[SOLVED] Allegedly some corrupt system .dlls and .sys's

[SurgeonX1]

On an older fine working 7 ultimate system with some minor faults I suddenly got an BSOD after last ESU updates, time line not fully clear.
One .dll and about 10 .sys files are reportedly corrupt !
From one moment to the other !
sfc says no problems, sfc fix too resp. 8 faults successfully repaired.
BSOD does not stop so I have too cut off surveillance of driver signature from start of the system e.g. by Easy BCD and
chose that with F8 at system start.
But the signatures all are ok ! Seen by special program.
I replaced the reportedly defect files with the same from another 7 system without that fault but no change.
So now I must ask what is the reason !
The surveillance program defect ??

(Sorry for my English, I am German and PC is German ! ^^

 

[Corday]

Is your Windows 7 Ultimate an authorized copy?

 

[SurgeonX1]

Sure. What has this to do with the new emerged problem never encountered before ??

 

[Will]

Sure. What has this to do with the new emerged problem never encountered before ??

Certain types of issue are more common to be caused by pirated copies of Windows or applications, hence the question. Windows 7 ultimate on consumer systems was also relatively rare as it was priced higher - but was a very common pirated version.


To get some more info from your system, please run the BSOD tools from this thread:
Blue Screen of Death (BSOD) Posting Instructions - Windows 11, 10, 8.1 and 8

Most of these should still run on Windows 7, although let us know if any fail.


As Windows 7 was EOL in 2020, we'd also recommend updating to a new OS if possible. More info on this in this thread:
Still running Windows 7? Read this first!

 

[SurgeonX1]

I bought the license in internet and it was accepted. This was years ago ! So I ask here a question for professionals as I was told. But don't see this
in the answers. And the answers up to now are useless, because the system works for years and got this problem now ! And never before !
So the key is ok, and I described the time line of this new problem.
Add. it is a 7 double boot system and the other nearly identical works fine.
Because of exchange of the allegedly defect files there must be a fault in the surveillance I guess.
But this seems to be a rare problem I did not find in internet. There only one or 2 files with other background.
Virus scan ok, by system or emergency DVD.
I also have 8.1 and 10, rarely used on another SSD.
Since some time I encountered some CBS E Invalid Items.
But sfc says no faults. Sfx Fix too. This does not fit !
So I exchanged the files from 2d 7 system which is ok, but no effect.
I would ask if it is possible to take these files from 8.1, or is that principally not possible ??

So 2 faults remain: defects who are probably none !
sfc ok, but since some months CBS E invalid items seen in CBS log.
In the past I solved all windows problems by internet forums and by myself, perhaps here too,
but it takes time to get the right inspiration.

 

[Will]

One of the "useless" answers was a request for more information about your system - which you have not provided.

No, you cannot swap files from 8.1 and add them to Windows 7.

 

[plodr]

I suddenly got an BSOD after last ESU updates

I haven't paid for ESU so I can't help you with that.
Have you tried uninstalling the suspected update that is creating problems?
Better yet, do you have an image you can restore?

When Windows 7 was updated monthly, I used to make an image before I applied the updates manually. If a computer got weird, I then restored the image and waited to see if the problems with the updates were fixed.

You'd have to see if anyone else doing the ESU had problems. Since this is the final update for Windows 7 extended support, you might just have to not install on the one computer to get the computer to work correctly.

 

[SurgeonX1]

I checked history. I gave some rights to the installer folder in 7. I don't know why. After it was empty or deleted. I copied this back from a backup. Then the problem emerges. Then I made a full recover from a backup from 9/11/22. After that for the first time partition table was defect which should not happen by Acronis !
I repaired the PT, then PT in the second SSD only for data was defect. This was repaired too.
But the fault persists.
For me there is no reason for this fault because the .dll and .sys of another 7 were copied which has no faults !
(E.g. for this I use a double boot for mutual repair, copy etc pp)

So now my focus is what is the reason for this fault, if the files are ok and are from another non faulty system ??
It seems to be a miracle, I do not see a logical reason or context/correlation.
So my focus is on the surveillance program causing the message in the event viewer.

But also BSOD persists and emerges very early and does not create any .dmp data !

 

[Will]

If you're not willing to provide the information requested, then I'm not sure how you expect us to help you.

Files from different systems are only compatible if they're the exact same version number - you can't pull a file even from a different Windows 7 machine, unless it's exactly the same version and has the same updates installed.

 

[SurgeonX1]

I provided all requested information I guess.
And even much more details.
And I copied the intact files from another identical system with same status and updates !
The fault is at another place as I wrote before and not clear up to now.
But I am sure solution will come as I always experienced.
From BSOD there is no .dmp because it came soon.

