ralphyde

August 28, 2014

In my previous topic (gateway-laptop-with-ssd-not-find-vista-sp2-wont-start-pxe-e76 ) , I was unable to restart my Gateway 32bit Vista laptop, except by using the Gateway Recovery management Partition. and doing a "Recovery with automatic data backup."

This recovery worked flawlessly, and recovered Vista to its 2008 level, including 60 associated programs and Windows updates, and built an associated 23 gig BACKUP file which was stored in the top level of the Local Disk (C:) directory.

It included a top level directory folder named: 14-08-23 12:39 AM, beneath which were folders, the same folder names that Vista initially builds in its structure including; Documents, Google, Graphics, Intel, Perflogs, Program files, System Volume Information, Users, and Windows, along with additional folders that had existed in the previous version on my computer, such as AmiPro, Downloads, Quicken98, and other programs and folders of mine, built since the previous recovery when I'd replaced a failing hard drive with a Crucial SSD.

However, after recovering to this stage, I did not know the proper way to continue the recovery, how to get this backup structure back into the Local Disk (C:) structure in place of the one the recovery had built.

I thought the first priority would be to continue applying updates to the system using Windows Update. But I ran into a problem with Windows Update, so went ahead and used the standalone installs of SP1 and then SP2, but Windows Update is still not working.

And I still have not put the backed up directory structure back in place, and I don't even know how to do that. So I'm not sure what to do next, and am requesting any assistance as to the proper way to recover from this situation.

I will make an offline backup of that BACKUP directory, before I do anything. And if I have to go back and start over, I am willing to do that, too, in the case that I have done things in the wrong order.

I am 76 years old and struggling to get this recovery right, so I would appreciate any help anyone could give me as to the proper method of doing this recovery to get me back to where I was before the startup problem.

Thank you very much,

Ralphyde

August 25, 2014

Successful startup, but two new problems to deal with. I have also downloaded and installed SP-1 and SP-2

Windows Update has not been working since startup. It was an old version, 7.0, so I thought a newer version might get around the problem, so I installed the 7.4 agent, since the latest 7.6 wasn't available for downloading and installing. But with 7.4 agent, I'm still having problems, says it isn't started, though I have put in the recommended settings.

The other problem or question is: How to use the BACKUP file from the rebuild run to replace the new (old - 2008) system that was restored.

The Recovery from the recovery partition (with saving data) built a folder called BACKUP with folders under the Local Disk (C:) directory entry

It has the same directory structure as the newly built one all the way down through WINDOWS, with all the previous contents.

What I need to know is whether I can just replace the newly built structure with the Backup structure, that would put the computer back the way it was before the problem and would be the ideal solution if it could be done.

Thanks for any assistance with either of the two problems

Ralphyde

August 23, 2014

Well, I bit the bullet today, and ran the Windows restore (with saving data option) program from my recovery partition. It ran flawlessly an installed the 2008 version of Windows Vista, along with 60 associated programs and Windows update.

I turned on wi-fi and tried to run Windows Update, to get some of the early updates, with setting of - Let me decide which ones to download and install. I hoped to create smaller more manageable batches to install. But that old version of Windows Update wouldn't give me anything.

I then installed and ran my copy of Malwarebytes Pro to shield the system while on wi-fi, and ran a scan, finding no problems.

Now I need to find out how to bring my Windows Vista up to SP2 level.

Can someone please tell me how? Can I skip the individual fixes and go right to Sp1, and then straight to SP2? And will that give me an updated Windows Update as; well? I appreciate any knowledge about this. Thanks.

ralphyde

August 22, 2014

I have a Gateway P-6301 Laptop computer that had a failing hard drive in 2013, which I successfully replaced with a Crucial SSD, then recovered the factory Windows Vista from the recovery partition, then applied all the updates to bring it up to SP-2, and reinstalled my programs, including some that will only run on 32 bit machines (like AmiPro).

It has been running flawlessly since then, as I keep it healthy with Malwarebytes Pro and System Mechanic. So it had no malware on it, and was running fine through August 20.

But when I tried to start it on August 21, it got only to the black screen with the cursor in the middle, and stayed that way forever. instead of bringing up the Windows icon and password dialog. Pressing the start button would shut it down after about 50 seconds.

