-02-21 06:12:19
Restore point made on: 2013-03-04 17:18:43
Restore point made on: 2013-03-04 17:37:59
Restore point made on: 2013-03-04 17:45:45
Restore point made on: 2013-03-09 05:54:45
Restore point made on: 2013-03-10 17:00:22
Restore point made on: 2013-03-16 14:28:02
Restore point made on: 2013-03-16 14:49:35
Restore point made on: 2013-03-16 15:04:10

==================== Memory info ===========================

Percentage of memory in use: 19%
Total physical RAM: 2046.55 MB
Available physical RAM: 1645.71 MB
Total Pagefile: 2046.55 MB
Available Pagefile: 1638.79 MB
Total Virtual: 2047.88 MB
Available Virtual: 1932.41 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.88 GB) (Free:156.77 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Repair disc Windows 7 32-bit) (CDROM) (Total:0.14 GB) (Free:0 GB) UDF
Drive f: (Repair disc Windows 7 32-bit) (Removable) (Total:14.91 GB) (Free:14.66 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows Vista) (Size: 233 GB) (Disk ID: E3FCE3FC)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 000AB0B1)
Partition 1: (Active) - (Size=15 GB) - (Type=07 NTFS)

Last Boot: 2013-03-27 06:19

==================== End Of Log ============================

2
Boot Mode: RecoveryAttention: Could not load system hive. ERROR: The configuration registry database is corrupt.
Hi this is the problem a corrupt registry

Are you able to use system restore from the Recovery disc

3

Thank you! ;D

That gets me going in the right direction. It also tells me I may be trouble with recovery because the prior owner (sister) is looking for CD’s now. If we cannot find the recovery CDs I’ll reformat and start over with another windows version. We had pictures on it that I should have saved off. My fault for not backing it up. :o

Thanks again!

4

You can back your pictures up using this

Please print these instruction out so that you know what you are doing

[*]Download OTLPENet.exe to your desktop
[*]Ensure that you have a blank CD in the drive
[*]Double click OTLPENet.exe and this will then open imgburn to burn the file to CD

[*]Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
[*]As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads :slight_smile:

[*]Your system should now display a Reatogo desktop.
Note : as you are running from CD it is not exactly speedy
[*]Use explorer to locate and back up the pictures to a USB