 

[Corday]

And you did this? Configure system failure and recovery options - Windows Client

 

[SurgeonX1]

BSOD Collection App makes a queue waiting for system info. As mentioned before there is no .dmp.

 

[Will]

And I copied the intact files from another identical system with same status and updates !

This isn't what you said before - you asked if you could copy from 8.1. That's why I've said no.

BSOD Collection App makes a queue waiting for system info. As mentioned before there is no .dmp.

This is the info we're after - if it's not running succesfully, that's okay. Please also run the other tools in the thread (e.g. Speccy) and provide more info about your system.

The specific BSOD you're getting (c000021a) occurs when Windows detects the user-mode as "compromised". This could happen due to a corrupted file, could be due to the file replacements manually done, or could be a 3rd party program interfering. This particular stop code won't product a .dmp file.

 

[Will]

mscvrt.dll being flagged in EventViewer is probably not the cause, as this is a visual studio file.

 

[SurgeonX1]

@ Will Watts: No ! I did not copy files from 8.1 but from the 2d 7 Ultimate of the double boot system which is identical ! Same and same updated !

 

[SurgeonX1]

I thank you for support up to now.
But I encounter more problems. Reason not clear so that U must stop here and now !
History:
The accused system works except the allegedly corrupt files (even after replacement from 2d system 7 from double boot).
But more problems occur:
Today I startet the 2d 7 Ultimate system. No problems. But suddenly I got messages the SSD (1 year old, Samsung Evo 1 TB, fine)
is not initialized !
I shot the system down.
Then I took my 2d SSD Crucial MX500 1 TB with windows 8.1 and 10 as double boot.
Start problems though updatet and full service days before. Chkdsk running.
Then 10 start problems even after and automatic repair.
Then 10 starts.
I put Evo with double boot extern at USB 3.0 adapater.
Really partition table not there, testdisk says no endmark 0xAA55 !
Starting recovery expert from Acronis DD. Finds ext4 partitions up to now which have never been there !
From the beginning when bought at Saturn double boot 7 system cloned from a HGST 1 TB !
All in a notebook from Medion, office notebook, nothing special.
Only for work, internet and so on. No gamer or such things. Simply for work.
So why initialization defect (MBR) ??
And starting the 2d SSD also start problems though not there days ago and not used in between ??

With this notebook I never had problems with HDDs as HGST 1 TB one for system one for data every 1 TB or before Western Digital Black
750/500 GB. HGST 1 TB is = WD Black 1 TB only other label.

So problems start when using SSDs, though they should work.
Much time before I used for 7 double boot a Samsung QVO. Several times MBR not there = not initialized.
So I changed that at Saturn to Evo and then ok.
For data I exchanged HSGT 1 TB to Crucial SSD MX500 1 TB.
Problems therefore startet with Samsung QVO 1 TB.
Additionally I used an extern enclosure for 2,5'' from Conrad Electronics USB 3.0.
Several times I encountered MBR deleted / not initialized with this enclosure.
But after eject and connect again all ok !
Chip is from Jmicron in this enclosure.
I asked me time ago if there is a boot sector virus or sth like that ! But did not find anything (Kaspersky IS plus rescue DVD).

Now the above mentioned problems with allegedly defect system files.
Started with manipulation of installer folder, then copy back, then full recovery of 7 system,
after that partition table defect.
Wild repair efforts at the Evo SSD until success.
Then suddenly PT at Crucial MX500 defect, also wild repair efforts.
On this data SSD 2 partitions called data 4 and data 5.
Data 5 PT found by Acronis and restored, Data 4 not found so restored full partition from backup.

Then all seems ok, except the allegedly defect system files.
But can they be defect after full copy of installer folder from a backup and,
2d step a full 7 system recovery ??
I think no !

And now in timeline full partition table of the 7 double boot system defect !
So I took Crucial with 8.1/10 and start problems !
Now ok, but Evo is empty because of PT !
Recovery now running at started 10 system and Evo connected by USB 3.0 adapter seeking by Acronis Disk Director.
Finds ext4 from Linux never been there up to now.

All this is a thriller for me and a bit too much because I have to work and lots of other problems here in Germoney.

I ask me if this notebook is not capable to use SSDs first.
Though Medion said no problem.
Second is there a correlation to the external USB 3.0 enclosure with Jmicron chip (which has lots of problems as I found in internet) ??
Because with this enclosure MBR problems / no initialization started when using Samsung QVO 1 TB.
Is it possible that problems of an external USB 3.0 enclosure of a bad chipset transfer by USB 3.0 to a SATA notebook ??
Can there be a special virus though nothing found ??
Electrical problems though nothing to be seen up to now ?? (NB is cheap but works fine)

So the "defect" 7 system called 7 1 by me is years old updated and has some minor problems before.
7 2 the second from double boot is newer and no faults.
Although I tried an inplace upgrade at both to refresh but both did not work ! Stopped at different times at about 70%
and then restore old system.