Starting it with PF8 would bring up the repair choices, but Windows would not come up in Safe mode either, nor would command prompt, or directory services.

The Repair Computer option, would allow me to access the Gateway System Recovery Options screen showing the following choices: startup repair, system restore, Windows complete PC restore,Windows Memory diagnostic tool, command prompt, and recovery manager.

Startup repair ran through several tests all of which came back with code 0x0, then "boot status indicates that the OS booted successfully". and "Startup Repair could not detect a problem."

System Restore didn't do anything.

The Memory diagnostic tool ran successfully.

When I try to startup with PF12, it shows whats happening quickly, and the Error PXE-E76 flashes by "Bad or missing multicast discovery address" Then PXE-M0F "Exiting PXE-ROM"

I tried changing the start device order in the BIOS to no avail.

It seems like the link to the part of the strartup routine that puts up the Windows icon and the signon dialog is lost.

If all else fails, it appears that I'll have to bite the bullet and do a recovery from the recovery partition, saving data but putting Vista back to 2008 status, then have to update to SP2 again. I'm hoping there's something easier than that long process..

I would appreciate any assistance with this problem.

Thanks

ralphyde

October 26, 2013

Amaziingly, I've gotten on today normally, after several more crashes. This time (it always comes up to the signon screen, giving me a choice of Ralph (admin) or Guest (no signon)), but if I choose Ralph, it goes into a Welcome loop, then crashes.

This time, I got on as Guest, and that desktop came up, allowiing me to get onto Chrome, as well as this forum, and even Windows Explorer, on which I copied some of my vital files to a 16G flash drive. Most were already threre. The system runs smoothly and nice as long as I don't try to sign on, which is where there is an unwriteable sector, I think.

Hopefully, now, I have most of what I'll need to migrate to my new Windows 7 laptop, when it arrives.

Though I'm not sure about my Windows Mail.

October 25, 2013

Yes, Ron warned me that other symptoms were indicating a failing hard drive, but I was still able to get on and work normally for hours at a time over a period of weeks. But now it seems the end has come.

I have already ordered a Windows 7 laptop to replace it, but hoped to keep it going for a few more days, perhaps. And I'm hoping that my Malwarebytes Secure Backups will be restorable to my new Toshiba Windows 7 laptop.

But today, an attempted normal startup got to the signon screen, I signed on, then it went to the 'welcome' screen for about 30 minutes, before crashing with the following message:

STOP: c000021a {Fatal System Error}

The Windows subsystem system process terminated unexpectedly with a status of

0xc0000005 (0x75879529 0x00bef3f4).

The system has been shut down.

collecting data for crash dump. . .

...

contact your system admin or technical support group for further assistance.

So that's where I stand now.

Using F8 on startup, I am able to get to the repair screen, but don't know if any options would help.

Have tried to get up in safe mode, but no go.

Any suggestions?

October 24, 2013

My Vista laptoop Has been having troubles, but I have been able to get on up til now.

Today I was able to get to the Windows signon, then sighnon, but then the computer went into an endless 'welcome' loop. Eventually forced shutdown.

Have tried to get on in Safe Mode. Same thing

Finally I got the following Windows error message:

The instruction at 0x00bf1e8e referenced memory at 0x000001fe. The memory could not be written. Click OK to terminate program.

Anyone got any ideas as to how to get past this?

Thanks

October 22, 2013

Thanks for all the reference material. I am currently using Malwarebytes Pro, as well as Secure Backup.

And I am a subscriber to Windows Secrets, though I can't keep up with it.

Last night I decided to see if I could run a Malwarebytes full scan, just to see if my computer could do it

without freezing up. And first, I scheduled a CHKDSK /f.

I started around 9:45. When I went to bed after 11, Malwarebytes Pro showed one issue found.

But when I checked at 2:30 AM, the screen was black, and nothing I could do would revive it, so I closed it.

In the morning, I restarted (chose normal startup), but couldn't find any output from the full scan. The event log

showed that at 2:06, there were a gupdate, 2 system restore point creations, another gupdate, and a VSS at 2:09.

(I don't know what these mean). I haven't found any output from the Malwarebytes run, and nothing shows in its

history tab.

