[BrianDrab]

No it is not. It doesn't appear to be working then. We'll have to try something else.

 

Your Memory.dmp showed the following. 

 

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc000d7160290, String that identifies the problem.
Arg2: ffffffffc0000006, Error Code.
Arg3: ffffc000d74efb20
Arg4: 0000000000000000

 

ADDITIONAL_DEBUG_TEXT:  Verification of a KnownDLL failed.

 

The DLL that failed to verify was CRYPT32.dll

 

This is a serious error which is why I wanted to try a System Restore first. What exactly is showing on your screen?

[Advertisements]

it is still trying to do system restore.. how do I stop it?

[TicaW17]

it is still trying to do system restore.. how do I stop it?

[BrianDrab]

OK, let's do this. You will just have to power off your machine and then turn it back on.

 

Step#1 - File Identification
1. Run FRST64 again. You will have to get to the recovery console command-prompt again.
2. Type or Copy/Paste (to avoid typos) crypt32.dll into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will create a file on your USB drive named Search.txt. Can you copy/paste the contents of this into your next post?

[TicaW17]

Farbar Recovery Scan Tool (x64) Version: 07-02-2015
Ran by SYSTEM at 2015-02-07 23:26:17
Running from E:\
Boot Mode: Recovery

================== Search Files: "crypt32.dll" =============

C:\Windows\WinSxS\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.17476_none_f01c4200f963899d\crypt32.dll
[2014-12-10 05:31][2014-10-30 15:38] 1612992 ____A (Microsoft Corporation) 98C136EA9D0CA9C010FE49D863D29C6D

C:\Windows\WinSxS\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.16431_none_f0429706f9478185\crypt32.dll
[2014-03-18 02:13][2014-12-11 17:08] 0252956 ____A () 3E6B17AE547FB9D6553AD7504631406F

C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.17476_none_4c3add84b1c0fad3\crypt32.dll
[2014-12-10 05:31][2014-10-30 15:39] 1970432 ____A (Microsoft Corporation) 65B337D2A6CAF64538C03A8C0722CD86

C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.16431_none_4c61328ab1a4f2bb\crypt32.dll
[2014-03-18 02:13][2014-12-11 16:41] 0288926 ____A () 3586785B588B061EA09A85938A29CAB2

C:\Windows\SysWOW64\crypt32.dll
[2014-12-10 05:31][2014-10-30 15:38] 1612992 ____A (Microsoft Corporation) 98C136EA9D0CA9C010FE49D863D29C6D

C:\Windows\System32\crypt32.dll
[2014-12-10 05:31][2014-10-30 15:39] 1970432 ____A (Microsoft Corporation) 65B337D2A6CAF64538C03A8C0722CD86

X:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.16431_none_4c61328ab1a4f2bb\crypt32.dll
[2014-03-18 01:38][2014-03-18 01:38] 1943536 ____A (Microsoft Corporation) 6EFAF0D87291F9FBD7C0ED3BD56511AA

X:\Windows\System32\crypt32.dll
[2014-03-18 01:38][2014-03-18 01:38] 1943536 ____A (Microsoft Corporation) 6EFAF0D87291F9FBD7C0ED3BD56511AA

====== End Of Search ======

[BrianDrab]

Thank you. Please do the following.

 

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

1. Download crypt32.dll to your USB drive.
2. Download attached file and save it to the USB drive.  fixlist.txt   200bytes   192 downloads 
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the USB drive).
3. Run FRST64.
4. Press the Fix button just once and wait.
5. When finished FRST64 will generate a log on the USB drive (Fixlog.txt). Please post the contents of it in your reply.

 

 

[TicaW17]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by SYSTEM at 2015-02-08 00:00:07 Run:1
Running from E:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
replace: e:\crypt32.dll c:\windows\system32\crypt32.dll
replace: e:\crypt32.dll C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.17476_none_4c3add84b1c0fad3\crypt32.dll
*****************

c:\windows\system32\crypt32.dll => Moved successfully.
e:\crypt32.dll copied successfully to c:\windows\system32\crypt32.dll
C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.17476_none_4c3add84b1c0fad3\crypt32.dll => Moved successfully.
e:\crypt32.dll copied successfully to C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.3.9600.17476_none_4c3add84b1c0fad3\crypt32.dll

==== End of Fixlog 00:00:07 ====

[BrianDrab]

Good job. Reboot your computer and see what happens. Let me know.

[TicaW17]

computer freezes it never gets to the sign in just a black screen after logo

[BrianDrab]

Did it get farther this time though?

 

Prior to us doing this it was just in a reboot cycle correct?

 

Are you able to boot into Safe Mode now?

[TicaW17]

ok I restarted the computer again and it went it the recovery again giving me the option to advanced options or restart pc because windows wasn't able to load correctly

[BrianDrab]

Please provide me with an updated FRST log. Also, I'm turning in for the evening and will pick back up first thing in the morning.

 

Step#1 - Fresh Set of Logs
1. Open FRST64.exe
2. Press Scan button.
3. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the USB drive)
4. Please copy and paste log back here.
 
 

[TicaW17]

Thank you for all the help so far I really appreciate it....

[TicaW17]

ha my computer just logged into safe mode.. took forever but at least that is a good sign..

it keeps freezing and a window pops up to choose end process or cancel

Edited by TicaW17, 07 February 2015 - 11:52 PM.

[BrianDrab]

Yes, that is a good sign. Are you able to run FRST64.exe in Safe mode or is the freezing preventing you from doing it? Also, are you able to back up all of your critical data in case your machine isn't recoverable? If you can get logs from safe mode that would be best. Use the instructions below. If you can't please get a new FRST log from the recovery environment and post that. Thank you.

 

Step#1 - Fresh Set of Logs
 1. Right click on FRST64.exe and select Run as administrator. When the tool opens click Yes to disclaimer.
2. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running.
3. Press Scan button.
4. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
5. Please copy and paste log back here.
6. Because you selected the Addition.txt check box this log will be created as well. Please copy and paste this log as well.
 
 
 
Items for your next post
1. FRST and Addition logs

[BrianDrab]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.