[senselocke]

Since the system had me log in to my account as soon as RE had started, I also tried to use d:\windows\system32 cipher /x as soon as chkdsk was finished--it told me it "couldn't find the file specified", same error as last time. I'm thinking whatever service should be running to verify EFS or generate File Encryption Keys isn't installed or running. Whatever cipher needs, it's not there or not running.

[Advertisements]

Since the system had me log in to my account as soon as RE had started, I also tried to use d:\windows\system32 cipher /x as soon as chkdsk was finished--it told me it "couldn't find the file specified", same error as last time. I'm thinking whatever service should be running to verify EFS or generate File Encryption Keys isn't installed or running. Whatever cipher needs, it's not there or not running.

Chances are you must logon into Windows to run Cipher.exe
 
Download the attached file [attachment=78421:fixlist.txt] and save it in the same directory FRST64 is saved in the USB drive.

• Start FRST64.
• Press the Fix button.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from (USB drive).

Please copy and paste its contents in your next reply.

 

Attempt to boot in Normal Mode. If an error is experienced, post the error contents.

[JSntgRvr]

Since the system had me log in to my account as soon as RE had started, I also tried to use d:\windows\system32 cipher /x as soon as chkdsk was finished--it told me it "couldn't find the file specified", same error as last time. I'm thinking whatever service should be running to verify EFS or generate File Encryption Keys isn't installed or running. Whatever cipher needs, it's not there or not running.

Chances are you must logon into Windows to run Cipher.exe
 
Download the attached file [attachment=78421:fixlist.txt] and save it in the same directory FRST64 is saved in the USB drive.

• Start FRST64.
• Press the Fix button.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from (USB drive).

Please copy and paste its contents in your next reply.

 

Attempt to boot in Normal Mode. If an error is experienced, post the error contents.

[senselocke]

 

Fix result of Farbar Recovery Scan Tool (x64) Version:31-08-2015

Ran by SYSTEM (2015-09-11 09:09:19) Run:1

Running from F:\

Boot Mode: Recovery

==============================================

 

fixlist content:

*****************

HKLM\...\Winlogon: [Userinit] 

HKLM-x32\...\Winlogon: [Userinit]  [X]

HKLM\...\Winlogon: [Shell]  [0 ] () <=== ATTENTION

HKLM-x32\...\Winlogon: [Shell]  [0 ] () <=== ATTENTION

HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess?

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?

HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI]  <==== ATTENTION

Replace: C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_ae2511475093798f\ole32.dll C:\Windows\SysWOW64\ole32.dll

Replace: C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5\ole32.dll C:\Windows\System32\ole32.dll

Reg: Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

*****************

 

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value restored successfully

HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value restored successfully

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value restored successfully

HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value restored successfully

HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\\Default => value restored successfully

HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => value restored successfully

HKLM\Software\Classes\CLSID\{7986d495-ce42-4926-8afc-26dfa299cadb}\InprocServer32\\Default => value restored successfully

"C:\Windows\SysWOW64\ole32.dll" => not found

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_ae2511475093798f\ole32.dll copied successfully to C:\Windows\SysWOW64\ole32.dll

"C:\Windows\System32\ole32.dll" => not found

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5\ole32.dll copied successfully to C:\Windows\System32\ole32.dll

 

========= Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" =========

 

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

    Userinit    REG_SZ    \system32\userinit.exe,

    Shell    REG_SZ    Explorer.exe

 

 

 

========= End of Reg: =========

 

 

==== End of Fixlog 09:09:20 ====

BSOD on "Start Windows Normally" states:

 

STOP: c0000135 The program can't start because %hs is missing from your computer. Try reinstalling the program to fix this problem.

[JSntgRvr]

The Software hive has missing components.

 

 

Open FRST as you did before.

Type the following in the edit box on FRST, after "Search:".

System;Software

It then should look like:

Search: System;Software

Click Search Files button and post the log (Search.txt) it makes on the USB drive in your next reply.
 