The output from the CHKDSK run shows the same index rebuilding involving taskmgr and wmplayer, which I don't

understand. Here is the output from that run:

Log Name: Application

Source: Microsoft-Windows-Wininit

Date: 10/21/2013 9:46:58 PM

Event ID: 1001

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: RALPH-PC

Description:

Checking file system on C:

The type of the file system is NTFS.

A disk check has been scheduled.

Windows will now check the disk.

318912 file records processed.

1516 large file records processed.

0 bad file records processed.

0 EA records processed.

68 reparse records processed.

Unable to locate the file name attribute of index entry wmplayer.exe

of index $I30 with parent 0xcb in file 0x3688f.

Deleting index entry wmplayer.exe in index $I30 of file 203.

Unable to locate the file name attribute of index entry inetpp.dll

of index $I30 with parent 0x5b3 in file 0x30fc9.

Deleting index entry inetpp.dll in index $I30 of file 1459.

Unable to locate the file name attribute of index entry taskeng.exe

of index $I30 with parent 0x5b3 in file 0x36e5b.

Deleting index entry taskeng.exe in index $I30 of file 1459.

Unable to locate the file name attribute of index entry taskmgr.exe

of index $I30 with parent 0x5b3 in file 0x200cc.

Deleting index entry taskmgr.exe in index $I30 of file 1459.

Unable to locate the file name attribute of index entry wer.dll

of index $I30 with parent 0x5b3 in file 0x30de1.

Deleting index entry wer.dll in index $I30 of file 1459.

386080 index entries processed.

CHKDSK is recovering lost files.

Recovering orphaned file taskmgr.exe (131276) into directory file 1459.

Recovering orphaned file wer.dll (200161) into directory file 1459.

Recovering orphaned file inetpp.dll (200649) into directory file 1459.

Recovering orphaned file wmplayer.exe (223375) into directory file 203.

5 unindexed files processed.

Recovering orphaned file taskeng.exe (224859) into directory file 1459.

318912 security descriptors processed.

Cleaning up 9 unused index entries from index $SII of file 0x9.

Cleaning up 9 unused index entries from index $SDH of file 0x9.

Cleaning up 9 unused security descriptors.

33585 data files processed.

CHKDSK is verifying Usn Journal...

34528776 USN bytes processed.

Usn Journal verification completed.

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

145773809 KB total disk space.

70644432 KB in 260267 files.

145660 KB in 33586 indexes.

60 KB in bad sectors.

437309 KB in use by the system.

65536 KB occupied by the log file.

74546348 KB available on disk.

4096 bytes in each allocation unit.

36443452 total allocation units on disk.

18636587 allocation units available on disk.

Internal Info:

c0 dd 04 00 e9 7b 04 00 05 b9 07 00 00 00 00 00 .....{..........

32 7c 00 00 44 00 00 00 00 00 00 00 00 00 00 00 2|..D...........

42 00 00 00 e2 73 ef 76 58 84 40 00 58 7c 40 00 B....s.vX.@.X|@.

Windows has finished checking your disk.

Please wait while your computer restarts.

Event Xml:

<Channel>Application</Channel>

<Computer>RALPH-PC</Computer>

</System>

<Data>

Checking file system on C:

The type of the file system is NTFS.

A disk check has been scheduled.

Windows will now check the disk.

318912 file records processed.

1516 large file records processed.

0 bad file records processed.

0 EA records processed.

68 reparse records processed.

Unable to locate the file name attribute of index entry wmplayer.exe

of index $I30 with parent 0xcb in file 0x3688f.

Deleting index entry wmplayer.exe in index $I30 of file 203.

Unable to locate the file name attribute of index entry inetpp.dll

of index $I30 with parent 0x5b3 in file 0x30fc9.

Deleting index entry inetpp.dll in index $I30 of file 1459.

Unable to locate the file name attribute of index entry taskeng.exe

of index $I30 with parent 0x5b3 in file 0x36e5b.

Deleting index entry taskeng.exe in index $I30 of file 1459.

Unable to locate the file name attribute of index entry taskmgr.exe

of index $I30 with parent 0x5b3 in file 0x200cc.

Deleting index entry taskmgr.exe in index $I30 of file 1459.

