[panda_23]

Hello,

 

I am currently experiencing issues with my Toshiba Satellite P750 Laptop running Windows 7 Home Premium.

 

I recently started using the laptop after 3 month holiday, it worked fine initially, I basically started updating any programs that asked to be, for example: All windows updates, java, avast etc.

 

After one of the many update restarts, the laptop booted to a black screen with a moveable cursor however that is as far as it goes. I then tried starting in safe mode, when starting in safe mode, during the generation of the list, the system appears to hang at "\windows\system32\drivers\aswRvrt.sys" before moving on to a black screen with a moveable cursor.

 

Have reviewed similar issues on forums however each appears to be unique enough that my basic computer knowledge cannot adjust confidently enough for my specifics.

 

Any assistance that can be offered in this matter would be greatly appreciated.

 

Thank you.

[Advertisements]

Is this a 32 or 64 bit system ?

Do you have the windows CD or a spare USB stick

[Essexboy]

Is this a 32 or 64 bit system ?

Do you have the windows CD or a spare USB stick

[panda_23]

Sorry, the machine is a 64bit system.

 

I do not have the windows cd, however i do have spare USB's

 

I do have access to another laptop that is running windows 7 64 bit if that is any help.

[Essexboy]

Download the following three programmes to your desktop :


1. Rufus

For 64bit systems
2. Windows 7 64bit RC I will PM link
3. Farbar Recovery Scan Tool x64

Insert the USB stick Then run Rufus


Select the ISO file on the desktop via the ISO icon.

Press Start Burn

Then copy FRST to the same USB





Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

Windows 7 and Vista screenshots

When you reboot you will see this.
Click repair my computer


Select your operating system


Select Command prompt


At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe or e:\frst.exe dependant on system
and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[panda_23]

Have completed the above instructions.

 

During the scan, got a popup saying the following: "The file or directory C:\\Windows\ntbtlog.txt is corrupt and unreadable. Please run the Chkdsk utility"

During this popup the scan continued and got the Scan complete popup at the end of the scan.

 

As requested have pasted the scan results below:

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-08-2015
Ran by SYSTEM on MININT-3108158 (08-08-2015 22:06:06)
Running from f:\
Platform: Windows 7 Home Premium (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-01-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1519016 2011-01-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2010-12-20] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2010-12-13] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-06-28] (Apple Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1793736 2015-04-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [SVPWUTIL] => C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [532480 2010-11-09] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-16] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [252792 2010-06-04] (TOSHIBA)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294712 2010-11-29] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TRCMan] => C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe [714104 2010-11-02] (TOSHIBA Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1110360 2010-05-03] (Symantec Corporation)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-09] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3695928 2009-08-18] (brother)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-30] (Avast Software s.r.o.)
HKLM-x32\...\Run: [McDiags AutoLaunch] => [X]
HKLM-x32\...\Run: [Appandora device service] => C:\Program Files (x86)\Appandora\AppandoraDeviceService.exe [736768 2014-05-18] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Andrew\...\Run: [Google Update] => C:\Users\Andrew\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-12-24] (Google Inc.)
HKU\Andrew\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\UpdatusUser\...\Run: [] => [X]
HKU\UpdatusUser\...\RunOnce: [SysOff] => C:\Windows\SysWOW64\SYSPREP\ClosespV.exe
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [167312 2015-04-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [147576 2015-04-08] (NVIDIA Corporation)

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-30] (Avast Software s.r.o.)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-03-30] (Avast Software)
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-18] (Microsoft Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2782552 2010-05-03] (Symantec Corporation)
S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.202\SymcPCCULaunchSvc.exe [103792 2010-02-02] (Symantec Corporation)
S2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.202\ccSvcHst.exe [126392 2009-08-24] (Symantec Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [X]
S3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-30] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-30] (Avast Software s.r.o.)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-30] (Avast Software s.r.o.)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-30] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-30] (Avast Software s.r.o.)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-03-30] (Avast Software s.r.o.)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-30] (Avast Software s.r.o.)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-03-30] ()
S3 DVB7700ALL; C:\Windows\System32\Drivers\dvb7700all.sys [711168 2013-07-30] (DiBcom)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [203888 2012-03-20] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [98688 2012-03-20] (Microsoft Corporation)
S2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-03-30] (Avast Software)
S3 Winsock; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-08 22:05 - 2015-08-08 22:06 - 00000000 ____D C:\FRST

