[JSntgRvr]

There is conflicting information as to the bootable partition. The active partition seems to be the Recovery Partition, rather than the OS partition. Lets get the information from the Boot Configuration Data.

Download the enclosed file:

Save it next to FRST in the USB drive. Run FRST as you did before, except that this time around click on the Fix button and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it in your next reply.

Attempt to boot in Normal as I am removing a folder that responds to the Zero Access Trojan and which in turn can create this type of issue. Let me know the outcome.

[Advertisements]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 09-06-2012 01
Ran by SYSTEM at 2012-06-09 17:27:38 Run:1
Running from G:\

==============================================


========= bcdedit /enum all /v =========


Windows Boot Manager
--------------------
identifier {9dea862c-5cdd-4e70-acc1-f32b344d4795}
device partition=Y:
description Windows Boot Manager
locale en-US
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
extendedinput Yes
default {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
resumeobject {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
displayorder {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d}
timeout 0
customactions 0x10000ba000001
0x54000001
custom:54000001 {572bcd55-ffa7-11d9-aae0-0007e994107d}

Windows Boot Loader
-------------------
identifier {572bcd55-ffa7-11d9-aae0-0007e994107d}
device ramdisk=[boot]\tvtos\winpe.wim,{ae5534e0-a924-466c-b836-758539a3ee3a}
path \windows\system32\boot\winload.exe
description WinPE
osdevice ramdisk=[boot]\tvtos\winpe.wim,{ae5534e0-a924-466c-b836-758539a3ee3a}
systemroot \windows
nx OptIn
bootstatuspolicy IgnoreShutdownFailures
detecthal Yes
winpe Yes

Windows Boot Loader
-------------------
identifier {97184ba4-0ff7-11e0-9a51-5cac4cc93cc8}
device ramdisk=[Y:]\recovery\windowsre\winre.wim,{97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
osdevice ramdisk=[Y:]\recovery\windowsre\winre.wim,{97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
systemroot \windows
nx OptIn
bootstatuspolicy IgnoreShutdownFailures
winpe Yes
custom:46000010 Yes

Windows Boot Loader
-------------------
identifier {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence {97184ba4-0ff7-11e0-9a51-5cac4cc93cc8}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
nx OptIn
bootstatuspolicy IgnoreShutdownFailures

Resume from Hibernate
---------------------
identifier {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {1afa9c49-16ab-4a5c-901b-212802da9460}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Windows Memory Tester
---------------------
identifier {b2721d73-1db4-4c62-bf78-c548a880142d}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale en-US
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
badmemoryaccess Yes

EMS Settings
------------
identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
custom:26000022 Yes

Debugger Settings
-----------------
identifier {4636856e-540f-4170-a130-a84776f4c654}
debugtype Serial
debugport 1
baudrate 115200

RAM Defects
-----------
identifier {5189b25c-5558-4bf2-bca4-289b11bd29e2}

Global Settings
---------------
identifier {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
inherit {4636856e-540f-4170-a130-a84776f4c654}
{0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
{5189b25c-5558-4bf2-bca4-289b11bd29e2}

Boot Loader Settings
--------------------
identifier {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
{7ff607e0-4395-11db-b0de-0800200c9a66}
bootstatuspolicy IgnoreShutdownFailures

Hypervisor Settings
-------------------
identifier {7ff607e0-4395-11db-b0de-0800200c9a66}
bootstatuspolicy IgnoreShutdownFailures
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Resume Loader Settings
----------------------
identifier {1afa9c49-16ab-4a5c-901b-212802da9460}
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}

Device options
--------------
identifier {97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
description Ramdisk Options
ramdisksdidevice partition=Y:
ramdisksdipath \Recovery\WindowsRE\boot.sdi

Setup Ramdisk Options
---------------------
identifier {ae5534e0-a924-466c-b836-758539a3ee3a}
description Ramdisk options
ramdisksdidevice boot
ramdisksdipath \boot\boot.sdi

========= End of CMD: =========

C:\Users\Connor Biggs\AppData\Local\2e26c49f moved successfully.

==== End of Fixlog ====

[Jbiggs]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 09-06-2012 01
Ran by SYSTEM at 2012-06-09 17:27:38 Run:1
Running from G:\

==============================================


========= bcdedit /enum all /v =========


Windows Boot Manager
--------------------
identifier {9dea862c-5cdd-4e70-acc1-f32b344d4795}
device partition=Y:
description Windows Boot Manager
locale en-US
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
extendedinput Yes
default {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
resumeobject {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
displayorder {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d}
timeout 0
customactions 0x10000ba000001
0x54000001
custom:54000001 {572bcd55-ffa7-11d9-aae0-0007e994107d}

Windows Boot Loader
-------------------
identifier {572bcd55-ffa7-11d9-aae0-0007e994107d}
device ramdisk=[boot]\tvtos\winpe.wim,{ae5534e0-a924-466c-b836-758539a3ee3a}
path \windows\system32\boot\winload.exe
description WinPE
osdevice ramdisk=[boot]\tvtos\winpe.wim,{ae5534e0-a924-466c-b836-758539a3ee3a}
systemroot \windows
nx OptIn
bootstatuspolicy IgnoreShutdownFailures
detecthal Yes
winpe Yes

Windows Boot Loader
-------------------
identifier {97184ba4-0ff7-11e0-9a51-5cac4cc93cc8}
device ramdisk=[Y:]\recovery\windowsre\winre.wim,{97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
osdevice ramdisk=[Y:]\recovery\windowsre\winre.wim,{97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
systemroot \windows
nx OptIn
bootstatuspolicy IgnoreShutdownFailures
winpe Yes
custom:46000010 Yes