Unable to locate the file name attribute of index entry wer.dll

of index $I30 with parent 0x5b3 in file 0x30de1.

Deleting index entry wer.dll in index $I30 of file 1459.

386080 index entries processed.

CHKDSK is recovering lost files.

Recovering orphaned file taskmgr.exe (131276) into directory file 1459.

Recovering orphaned file wer.dll (200161) into directory file 1459.

Recovering orphaned file inetpp.dll (200649) into directory file 1459.

Recovering orphaned file wmplayer.exe (223375) into directory file 203.

5 unindexed files processed.

Recovering orphaned file taskeng.exe (224859) into directory file 1459.

318912 security descriptors processed.

Cleaning up 9 unused index entries from index $SII of file 0x9.

Cleaning up 9 unused index entries from index $SDH of file 0x9.

Cleaning up 9 unused security descriptors.

33585 data files processed.

CHKDSK is verifying Usn Journal...

34528776 USN bytes processed.

Usn Journal verification completed.

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

145773809 KB total disk space.

70644432 KB in 260267 files.

145660 KB in 33586 indexes.

60 KB in bad sectors.

437309 KB in use by the system.

65536 KB occupied by the log file.

74546348 KB available on disk.

4096 bytes in each allocation unit.

36443452 total allocation units on disk.

18636587 allocation units available on disk.

Internal Info:

c0 dd 04 00 e9 7b 04 00 05 b9 07 00 00 00 00 00 .....{..........

32 7c 00 00 44 00 00 00 00 00 00 00 00 00 00 00 2|..D...........

42 00 00 00 e2 73 ef 76 58 84 40 00 58 7c 40 00 B....s.vX.@.X|@.

Windows has finished checking your disk.

Please wait while your computer restarts.

</Data>

</EventData>

</Event>

And I still don't understand why we weren't able to read the minidumps by zipping.them. Were settings changed somehow?

My system seems to be running better, but not without anomalies. I have suspected all along that stealthy changes

were made my some malware, which have affected my system. What about wmplayer? and taskmgr?

Still not sure what to do next.

October 22, 2013

I will try to run a Malwarebytes Pro full scan tonight. I hadn't been able to do that recently because my

computer would bog down and freeze up. We'll see if that problem has been put behind us. My computer has

been up and running all day, including the ESET scan on IE, and several programs including Facebook

on Chrome including this one.

So we'll see.

October 22, 2013

Yes, I read your warning about possibly failing hard drive, but have had no other indication of that, and since

Windows was able to fix it, I feel hopeful that it won't cause any more trouble.

Is there some source I could read about that? My computer has been much more stable for the

past few days since I uninstalled my recently purchased (February, 2013) HP PHotosmart printer. The tech gave me

newer installation software which I have not used yet, will wait until other issues are solved. I shold also probably

uninstall my old Canon printer before I do that.

And I have purchased MalwareBytes Secure Backup to save my important data. I will probably be getting a newer

laptop before too long, anyway.

October 22, 2013

I looked up these threats in the files listed to see when they were downloaded.

The first one was a little cat application that I'd had on various computers, dated 11-19-2001

The second was Registry Booster from Uniblue dated 2-04-2010

The third was a Google Earth setup from 3-11-2013. I think I was looking for an earlier version.

The fourth was Speedupmypc from Uniblue, whom I trusted, on 2-06-2013.

Malwarebytes full scans never indicated that any of them were threats, nor did MSE..

October 22, 2013

ESET finished. Here is the output as a txt file:

C:\download\Felix2.exe Win32/Joke.ScreenMate application

C:\Users\Ralph\Documents\Downloads\registrybooster.exe a variant of Win32/RegistryBooster application

C:\Users\Ralph\Downloads\google earth setup.exe a variant of Win32/Soft32Downloader.D application

C:\Users\Ralph\Downloads\speedupmypc.exe multiple threats

Since I ran ESET with 'Remove found threats' unticked, as instructed, how do I go about removing them now?

October 22, 2013

Okay, This afternoon, I started ESET online scan again. It breezed right past the repaired (by CHKDSK /R)

bad clusters in file 6939 of C: boot\bootstat.dat, which had hung up ESET on two previous attempts to run it.