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-08 03:33 - 2009-07-13 20:51 - 00151802 _____ C:\Windows\setupact.log
2015-08-08 03:32 - 2010-11-20 19:47 - 00688716 _____ C:\Windows\PFRO.log
2015-08-06 01:44 - 2012-03-13 20:55 - 00000000 ____D C:\users\Andrew

Some files in TEMP:
====================
C:\Users\Andrew\AppData\Local\Temp\ICReinstall_CR_Downloader_for_zsnes.exe
C:\Users\Andrew\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Andrew\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Andrew\AppData\Local\Temp\nsc6554.exe
C:\Users\Andrew\AppData\Local\Temp\nscEA35.exe
C:\Users\Andrew\AppData\Local\Temp\nsh5635.exe
C:\Users\Andrew\AppData\Local\Temp\nsh5DD4.exe
C:\Users\Andrew\AppData\Local\Temp\nsjCB4F.exe
C:\Users\Andrew\AppData\Local\Temp\nsrE479.exe
C:\Users\Andrew\AppData\Local\Temp\nsrEFC1.exe
C:\Users\Andrew\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Andrew\AppData\Local\Temp\qtxlmepr.dll
C:\Users\Andrew\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Andrew\AppData\Local\Temp\sfamcc00002.dll
C:\Users\Andrew\AppData\Local\Temp\sfamcc00003.dll
C:\Users\Andrew\AppData\Local\Temp\sfamcc00004.dll
C:\Users\Andrew\AppData\Local\Temp\sfextra.dll
C:\Users\Andrew\AppData\Local\Temp\_is2D41.exe
C:\Users\Andrew\AppData\Local\Temp\{26348D81-2173-428F-B0F4-77901B807AA6}-GoogleUpdateSetup.exe

==================== Known DLLs (Whitelisted) =========================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\dnsapi.dll => MD5 is legit
C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE Association (Whitelisted) =============


==================== Restore Points =========================


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8099.77 MB
Available physical RAM: 7248.59 MB
Total Virtual: 8097.91 MB
Available Virtual: 7245.59 MB

==================== Drives ================================

Drive c: (S3A9988D004) (Fixed) (Total:685.84 GB) (Free:288.65 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (System) (Fixed) (Total:1.46 GB) (Free:0.96 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive f: (DVD_ROM) (Removable) (Total:29.25 GB) (Free:29 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 698.6 GB) (Disk ID: CEFF3933)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=685.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11.3 GB) - (Type=17)

========================================================
Disk: 1 (Size: 29.3 GB) (Disk ID: 02D4E8E6)
Partition 1: (Active) - (Size=29.2 GB) - (Type=07 NTFS)


LastRegBack: 2015-07-07 00:31

==================== End of log ============================

[Essexboy]

At the moment windows is halfway through updating

Run the recovery console and select command prompt

Then type in the following command followed by enter :

chkdsk c: /r

Once it has completed try a normal boot

[panda_23]

Thank you so much...

 

The CHKDSK worked, now the laptop is booting to the desktop and all seems well.

 

The log that was created by CHKDSK wasn't saved however I typed it out in case the issue was elsewhere.

 

All is working now so thank you very much for your prompt response. Apologies that it wasn't specificly a malware issue.

 

Yourt help has been much appreciated.

[Essexboy]

Not a problem, glad that all is now resolved ...

Keep the recovery console USB handy as I usually find if you do that you never need it again

[panda_23]

Will do.

 

Thank you so much again.

[Essexboy]

My pleasure, thank you for the donation

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.