Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

a lot of errors and crashes...virus?


  • Please log in to reply

#16
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Either way is fine.

MBRCheck likes your MBR but reports you have a driver for RawDisk.
0x053EC000 \??\C:\Windows\system32\drivers\ElRawDsk.sys
This could be messing up your drive since you no longer have the program at least it is not in the uninstall list.

Right click on Computer and select Manage (Continue) then Device Manager. View, Show Hidden Drivers, then in the right pane open up the Non Plug and Play section and look for RawDisk or ElrawDsk. If you find it right click on it and Uninstall.

If you don't see it there then look under your hard drive. If you still can't find it then get Autoruns:

from
http://live.sysinter...om/autoruns.exe

Download Save and Run the program by right clicking and Run As Admin. You should be able to find it there and uncheck it.
  • 0

Advertisements


#17
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
system and applcacion event log and OTL

looks like there's still a VSS error? i'll try to fix the raw driver you were saying! :)= thanks!

Attached Files


  • 0

#18
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Forgot to mention what Speccy sees. Temps are OK. You have a Hatachi drive. You can get the Hitachi Drive Fitness test from:

http://pcsupport.abo...ownload.htm#DFT

Click on DOWNLOAD WinDFT

It is a Zip file. You will need to save it then right click on it and Extract All. Once you get the thing unzipped then you need to use a program like Free iso Burner :

http://www.freeisoburner.com/

(Download, save and install by right clicking and Run As Admin.)
You put in a CD and then right click on Free Iso Burner and point it at your iso that you just unzipped. And tell it to burn it. Once it burns you boot off it and then run the test. We want the Extended test which takes several hours.
This bypasses Windows and ensures that the drive itself is good.
  • 0

#19
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
For the VSS error. Suspect it is caused by Revo but you can try:





This issue occurs when using a 3rd party backup program that utilizes Windows VSS (Volume Shadow Service) and has its own requestor.

It looks like the requestor (the backup application) does not allow system writer to call back into their process and hence generates the error in the application log.

Step 1:
Check if the Volume Shadow Copy service is running on your computer or not.

To check for the same,

1. Click ‘Start’, type ‘services.msc’ and hit Enter.

2. Locate “Volume Shadow Copy” and check if the service is started.

3. If not ‘Start’ the service.

Step 2:

If the issue persists, you may have to make some changes in the registry.

1. The following example grants access to the "MyDomain\MyUser" account:

2. Click on Start, type regedit in the search box.

3. On the Registry Editor window, navigate to the below location:

HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>VSS>VssAccessControl <--- ADD KEY

MyDomain\MyUser = 1 <- ADD VALUE

Important: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following link:
http://windows.micro...up-the-registry

Step 3:

If you still come across the issue, to troubleshoot the error condition, you first need to determine what caused it by using the VssAdmin command line tool. After determining the cause of the error condition, follow the steps indicated for each possible cause.

Access the below link to know about Volume Shadow Copy Service Operations:

http://technet.micro.../cc734235(WS.10).aspx


Get Autoruns:

from
http://live.sysinter...om/autoruns.exe

Download Save and Run the program by right clicking and Run As Admin. File, Save, to your desktop, autoruns.arn, OK

Zip up or WinRar the file then ATTACH it. Do not copy and paste.
  • 0

#20
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
:) little issue perhaps... my laptop doesn't have any burner! What about if i use daemon tools?


and looking more mbr what about this file?
??\C:\Windows\SysWOW64\drivers\supersafer64.sys
  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Can't boot off it that way. You need to get a friend to make the CD for you.

Part of Spotmau
  • 0

#22
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
i almost forget, i did uninstsall ELRaw disk in the way you told me! :)

i'm having issue with the autorun file.arn, it's too big to attach, so i rar it, also sending OTL extras, just in case, and i'll try the procedure you are telling me, i think i did something similar alrteady, but let's give a try! :)
THanks!

Attached Files


  • 0

#23
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
the issue is that i don' t have a cd player on my pc! and in colombia where i live it's almost impossible to find out an external one!

:(
  • 0

#24
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
ok, verifying it http://technet.micro...c734021(v=ws.10).aspx

MSSearch Service Writeer and most important System writer gives to me estasdo: [5] esperando finalizaciones ... ?
  • 0

#25
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
here we go a copy of VSSadmin, to know what to do! :)

Attached Thumbnails

  • VSSadmin.jpg

  • 0

Advertisements


#26
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Doesn't seem to be a problem. I get the same response.

Run Autoruns again and click on Options then Filter Options then uncheck Hide Microsoft Entries and Hide Windows Entries then Rescan and send me the new file. Autoruns is still showing the RawDisk entry. I think it would be wise to uninstall TuneUp360 monitor or spotmau powersuite golden edition
  • 0

#27
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Also do you have a USB drive you could use instead of a CD?
  • 0

#28
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
hi!! i do have a usb, that i could use, sending also to you the new autorun scan.

i also tried again the fixit for windows search and it looks thast this time works. also i used a fix for x64 for VSS , but i don't know if it works.

really thanks for the help! :)

Attached Files


  • 0

#29
marcospritz2000

marcospritz2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
last errors of the applications
Windows (956) Windows: Error -1811 al abrir un archivo de registro C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log.

and system
Error de DCOM "1053" al intentar iniciar el servicio WSearch con argumentos "" para ejecutar el servidor:
{9E175B6D-F52A-11D8-B9A5-505054503030}

El servicio Conexión compartida a Internet (ICS) no respondió después de iniciar.

P.S. how can i use Win DFT with a usb?
  • 0

#30
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
http://www.isotousb.com/ should make a bootable USB drive from your iso.

I would run Autoruns and just uncheck WSearch, and then reboot. That should turn it off. You can live without it.

or you can find the file:

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log and see if you can open it in notepad. If it comes up as garbage or won't open then just delete it.

If you are still getting this error:

The server {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} did not register with DCOM within the required timeout.


Go into Autoruns and uncheck: AMD External Events Utility

I would uninstall your MyDefrag. We don't want to take a chance on it messing up the drive.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP