Windows 8.1 failed to boot after an automatic update

[PeterJ]

Follow the instructions below please.

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download the attachment SFCFixScript.txt and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.
  
  
• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Open the file, then copy and paste its content in your next reply.

 

[DRQ]

Hi,
The 'SFCFix.txt' should be attached here.

 

[PeterJ]

Step 1:
WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download the attachment SFCFix.zip and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
  
  
• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Open the file, then copy and paste its content in your next reply.

Step 2:
Restart the machine.
Try to enable Windows Defender in the Action Center again and report the result.

 

[DRQ]

Step 1 - 'SFCFix_d20210830t1741.txt' attached

Step 2 -
Restarted machine and logged in.
Waited a bit for the flag to appear in system tray. It took a while but when it did
Start -> Control Panel -> Action Centre = 'actioncentre_d20210830t1747.png'
Then clicked on 'turn on now' = 'clicked_on_turn_on_now_d20210830t1748.png'

Does it mater that this is not a US machine? I'm in the UK and most Windows settings will be set to UK or GB.

 

[PeterJ]

Do you have another Windows 8.1 x86 machine at hard ?
We added 6 missing files in the folder C:\Program Files\Windows Defender\en-US.
There is still 1 file missing in the folder C:\Program Files\Windows Defender\en-GB which I have to find first.

 

[DRQ]

I don't think I have any other Windows 8.1 machines. Other machines that did have 8.1 got upgraded to 10, both x86 and x64.
I might have an old HDD that came out of this machine; I'll have a look for that.

 

[DRQ]

I've had a look and I don't think I have that HDD. I might have been imagining it! I thought I might have had one that got swapped out of an old machine but it doesn't look like it.

I really appreciate the effort you've put in.

 

[PeterJ]

Installed Windows 8.1 x86 en-GB on a Virtual Machine.
There are some differences between a en-US and a en-GB OS. The files that I added in the last fix seems not required.

Open the folder C:\Program Files\Windows Defender.
Double-click the file MSASCui.exe.
Windows Defender should open. Does that happen or something else ?

 

[DRQ]

Yes, a Windows Defender window does open (the same whether I double-click or right click and run as administrator) but it says "Your PC isn't being monitored because the application's service stopped. You should restart it now" as per 'Defender01_d20210902t1038.png' attached.
When I click on "Start now" the pointer changes to the blue circle, most of the window fades a little and nothing happens for quite a while and then I get a window saying "The service couldn't be started.", I click on support information and it says "Error code: 0x800705b4", as per 'couldntbestarted_d20210902t1043.png'

 

[DRQ]

I opened up Task Manager and looked at the Services tab, see 'taskmanagerservices_d20210902t1054.png'.
I clicked on "Services" and found the "Windows Defender Service" as per 'services_d20210902t1055.png'.
I clicked on "Start the service" and, after a brief progress bar, got 'terminated_uexpectedly_d20210902t1055.png'

I tried starting the "Windows Defender Network..." service and that did start, but when I tried "Windows Defender Service" I got the same "...terminated unexpectedly..." message.

 

[PeterJ]

Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

1. Download the attachment fixlist.txt and save it to your desktop.
2. Right-click on FRST.exe and select "Run as administrator".
3. Press the Fix button.
4. The tool will now process fixlist.txt.
5. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
6. When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
7. Post the logfile Fixlog.txt as attachment in your next reply.

 

[DRQ]

log should be attached as 'Fixlog_d20210902t1739.txt'

 

[DRQ]

Forgot to say that your help is appreciated. I'm concerned that this is taking up too much of your time and effort.

 

[PeterJ]

Try to run the program C:\Windows\System32\MRT.exe and report the result

 

[DRQ]

I navigated to the file and used right click and run as administrator. The Microsoft Windows Malicions Software Removal Tool starts and seems to be working. I selected a complete scan and so far (3 hours in) it's showing 0 files infected out of about 2860000 scanned.

I think I ran this a few weeks ago but don't recall what type of scan I selected.

I did find the log and there were several mentions of "Failure to collect/send Service Start Failure heartbeat. HR = 80072EE7" but the a quick search web seems to suggest that this may be because the computer is not connected to a network at the moment.

I'll let it complete and post the results.

 

[DRQ]

Scan has completed with no infections found.
The last entry in 'mrt.log'
is:

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.92, (build 5.92.18432.1)
Started On Fri Sep  3 09:04:39 2021

Engine: 1.1.18300.4
Signatures: 1.343.1365.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Failed to submit MAPS report: 0x80072EE7
Failed to submit clean hearbeat MAPS report: 0x80072EE7
Microsoft Windows Malicious Software Removal Tool Finished On Fri Sep  3 13:37:12 2021


Return code: 0 (0x0)

screenshots also attached.

I was a bit surprised to see the 'mrt.exe' file in blue in Explorer. I thought I'd mention that because it's not very clear in the image.

It was the 'MRT.exe' file highlighted that was run.

Hopefully that makes sense.

Your help is appreciated and I would understand if you're getting fed up with this.

 

[PeterJ]

Try to run the program C:\Program Files\Windows Defender\MSASCui.exe ones again and report the result.

 

[DRQ]

Hi,
Since I was running scans I re-installed Avast and ran a full system scan with that. It didn't find anything. I've uninstalled it and run the 'avastclear.exe' uninstall utility. But at this moment I've not yet repeated any of the steps that you asked me to do since the last time I uninstalled Avast.
Running 'MSASCui.exe' results is the same as described in post #49: Windows Defender screen with "Your PC isn't being monitored because the application's service stopped. You should restart it now". When I try to start it I get "The service couldn't be started." and support information says "Error code: 0x800705b4".
If you think it's worthwhile I will repeat the steps that I was asked to do since I last tried Avast (post #38), but won't post the log files unless there's a difference.

 

[PeterJ]

Download ZHPDiag 2021 using the link: ZHPDiag
Save the file on your desktop.

Disable the real-time protection of your antivirus software. It may conflict with ZHPDiag.

Run ZHPDiag

• Rightclick the file ZHPDiag3.exe and select Run as Administrator.
• Click "I agree" in the window "TERMS OF USE".
• Click "Scan" and wait for this to finish.
• When completed a file called ZHPDiag.txt is saved on your desktop, Attach this file to your next reply.
  (You can find this file also in the folder %AppData%\ZHP.)

 

[DRQ]

Hi,

Ran that and the log file should be attached here as 'ZHPDiag_d20210905t1220.txt'

I did have a look at it and it reminded me of how much junk there is on this machine! And I did notice an entry that seems strange to me:

---\\ Task Planned Automatically (Register) (2) - 5s
O38 - TASK: {46D4A6AF-33A3-45A0-8524-44D58BCF5848}[\{3C0F072F-14FE-422B-BF73-9E108790273D}] - (. - unpacksf Application.) -- C:\Users\Public\Downloads\Setup.exe  [5813568]
C:\WINDOWS\System32\Tasks\{3C0F072F-14FE-422B-BF73-9E108790273D} - (..) -- C:\Users\Public\Downloads\Setup.exe  [C:\Users\Public\Downloads\Setup.exe]

I looked at the file 'C:\Users\Public\Downloads\Setup.exe' and it's not clear what it is. Judging from its age it might be related to a 3G modem that I haven't used for many years.