[senselocke]

 

Farbar Recovery Scan Tool (x64) Version:31-08-2015

Ran by SYSTEM (2015-09-12 08:18:07)

Running from F:\

Boot Mode: Recovery

 

================== Search Files: "System;Software" =============

 

C:\Windows\System32\config\SOFTWARE

[2009-07-13 18:34][2015-09-11 06:11] 0262144 ____A () C4E018CD8350CD0D7D708F48F2EFE48A

 

C:\Windows\System32\config\SYSTEM

[2009-07-13 18:34][2015-09-11 06:11] 17039360 ____A () 41F0A8F11ECD2C1CF2017205D1F3302C

 

C:\Windows\System32\config\RegBack\SOFTWARE

[2015-04-05 14:50][2015-08-12 03:34] 72744960 ____A () 

 

C:\Windows\System32\config\RegBack\SYSTEM

[2015-09-11 06:10][2015-09-11 06:10] 0000000 ____A () 

 

C:\ProgramData\AVAST Software\Avast\ng\registry\SOFTWARE

[2015-07-02 09:18][2015-07-02 09:18] 46059520 ____A () 

 

C:\ProgramData\AVAST Software\Avast\ng\registry\SYSTEM

[2015-07-02 09:18][2015-07-02 09:18] 9998336 ____A () EA96D02ADD2BC9BA18D0740E4FFE7888

 

C:\FRST\Hives\SOFTWARE

[2015-09-10 13:17][2015-08-27 05:59] 0000000 ____A () 

 

C:\FRST\Hives\SYSTEM

[2015-09-10 12:19][2015-08-27 05:59] 17039360 ____A () 04B8CF386F52D00105188B17792E6C8E

 

C:\found.000\dir0003.chk\SOFTWARE

[2015-04-05 14:50][2015-08-23 19:47] 72900608 ____A () 

 

X:\Windows\System32\config\SOFTWARE

[2010-11-20 06:42][2010-11-20 08:42] 3932160 ____A () 0EC68CA975FC7CB33D168151B9552788

 

X:\Windows\System32\config\SYSTEM

[2010-11-20 06:42][2010-11-20 08:42] 2097152 ____A () BCC99333C3800D9C355BFDA6E60CAF79

 

X:\Windows\System32\config\SOFTWARE

[2010-11-20 06:42][2010-11-20 08:42] 3932160 ____A () 0EC68CA975FC7CB33D168151B9552788

 

X:\Windows\System32\config\SYSTEM

[2010-11-20 06:42][2010-11-20 08:42] 2097152 ____A () BCC99333C3800D9C355BFDA6E60CAF79

 

====== End of Search ======

[JSntgRvr]

Your Registry is corrupted and here is no good backup we can use. Lets run cipher and see if the command is accepted. Nothing to lose. The installation however wont be able to be recovered.

 

Download the attached file [attachment=78452:fixlist.txt] and save it in the same directory FRST64 is saved in the USB drive.

• Start FRST64.
• Press the Fix button.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from (USB drive).

Please copy and paste its contents in your next reply.

[senselocke]

 

Fix result of Farbar Recovery Scan Tool (x64) Version:31-08-2015

Ran by SYSTEM (2015-09-13 08:16:13) Run:2

Running from F:\

Boot Mode: Recovery

==============================================

 

fixlist content:

*****************

cmd: cipher /x

*****************

 

 

=========  cipher /x =========

 

'cipher' is not recognized as an internal or external command,

operable program or batch file.

 

========= End of CMD: =========

 

 

==== End of Fixlog 08:16:13 ====

I can get "cipher" to run, but I have to run "d:\windows\system32\cipher" to do so (well, cipher /?), or I have to navigate to d:\windows\system32\ and run it from there.The error when running cipher /x like that is this:

 

The system cannot find the file specified

[JSntgRvr]

Have you ever backed-up your certificate prior to the onset of this issue?

[senselocke]

Nope, I had not. Which is, I know, stupid. But I figured I had a full backup, so it wasn't needed (d'oh).

[JSntgRvr]

I don't know if the link given you by BrianDrab will work in RE, or thru a parallel install as you did before. If it doesn't, I believe this is it. There are no more alternatives.