As of now, after 4 hours of scanning and about 50% of the way through, it has found

4 infected files so far:

These are:

1. Win32/Joke.Screenmate application

2. a variant of Win32/Registry Booster application

3. a variant of Win32/Soft32 Downloader D application

4. multiple threats

So, I will let it continue running into the night and finish this time, if it will.

These infected files were not found by Malwarebytes Pro or MSE, but I have not

been able to do a full scan with either of these programs since August 30 (I believe).

I have done Flash scans with Malwarebytes Pro, and quick scans with MSE.

But I don't know how recent these infections are. If I get a report I will print it.

October 21, 2013

Okay, I scheduled another run of CHKDSK /R for last night when I went to bed, around 10 PM.

When I checked on it later, it had completed stage 4, verifying file data. The bad clusters which had been found

in boot/bootstat.dat in the previous run, had indeed been fixed. (I still want to rerun ESET to make sure it gets past

that area).

But later still, it had hung up in stage 5, making no further progress all night. This time it only completed 71% of the

free space clusters, as opposed to 79% the previous afternoon.

Here is what remained on the screen this morning (hand written and typed here):

Deleting index entry taskmgr.exe in index $I30 of file 1459.

Deleting index entry wer.dll in index $I30 of file 1459.

386164 index entries processed.

Index verification completed.

CHKDSK is recovering lost files.

Recovering orphaned file taskmgr.exe (131276) into directory file 1459.

Recovering orphaned file wer.dll (200161) into directory file 1459.

Recovering orphaned file inetpp.dll (200649) into directory file 1459.

Recovering orphaned file wmplayer.exe (223375) into directory file 203.

5 unindexed files processed.

Recovering orphaned file taskeng.exe (224859) into directory file 1459.

CHKDSK is verifying security descriptors (stage 3 of 5). . .

318912 security descriptors processed.

Security descriptor verification completed.

33627 data files processed.

CHKDSK is verifying usn journal. . .

33855032 USN bytes processed.

usn journal verification completed.

CHKDSK is verifying file data (stage 4 of 5). . .

318896 files processed.

File data verification completed.

CHKDSK is verifying free space (stage 5 of 5). . .

71 percent complete. (12047345 of 18627258 free clusters processed)

Now I am interested in rerunning ESET, as it only scanned a small portion of the disk

before hanging up in boot/bootstat.dat (which has now had bad clusters replaced).

Thanks for your advice about failing hard drive, but I'd like to investigate further.

But I think I will schedule another CHKDSK /R first.

PS - the system came up much quicker this morning after first forcing a shutdown

hasn't shown signs of freezing up yet, but it's still too soon to say.

October 21, 2013

Okay, today has been strange. First I tried to find Command Prompt, but couldn't find it your way, because I never did find Accessorries.

I eventally found it by searching for Command prompt at the bottom of the Start page.

Then I started it as Administrator, and scheduled it to start after a restart.

It restarted fine and launced into the Chkdsk /R, But it eventually hung up in step 5. But first:

it found 0 bad sectors

but it found and fixed the usual indexes, including indexes for wmplayer.exe and taskmgr.exe, and about 3 others,

then restoring the orphan records which it had removed from the indexes.

In stage 4, it verified file data.(stage 4 of 5):

"Windows replaced bad clusters in file 6939

of name \boot\bootstat.dat."

Interstingly, this is the same spot where both ESET runs had hung up, in previous runs.

At about 2 PM I left to play tennis, leaving the chkdsk running.

When I returned at about 4:30, Chkdsk had added the following lines:

"318896 files processed (no more bad clusters found, however)

File data verification completed.

CHKDSK is verifying free space (stage 5 of 5)...

79% percent complete. (13981389 of 18627858 free clusters processed)"

I was surprised that it hadn't finished, and I waited another 3 hours, and the last line stayed the same.

Since neither the memory or disk lights were blinking, I finally concluded that it was hung up and not

going any farther, and since it was just verifying free space, I forced it to shut down.

Nothing had gotten into the event log from that CHKDSK run, only when I canceled it.

So I will schedule another CHKDSK /R run tonight.

