Ref. from malware forum / Win7 won't start, restore points deleted

My Windows 7 Home Premium 64-bit system has become destabilized after a malware situation which I resolved under the direction of your malware forum. See this thread: https://forums.whatthetech.com/index.php?showtopic=131325.

As part of the cleanup process, I ran the Tweaking.com Windows All In One Repair tool, letting the prescan function execute its fixes and setting up chkdsk to perform a full scan and repair on the next boot. Then I clicked "restart in safe mode," within the program. Windows shut down, chkdsk didn't appear to run, and Windows tried to start in safe mode but failed. After a long time, I did a hard power off and tried again. Again it tried to start in safe mode. Again it failed. I ran System Restore from the F8 boot menu, but it failed and somehow deleted all my restore points. I tried to restart again. Every time, it failed at the same file.I ran startup repair and was eventually able to open Windows in safe mode, but now it goes directly to safe mode on its own.

Can you help me figure this out? I've just made a fresh backup of all my data.

Hello muddythewaters,

** Please note that in order to avoid data corruption and/or mechanical HDD failure for you must always have a minimum of 20 to 25% of the HDDs or partitions overall storage capacity available as free space where Windows is installed and between 10 and 15% of a HDDs overall storage capacity available as free space if there is data only on it, the free space allows for information to be copied to and from the drive efficiently particularily important for Windows file swapping and the installation of OS and AV updates.

Not having the above can render a computer inoperable if the HDD concerned has the OS on it due to the MBR (Master Boot Record) becoming damaged/corrupt, please see information here and here

 

Thanks for your reply. I'll work on deleting data. I had understood the threshold was 10% free space. I guess the system got there by deleting my restore points.

Here's an update: I was able to coax Windows to start in normal mode, using MSCONFIG, and I ran both a Check Disk on reboot and SFK /scannow. It seems to be operating pretty normally, but one of the issues that I raised in the malware forum seems to have come back. I get these random phantom windows – like a blank window, with a top bar but no buttons, and the window disappears when I click or right-click on it, but the bar remains. It tends to clear out if I click the desktop button at the lower-right corner of my windows screen. It's possible that when I rebooted using "last good configuration" windows rolled back a display driver update we had installed, which seemed to eliminate the phantom windows. Anyway, I'm now working with Windows 7 in normal mode and I've been able to create a system restore point.

Anyway, just ran CrystalDiskInfo 7.2.0 (the version that was available at the link you indicated). Results attached.

CrystalDisk shows that your HDD is failing and is running a bit on the warm side, both possibly caused by running on low free storage space, would suggest that you keep on freeing up space and then once done run Seatools for Dos to double check the SMART warning;

If possible select the tool that is appropriate for the brand of your hard drive TackTech if unsure use Seatools for Dos as it works well with many other brands;

Depending on the program it will create a bootable floppy or a bootable DVD/CD.

If the downloaded file is the .iso type use ImgBurn to burn the .iso file to a DVD/CD disk depending on your OS (select "Write image file to disc" option) and make the disk bootable.

 

RE ImgBurn: please use the custom install and uncheck the attached foistware such as "Install Entrusted Toolbar etc

 

Some info on the error reported can be found here

Can I run Seatools from a bootable USB thumb drive? The write function of my CD/DVD drive doesn't work well. It's an old computer, and I need to get a new one, but that's what I'm working with right now.

If you have managed to free up a fair bit of storage space, download and run SeaTools for Windows which you can get from here it can always be uninstalled once you are done with it.

Freed up about 95 GB on the hard drive. Ran the Seatools for Windows SMART test and it passed. Here's the log.

Should I run any other tests/repairs?

————— SeaTools for Windows v1.4.0.5 —————
10/28/2017 5:17:45 PM
Model Number: ST95005620AS
Serial Number: 5YX18SR3
Firmware Revision: SD24
SMART - Started 10/28/2017 5:17:45 PM
SMART - Pass 10/28/2017 5:17:50 PM
SMART - Started 10/28/2017 5:18:07 PM
SMART - Pass 10/28/2017 5:18:13 PM

The time taken for the tests suggests that you may have only run the short test, if correct, you need to run the Long Generic, this can take hrs depending on the capacity of the HDD and so is best left to run overnight or if the computer is not needed for the day, Seatools guide here

NB: My fault btw as I should have mentioned the need for running both the short and long tests, it is possible for a drive to pass one test but fail the other.

Ran the Long Generic test. Looks like it passed. Logs:
 

————— SeaTools for Windows v1.4.0.5 —————
10/28/2017 5:17:45 PM
Model Number: ST95005620AS
Serial Number: 5YX18SR3
Firmware Revision: SD24
SMART - Started 10/28/2017 5:17:45 PM
SMART - Pass 10/28/2017 5:17:50 PM
SMART - Started 10/28/2017 5:18:07 PM
SMART - Pass 10/28/2017 5:18:13 PM
Short DST - Started 10/28/2017 5:46:31 PM
Short DST - Pass 10/28/2017 5:48:04 PM
Identify - Started 10/28/2017 5:48:22 PM
Short Generic - Started 10/28/2017 5:50:59 PM
Short Generic - Pass 10/28/2017 5:52:55 PM
Identify - Started 10/28/2017 5:54:21 PM
Identify - Started 10/28/2017 5:57:25 PM
Long Generic - Started 10/29/2017 11:58:12 PM
Long Generic - Pass 10/30/2017 1:36:16 AM
 

Anything else I should test? Or should I jump back to malware forum to finish that process? Some of the original malware issues came back when I started windows using "last good configuration."

Thanks

Anything else I should test? Or should I jump back to malware forum to finish that process? Some of the original malware issues came back when I started windows using "last good configuration."

 

Malware removal is beyond my remit and something that only Juliet or another security expert can deal with, please refer back and reply to the reply #30 of Juliet here advising of the outcome of using the Last Known Good configuration suggestion.

The following only in the interim and once you receive a reply to your malware thread we must hold off here until given the all clear to continue;

Download then run Speccy (free) and post the resultant url for us, details here,  this will provide us with information about your computer hardware + any software that you have installed that may explain the present issue/s. 

Sounds good. For now, here's what came up: http://speccy.piriform.com/results/Fu4KlFwH1wjICFebSG4KNhp

For what it's worth, my computer seems to be working fine right now. I suspect a driver update or something I did during the malware removal process must have been what caused Windows to have trouble starting.

Thanks for the url 

As your malware thread is active again I can only bring the following to your attention for now, Speccy is also reporting a problem with your HDD, will hold off for now but will still be around.

We're wrapping up in the malware forum. Just cleaned the malware removal tools.

So based on these warnings, are you saying I need a new hard drive?

Juliet just told me we're officially done with the malware removal. I'm not seeing any ongoing issues now, but since we started looking into it, I want to make sure I follow through with you.