[joecool90]

Can you see the attachment? I can't see it on my end.

[Advertisements]

When i tried to add myself as a new user it said 'Something went wrong - Try again, or tap Cancel to set up your device later.' Still in safe mode with networking.

[joecool90]

When i tried to add myself as a new user it said 'Something went wrong - Try again, or tap Cancel to set up your device later.' Still in safe mode with networking.

[joecool90]

3rd try

[RKinner]

No attachment. I am on a trip until Saturday

[joecool90]

New try

[joecool90]

Should work now!

Attached Files

•  ntbtlog.txt   2.92MB   664 downloads

[RKinner]

In first put cad.sys in the search box then search files you will get one file please post

[RKinner]

For the new user you need to pick a different name

[joecool90]

Farbar Recovery Scan Tool (x64) Version: 01.12.2018 01
Ran by Toshiba-laptop (05-12-2018 21:18:43)
Running from C:\Users\Toshiba-laptop\Desktop
Boot Mode: Normal

================== Search Files: "cad.sys" =============

C:\Windows\WinSxS\amd64_dual_chargearbitration.inf_31bf3856ad364e35_10.0.17134.1_none_04f44cd2999f80d3\CAD.sys
[2018-04-11 23:33][2018-04-11 23:33] 000060320 _____ (Microsoft Corporation) 9983FF8D9834F2E67787F4BDC42A8E36 [File is digitally signed]

C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_07ec1f03e5e57746\CAD.sys
[2018-04-11 23:33][2018-04-11 23:33] 000060320 _____ (Microsoft Corporation) 9983FF8D9834F2E67787F4BDC42A8E36 [File is digitally signed]

C:\Windows\System32\drivers\CAD.sys
[2018-04-11 23:33][2018-04-11 23:33] 000060320 _____ (Microsoft Corporation) 9983FF8D9834F2E67787F4BDC42A8E36 [File is digitally signed]


====== End of Search ======

[joecool90]

For some reason my laptop is now working in Normal mode for at least 20 minutes now

 

I've also done the extra administrator mode successfully.

[RKinner]

I suppose it's too much to hope for that looking at the cad.sys file made Windows fix it. Can you post the ntbtlog again?

[joecool90]

I'll post later today thanks

[RKinner]

No hurry. I'm on a trip. Will be off line until very late today.

[joecool90]

See attached.  ntbtlog.txt   91.45KB   524 downloads

[RKinner]

In your ntbtlog I see:

 

BOOTLOG_NOT_LOADED \SystemRoot\system32\DRIVERS\gzflt.sys
BOOTLOG_NOT_LOADED \SystemRoot\system32\DRIVERS\trufos.sys

 

The files are from BitDefender and should have been removed when BitDefender was removed.  If you remember which version you had you can get a special tool to remove leftovers.

 

https://www.bitdefen...umer_trial.html

 

or try the generic tool from BleepingComputer:

 

https://www.bleeping...uninstall-tool/

 

If that doesn't work we can put

 

gzflt.sys;trufos.sys

 

in the FRST Search Box and hit Search Registry.  You will get one file.  Please post.

 

You might want to uninstall MBAM.  We had a rash of no boots because of a problem with one of their updates a while back.  You can reinstall it when things have settled down.

 

We can check your temps with:

 

Speedfan

 

http://www.filehippo...nload_speedfan/

Download, save and Install it (Win 7+ or Vista right click and Run As Admin.) then run it (Win 7+ or Vista right click and Run As Admin.).

It will tell you your temps in real time tho the default is to show the hard drive temp in the systray.  You can change it:  Hit Configure then click on the highest temp and check Show in tray.  With no other programs running what is the highest temp you see?  Run an anti-virus scan, play one of your games or watch a video for at least 5 minutes.  What is the highest temp now?
 

We don't really want it to go over about 65 under load.  If it does it usually means either the fan is defective (speedfan should tell you your fan speed so you can see if it is running) or (most likely) the interface between the fan and the heatsink is clogged with dust. The best fix for a clogged heatsink is to remove the fan (not the heatsink or heatpipe) and vacuum out the heatsink.  However on some PCs this is major surgery.  Sometimes you can blow air backwards through the exhaust vent while vacuuming at the input vent and if you are lucky it may clear the heatsink.  Don't do it too long as the fan may overrev.

 

 

We can check your system files with dism & sfc:

Open an elevated command prompt:

http://www.howtogeek...-in-windows-10/
http://www.eightforu...indows-8-a.html

(If you open an elevated Command Prompt properly it will say Administrator: Command Prompt in the margin at the top of the window)


Once you have an elevated command prompt:

Type:

 DISM  /Online  /Cleanup-Image  /RestoreHealth

 (I use two spaces so you can be sure to see where one space goes.)
Hit Enter.  This will take a while (10-20 minutes) to complete.  Once the prompt returns:

Reboot.  Open an elevated Command Prompt again and type (with an Enter after the line):
 

sfc  /scannow

This will also take a few minutes.  

When it finishes it will say one of the following:

Windows did not find any integrity violations (a good thing)
Windows Resource Protection found corrupt files and repaired them (a good thing)
Windows Resource Protection found corrupt files but was unable to fix some (or all) of them (not a good thing)

If you get the last result then type:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  %UserProfile%\desktop\junk.txt

Hit Enter.  Then type::

 

notepad  %UserProfile%\desktop\junk.txt

Hit Enter.

 Copy the text from notepad and paste it into a reply.


After you finish SFC, regardless of the result:



1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)