I'll be interested to see if those bad clusters in boot/bootstat.dat have indeed been fixed,

and if an ESET run will be able to get past that spot without hanging up,

and if it will complete stage 5 this time.

Hopefully, I'll get a complete report this time.

October 19, 2013

I seem to be stuck here: "Click on START and type in CMD.EXE and when it shows on the menu right click and choose "Run as administrator"

I do this, typing it into the search field at the bottom of the START page, but I can't find it on "the menu." (what menu?) It's probably something obvious that I'm just not understanding. If I could find it, I could continue with the instructions. But I'm stuck here. Sorry.

October 19, 2013

To start, here's the Minidump you asked for:

Mini101213-01.txt

October 19, 2013

Minitoolbox run:

MiniToolBox by Farbar Version: 13-07-2013

Ran by Ralph (administrator) on 18-10-2013 at 19:20:01

Running from "C:\Users\Ralph\Desktop\Deskwork"

Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)

Boot Mode: Normal

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.

No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= Hosts content: =================================

127.0.0.1 localhost

========================= IP Configuration: ================================

Realtek PCIe GBE Family Controller = Local Area Connection (Connected)

Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter = Wireless Network Connection (Connected)

The following helper DLL cannot be loaded: WLANCFG.DLL.

The following helper DLL cannot be loaded: WCNNETSH.DLL.

# ----------------------------------

# IPv4 Configuration

# ----------------------------------

pushd interface ipv4

reset

set global icmpredirects=enabled

add address name="Local Area Connection" address=192.168.0.1

popd

# End of IPv4 configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : Ralph-PC

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : PK5001Z

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : PK5001Z

Description . . . . . . . . . . . : Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter

Physical Address. . . . . . . . . : 00-C0-A8-FB-77-F4

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::31f5:5074:ea88:613%9(Preferred)

IPv4 Address. . . . . . . . . . . : 192.168.0.141(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Friday, October 18, 2013 6:32:26 PM

Lease Expires . . . . . . . . . . : Saturday, October 19, 2013 6:32:25 PM

Default Gateway . . . . . . . . . : fe80::b077:bc11:2fb0:cc22%9

192.168.0.1

DHCP Server . . . . . . . . . . . : 192.168.0.1

DHCPv6 IAID . . . . . . . . . . . : 218153128

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-0F-B6-5C-14-00-E0-B8-DB-4A-21

DNS Servers . . . . . . . . . . . : 192.168.0.1

64.91.3.46

NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller

Physical Address. . . . . . . . . : 00-E0-B8-DB-4A-21

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::b077:bc11:2fb0:cc22%8(Preferred)

Autoconfiguration IPv4 Address. . : 169.254.204.34(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.0.0

IPv4 Address. . . . . . . . . . . : 192.168.0.1(Duplicate)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . :

DHCPv6 IAID . . . . . . . . . . . : 201384120

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-0F-B6-5C-14-00-E0-B8-DB-4A-21

DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%2

fec0:0:0:ffff::2%2

fec0:0:0:ffff::3%2

NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : 6TO4 Adapter

Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface

Physical Address. . . . . . . . . : 02-00-54-55-4E-01

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

Media State . . . . . . . . . . . : Media disconnected

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : isatap.{E2CD68E9-F64B-46CA-AF60-CF8CB6FA1F9C}

Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 13:

Connection-specific DNS Suffix . : PK5001Z

Description . . . . . . . . . . . : isatap.PK5001Z

Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::5efe:192.168.0.141%15(Preferred)

Default Gateway . . . . . . . . . :

DNS Servers . . . . . . . . . . . : 192.168.0.1

64.91.3.46

NetBIOS over Tcpip. . . . . . . . : Disabled

Server: PK5001Z.PK5001Z

Address: 192.168.0.1

Name: google.com

Addresses: 2607:f8b0:400a:802::1001

173.194.33.97

173.194.33.98

173.194.33.99

173.194.33.100

173.194.33.101

173.194.33.102

173.194.33.103

173.194.33.104

173.194.33.105

173.194.33.110

173.194.33.96

Pinging google.com [173.194.33.98] with 32 bytes of data:

Reply from 173.194.33.98: bytes=32 time=23ms TTL=58

Reply from 173.194.33.98: bytes=32 time=24ms TTL=58

Ping statistics for 173.194.33.98:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 23ms, Maximum = 24ms, Average = 23ms