8.1 and 10 double boot I only used rarely to see how the newer MS systems work.
I have a HDD with Linux too, so work and general function is no problem.
The 2 SSDs have a configuration with 2 MS double boot systems, plus 2 program partitions each, plus 3 data partitions.
Data SSD from Crucial has 2 data partitions.
So the whole system seems to be a bit complicated but works since years.
I splitted page file in the systems to 2 or 3 partitions each and reduced size of hibernation file away from the standard.
I have several external HDD enclosures for 3,5'' and 2,5'' with USB 3.0 with total capacity of 14 TB for Backups and data.

So conclusion:
I do not focus on allegedly defect system files in one 7 system now !
This seems to be a special and "private" problem which can perhaps be fixed sometime or I really have to make a new installation.
(I am so crazy to try to fix problems for a long time even in old systems before and avoid new installations because they take
a lot of time with all browsers and special features).
Focus is at MBR, partition table and perhaps a defect of Jmicron chipset at external 2,5'' enclosure
because with this MBR / initialization problems start !
You need not answer to that !
It is even a bit too much for me for a PC only is a tool for my work and nothing more !

So I wish you a good and better time and thanks up to now !
It seems I am part of a thriller or I have some ghosts in my flat.
This fits to my life before in society, profession and private.
More problems than others, more hatred seen than others even in my church,
though I work fine in my profession 70 h a week and lots of hours private after

 

[SurgeonX1]

I made a backup from 24/10/2022. All problems disappeared.
Main reason: not updates, but I gave some rights to installer folder and it was emptied after.
I made a copy from a backup but this did not work.
In the defect system the folder has 8,4 GB, in correct system 12,1 GB.
So as said the files are neither corrupt nor defect but the surveillance (?) was defect.

If a specialist here can make further explanations of the correlations of the mentioned facts would be great:
lacking files in installer folder and allegedly some defect system dlls and sys files.
I cannot explain the direct correlation of that but it must be essential.
The system is several years old but enough for my work.
Communication and write sth see some videos and even TV.
Technical, no clouds, no skies, no pics or effects.
Like windows 2000 this was enough for me, technical.

I use 7 because it is faster than 8.1 or 10.
Though 10 and 8.1 have some better and newer drivers.
I will see what happens if support ends 2023.
If I use normal internet, don't make illegal downloads and have a virus scanner it must be ok.
I disabled AV software for some times and never had a problem.
I use an older notebook fast enough for my work with i5 and 16 GB DDR3 and 2 SSDs.
HD3000 from Intel and Nvidia M 630.
No time for gaming and playing with PC.
I use a NEC Multisync 90GX2 monitor, and with this old graphics I get small icons on desktop,
with 8.1 bigger and with 10 cannot be made small enough.
2 pics of this system.

 

[Corday]

Glad the backup did the trick. Maybe a few years form now, when buying new equipment, you'll upgrade to Windows 11 or its replacement.

 

[Will]

If a specialist here can make further explanations of the correlations of the mentioned facts would be great:
lacking files in installer folder and allegedly some defect system dlls and sys files.

It's a little difficult to follow your post - but the BSOD you were seeing is related to the integrity of your system, in particular security settings. The BSOD is Windows flagging that your system has become "non-trusted", and that it's no longer able to verify that essential files have not been modified.

Changing permissions for system folders could be a possible reason for this. It could also be a third party virus that made its way onto your system, and disrupted some system files.

I disabled AV software for some times and never had a problem.

We would encourage you to keep AV enabled on your system at all times. Even trusted websites can be hacked and inadvertently distribute malware, and you're taking a lot more risk than most consumers by still running Windows 7.

 

[SurgeonX1]

Glad the backup did the trick. Maybe a few years form now, when buying new equipment, you'll upgrade to Windows 11 or its replacement.

I never do new installations. Backup and recovery at last. Before trying to repair everything by checking the reason. By that I learned from windows 3.11 over 2000 to 10. Because of not very good systems by MS and a lot of faults. Responsible MS and not the users. 8 was rubbish, 8.1 better, and also 10 has faults. Instead of improve running systems MS makes new systems which are faulty too. And eb buys this ! If you have a good car with a faulty engine you will not buy the same car with a newer also faulty machine.
Why do you one update after the other ??
If the source code would be published lots of people would make a better system than MS himself !