Windows Boot Loader
-------------------
identifier {c4bcfd5e-fcb5-11df-a11b-60eb69970856}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence {97184ba4-0ff7-11e0-9a51-5cac4cc93cc8}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
nx OptIn
bootstatuspolicy IgnoreShutdownFailures

Resume from Hibernate
---------------------
identifier {c4bcfd5d-fcb5-11df-a11b-60eb69970856}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {1afa9c49-16ab-4a5c-901b-212802da9460}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Windows Memory Tester
---------------------
identifier {b2721d73-1db4-4c62-bf78-c548a880142d}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale en-US
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
badmemoryaccess Yes

EMS Settings
------------
identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
custom:26000022 Yes

Debugger Settings
-----------------
identifier {4636856e-540f-4170-a130-a84776f4c654}
debugtype Serial
debugport 1
baudrate 115200

RAM Defects
-----------
identifier {5189b25c-5558-4bf2-bca4-289b11bd29e2}

Global Settings
---------------
identifier {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
inherit {4636856e-540f-4170-a130-a84776f4c654}
{0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
{5189b25c-5558-4bf2-bca4-289b11bd29e2}

Boot Loader Settings
--------------------
identifier {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
{7ff607e0-4395-11db-b0de-0800200c9a66}
bootstatuspolicy IgnoreShutdownFailures

Hypervisor Settings
-------------------
identifier {7ff607e0-4395-11db-b0de-0800200c9a66}
bootstatuspolicy IgnoreShutdownFailures
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Resume Loader Settings
----------------------
identifier {1afa9c49-16ab-4a5c-901b-212802da9460}
inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}

Device options
--------------
identifier {97184ba5-0ff7-11e0-9a51-5cac4cc93cc8}
description Ramdisk Options
ramdisksdidevice partition=Y:
ramdisksdipath \Recovery\WindowsRE\boot.sdi

Setup Ramdisk Options
---------------------
identifier {ae5534e0-a924-466c-b836-758539a3ee3a}
description Ramdisk options
ramdisksdidevice boot
ramdisksdipath \boot\boot.sdi

========= End of CMD: =========

C:\Users\Connor Biggs\AppData\Local\2e26c49f moved successfully.

==== End of Fixlog ====

[Jbiggs]

ok... well I get to the windows animation then it flashes the blue screen and then throwes the startup repair at me

[JSntgRvr]

Download the enclosed file:

Save it next to FRST in the USB drive replacing the existing one. Run FRST as you did before, except that this time around click on the Fix button and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it in your next reply.

Attempt to boot in Normal Mode.

[Jbiggs]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 09-06-2012 01
Ran by SYSTEM at 2012-06-09 18:39:31 Run:2
Running from G:\

==============================================


========= bcdedit /deletevalue {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} custom:26000022 =========

The operation completed successfully.

========= End of CMD: =========


An error occurred while attempting to delete the specified data element.
Element not found.
The operation completed successfully.

========= bcdedit /set {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} bootems Yes =========

The operation completed successfully.

========= End of CMD: =========


==== End of Fixlog ====

[Jbiggs]

as u would guess no change in the problom

[JSntgRvr]

I need to consult this with FRST developer. Will post back promptly.

[Jbiggs]

go for it haha I understand it is frusterating

[Jbiggs]

thank you for you time patience and help

[JSntgRvr]

Boot to the Advanced Menu:

"Advanced Boot Options

Safe mode
Safe Mode With netowrking
Safe Mode With CMD prompt

Enable Boot Logging
Enable Low-resolutioon Video (640X480)
Directory services restoration mode
Debugging Mode
Disable Automatic Restart on System Failure
Disablle Driver Signature Enforcement

Start Windows normaly"

Select Disable Automatic Restart on System Failure

Post the entire contents of the Blue Screen error.

[Jbiggs]

*** STOP 0X0000007E (0XFFFFFFFFC0000005, 0XFFFFFA8004DD92B4, 0XFFFFF880037AA768, 0XFFFFF880037A9FC0)

[Jbiggs]

A PROBLEM HAS BEEN DETECTED AND WINDOWES HAS BEEN SHUT DOWN TO PREVENT DAMAGE TO YOUR COMPUTER

iF THIS SIS THE FIRST TIME YOU'HAVE SEEN THIS STOP WEEOE SCREEN, RESTART YOUR COMPUTER IF THIS SCREEN APPEARS AGAIN FOLLOW THESE STEPS.

CHECK TO BE SURE YOU HAVE ADQUET DISK SPACE IF A DRIVER IS IDENTIFIED IN THE STOP MESSAGE DISABLE THE DRIVER OR CHECK THE THE MANUFATUR FOR DRIVER UPDATESS TRY CHANGING VIDEO ADAPTERS

CHECK WITH YOUR HARDWARE VENDOR FOR ANY BIOS UPDATES DISABLE BIOS MEMORY OPTIONS SUCH AS CACHING OR SHADOWING IF YOU NEED TO USE SAFE MODE TO REMOVE OR SIDABLE COMPONETS RESTART YOUR COMPUTER PRESS F8 TO SELECT ADVANCED START UP OPTIONS AND THEN SELECT SAFE MODE

TECHNICAL INFORMATION
*** STOP 0X0000007E (0XFFFFFFFFC0000005, 0XFFFFFA8004DD92B4, 0XFFFFF880037AA768, 0XFFFFF880037A9FC0)

[Jbiggs]

"page fault in nonpage area*" 2nd line

[JSntgRvr]

That error message points to a driver, perhaps a video driver. Disconnect all peripherals and attempt to boot in Safe Mode.

[Jbiggs]

can not boot in safemode stopes at system32\driver\atipcie