Server: PK5001Z.PK5001Z

Address: 192.168.0.1

Name: yahoo.com

Addresses: 98.138.253.109

98.139.183.24

206.190.36.45

Pinging yahoo.com [206.190.36.45] with 32 bytes of data:

Reply from 206.190.36.45: bytes=32 time=27ms TTL=55

Reply from 206.190.36.45: bytes=32 time=28ms TTL=55

Ping statistics for 206.190.36.45:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 27ms, Maximum = 28ms, Average = 27ms

Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time=17ms TTL=128

Reply from 127.0.0.1: bytes=32 time=4ms TTL=128

Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 4ms, Maximum = 17ms, Average = 10ms

===========================================================================

Interface List

9 ...00 c0 a8 fb 77 f4 ...... Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter

8 ...00 e0 b8 db 4a 21 ...... Realtek PCIe GBE Family Controller

1 ........................... Software Loopback Interface 1

16 ...00 00 00 00 00 00 00 e0 6TO4 Adapter

11 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface

14 ...00 00 00 00 00 00 00 e0 isatap.{E2CD68E9-F64B-46CA-AF60-CF8CB6FA1F9C}

15 ...00 00 00 00 00 00 00 e0 isatap.PK5001Z

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.141 25

127.0.0.0 255.0.0.0 On-link 127.0.0.1 306

127.0.0.1 255.255.255.255 On-link 127.0.0.1 306

127.255.255.255 255.255.255.255 On-link 127.0.0.1 306

169.254.0.0 255.255.0.0 On-link 169.254.204.34 276

169.254.204.34 255.255.255.255 On-link 169.254.204.34 276

169.254.255.255 255.255.255.255 On-link 169.254.204.34 276

192.168.0.0 255.255.255.0 On-link 192.168.0.141 281

192.168.0.141 255.255.255.255 On-link 192.168.0.141 281

192.168.0.255 255.255.255.255 On-link 192.168.0.141 281

224.0.0.0 240.0.0.0 On-link 127.0.0.1 306

224.0.0.0 240.0.0.0 On-link 169.254.204.34 276

224.0.0.0 240.0.0.0 On-link 192.168.0.141 281

255.255.255.255 255.255.255.255 On-link 127.0.0.1 306

255.255.255.255 255.255.255.255 On-link 169.254.204.34 276

255.255.255.255 255.255.255.255 On-link 192.168.0.141 281

===========================================================================

Persistent Routes:

None

IPv6 Route Table

===========================================================================

Active Routes:

If Metric Network Destination Gateway

9 281 ::/0 fe80::b077:bc11:2fb0:cc22

1 306 ::1/128 On-link

8 276 fe80::/64 On-link

9 281 fe80::/64 On-link

15 286 fe80::5efe:192.168.0.141/128

On-link

9 281 fe80::31f5:5074:ea88:613/128

On-link

8 276 fe80::b077:bc11:2fb0:cc22/128

On-link

1 306 ff00::/8 On-link

8 276 ff00::/8 On-link

9 281 ff00::/8 On-link

===========================================================================

Persistent Routes:

None

========================= Winsock entries =====================================

Catalog5 01 C:\Windows\system32\NLAapi.dll [48128] (Microsoft Corporation)

Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation)

Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)

Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)

Catalog5 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog5 06 C:\Windows\system32\winrnr.dll [19968] (Microsoft Corporation)

Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 19 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 20 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 21 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 22 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 23 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 24 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 25 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 26 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 27 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 28 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 29 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 30 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 31 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

Catalog9 32 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:

==================

Error: (10/18/2013 05:52:15 PM) (Source: Application Error) (User: )

Description: Faulting application svchost.exe_BFE, version 6.0.6001.18000, time stamp 0x47918b89, faulting module bfe.dll, version 6.0.6002.18005, time stamp 0x49e036ff, exception code 0xc0000005, fault offset 0x0002799d,

process id 0x14bc, application start time 0xsvchost.exe_BFE0.

Error: (10/18/2013 05:47:14 PM) (Source: Application Error) (User: )

Description: Faulting application svchost.exe_BFE, version 6.0.6001.18000, time stamp 0x47918b89, faulting module bfe.dll, version 6.0.6002.18005, time stamp 0x49e036ff, exception code 0xc0000005, fault offset 0x0002799d,

process id 0xbe0, application start time 0xsvchost.exe_BFE0.

Error: (10/18/2013 05:47:08 PM) (Source: Application Error) (User: )

Description: Faulting application svchost.exe_BFE, version 6.0.6001.18000, time stamp 0x47918b89, faulting module bfe.dll, version 6.0.6002.18005, time stamp 0x49e036ff, exception code 0xc0000005, fault offset 0x0002799d,

process id 0x6e4, application start time 0xsvchost.exe_BFE0.

Error: (10/18/2013 05:44:53 PM) (Source: Application Error) (User: )

Description: Faulting application svchost.exe_BFE, version 6.0.6001.18000, time stamp 0x47918b89, faulting module bfe.dll, version 6.0.6002.18005, time stamp 0x49e036ff, exception code 0xc0000005, fault offset 0x00028232,

process id 0x6a0, application start time 0xsvchost.exe_BFE0.

Error: (10/16/2013 00:26:35 PM) (Source: Windows Search Service) (User: )

Description: The entry <C:\USERS\RALPH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AJPCDIPECMMHMHFCHEGPAFLPJKMCEIIP\1.0.0.0_0> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:

A device attached to the system is not functioning. (0x8007001f)

Error: (10/16/2013 00:26:17 PM) (Source: Windows Search Service) (User: )

Description: The entry <C:\USERS\RALPH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AJPCDIPECMMHMHFCHEGPAFLPJKMCEIIP\1.0.0.0_0> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:

A device attached to the system is not functioning. (0x8007001f)

Error: (10/16/2013 11:32:44 AM) (Source: Microsoft Security Client Setup) (User: NT AUTHORITY)

Description: HRESULT:0x8004FF80

Description:Cannot complete the Security Essentials Upgrade. Security Essentials is not currently monitoring and helping to protect your computer. Please restart your computer and try again. Error code:0x8004FF80.

Error: (10/16/2013 11:17:07 AM) (Source: MsiInstaller) (User: NT AUTHORITY)

Description: Product: Microsoft Security Client -- Error 1921. Service 'Microsoft Antimalware Service' (MsMpSvc) could not be stopped. Verify that you have sufficient privileges to stop system services.

Error: (10/15/2013 11:21:48 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (10/15/2013 05:55:17 PM) (Source: VSS) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.

This is often caused by incorrect security settings in either the writer or requestor process.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {f4b934b4-48a2-41b7-a311-37902ec5516c}

System errors:

=============

Error: (10/18/2013 06:45:40 PM) (Source: ipnathlp) (User: )

Description: The ICS_IPV6 failed to configure IPv6 stack.

Error: (10/18/2013 06:33:33 PM) (Source: ipnathlp) (User: )

Description: The DHCP allocator has disabled itself on IP address 169.254.204.34, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope.

Error: (10/18/2013 06:32:12 PM) (Source: EventLog) (User: )

Description: The previous system shutdown at 6:12:17 PM on 10/18/2013 was unexpected.

Error: (10/18/2013 05:44:52 PM) (Source: Ntfs) (User: )

Description: The file system structure on the disk is corrupt and unusable.

Please run the chkdsk utility on the volume \Device\HarddiskVolume2.

Error: (10/18/2013 05:44:50 PM) (Source: iaStor) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Error: (10/18/2013 05:43:35 PM) (Source: volsnap) (User: )

Description: The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Error: (10/18/2013 05:43:30 PM) (Source: iaStor) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Error: (10/18/2013 05:42:30 PM) (Source: iaStor) (User: )

Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Error: (10/18/2013 05:44:31 PM) (Source: ipnathlp) (User: )

Description: The ICS_IPV6 failed to configure IPv6 stack.

Error: (10/18/2013 04:50:17 PM) (Source: ipnathlp) (User: )

Description: The ICS_IPV6 failed to configure IPv6 stack.

Microsoft Office Sessions:

=========================

CodeIntegrity Errors:

===================================

Date: 2013-10-17 09:57:22.629