none
slui.exe Application Error and explorer.exe Application Error have suddenly appeared. Help to fix please. RRS feed

  • Question

  • Hi

    So all of a sudden when I  start my computer and log in I get the error message "slui.exe Application Error The application was unable to start correctly (0x0000006). Click OK to close the application."

    I also then get straight after the slui.exe error message "explorer.exe Application Error The application was unable to start correctly (0x0000006). Click OK to close the application."

    Then followed by a black screen.

    I restart the computer and can fix this with one or two or several system scans (in command prompt sfc/scannow). But eventually the errors always keep coming back.

    So I have ran System Scan and also purchased 'RegCure' as I thought that might fix anything in my registry but I still get these error messages.

    What are these error messages and how can I permanently fix it? I've had Windows 7 running for a couple of years now with no problems.

    Thanks 

    Sunday, June 30, 2013 2:01 PM

Answers

  • I can't see any good reason why you shouldn't have access to the file - please check that you precisely followed the instructions I posted.

    A repair install 'should' leave your files and installed programs functional - but there is always the chance of problems, so you should back up to external media first.

    A clean install will wipe everything on at least the C: drive - so you MUST back everything up!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Tuesday, July 9, 2013 8:24 PM
    Moderator

All replies

  • This sounds like disk corruption.

    Please run a full CHKDSK and SFC scan....

     

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     

    At the Command prompt, type

     

    CHKDSK C: /R

     

    and hit the Enter key.

    You will be told that the drive is locked,

    and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

     

    The CHKDSK will take a few hours depending on the size of the drive, so be patient!

     

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

    then run the SFC.

     

    SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     

    At the Command prompt, type

     

    SFC /SCANNOW

     

    and hit the Enter key

     

    Wait for the scan to finish - make a note of any error messages - and then reboot.

     

     

    Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive Public folder (http://skydrive.live.com ) and post a link to it so that I can take a look.

     

    Post a new MGADiag report with details of any error messages encountered.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Tuesday, July 2, 2013 7:27 PM
    Moderator
  • Hi there Noel and thanks for taking out time to look into this for me.

    I ran CHCKDSK exactly as you said and rebooted the computer.  After a brief time I received a black screen that had a simple paragraph that essentially said "This disk is NTFS" and "The disk is Clean." (something like that). However this took minutes and not hours as you advised above. Is there something I did wrong here?

    Then of course I got the error messages again. The same error messages as advised in my previous post; slui.exe and explorer.exe.

    I then ran system file checker (sfc/scannow) several times to get my computer up and running again. My CBS log is here   https://skydrive.live.com/redir?resid=B6776C39F95E0302!139

    I have also ran MGAdiag and copied the report below.

    Hope this helps you to help me and again, thanks for your time!

    Twoshoes

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-8GP94-RC83T-VGBPB
    Windows Product Key Hash: DpjmZpWIl0a+2apFqVYD1KiUp1c=
    Windows Product ID: 00371-OEM-9044173-43039
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {739ECD4F-E403-49A3-9E02-B4622A7915C8}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.130318-1533
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{739ECD4F-E403-49A3-9E02-B4622A7915C8}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-VGBPB</PKey><PID>00371-OEM-9044173-43039</PID><PIDType>3</PIDType><SID>S-1-5-21-3830562047-46924062-2198659940</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>X58A-UD3R</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>FA</Version><SMBIOSVersion major="2" minor="4"/><Date>20100420000000.000000+000</Date></BIOS><HWID>CB213407018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>AUS Eastern Standard Time(GMT+10:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00180-441-743039-02-1033-7600.0000-2942010
    Installation ID: 007365455556099342134453840291179565196624301843076386
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: VGBPB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 7/3/2013 9:08:37 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 4:13:2013 20:31
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: QAAAAAIABgABAAEAAgADAAAAAgABAAEAonbuKVTT2NWUigw1Rrzkv4Q0agMmLvrQwo98h8orzN0b4UotQIvqgg==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC GBT   GBTUACPI
      FACP GBT   GBTUACPI
      HPET GBT   GBTUACPI
      MCFG GBT   GBTUACPI
      EUDS GBT  
      MATS GBT  
      TAMG GBT   GBT   B0
      SSDT INTEL PPM RCM 

    Wednesday, July 3, 2013 11:15 AM
  • The new report looks fine - try rebooting again, and the notification should be gone.

    Having said that, it is likely to return, unless we fix the problems highlighted in the SFC scan.

    	Line 46230: 2013-07-03 20:14:22, Info                  CSI    00000315 [SR] Repairing 2 components
    	Line 46231: 2013-07-03 20:14:22, Info                  CSI    00000316 [SR] Beginning Verify and Repair transaction
    	Line 46232: 2013-07-03 20:14:31, Info                  CSI    00000317 [SR] Cannot repair member file [l:14{7}]"slc.dll" of Microsoft-Windows-Security-SPP-Client, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    	Line 46233: 2013-07-03 20:14:48, Info                  CSI    00000318 [SR] Cannot repair member file [l:32{16}]"MsCtfMonitor.dll" of Microsoft-Windows-TextServicesFramework-MsCtfMonitor, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    

    I'll post a fix protocol a bit later - if my connection holds up!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, July 3, 2013 1:45 PM
    Moderator
  • I've uploaded a file - 2wsaa.zip - to my SkyDrive at Noel's SkyDrive

    Please download and save it.

    Right-click on the saved file and select Extract all...

    Change the target to C:\ and click on Extract

    Close all windows (it would be a good idea to print these
    instructions!)

    Now reboot to the Repair Environment - as soon as the machine restarts, start
    tapping F8 - this should bring up the Advanced Boot Menu, at the top of which
    should be the option 'Repair my Computer'

    Pick that

    You'll have to log in with your username and password.

    Pick the option to use a Command Prompt

    At the prompt type

    DIR C:\wfire

    hit the enter key - if you get a 'Not Found' error try

    DIR D:\wfire

    or

    DIR E:\wfire

     

    The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following
    command...

     

    XCOPY <drive>:\2wsaa  <drive>:\windows\winsxs /y /i /s /v /h

     

    (e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

     

    run the command (it should take almost no time) and when the prompt returns, type

    EXIT

    and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

    Now run SFC /SCANNOW in an Elevated Command Prompt

    then reboot and upload the new CBS.log file to your SkyDrive Public folder, and
    post a new link

    Also run a new MGADiag report, and post the result.

     



    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, July 3, 2013 2:13 PM
    Moderator
  • Oh dear, this isn't looking too good. I think I managed to extract the files to the C drive. However when I got as far as logging on as an administrator account, my administrator username "Twoshoes" wasn't in the drop down box! I had no choice but to choose 'User' (a guess) and got as far as the command prompt but it didn't recognise any drives that I typed in for DIR. C, D, E or F! So I think that was a fail right there. However, what is more of a problem now, I can't even get into windows desktop, even after about 10 sfc/Scannow attempts I still only get as far as the log in screen and then the slui.exe and explorer.exe messages constantly appear. Has my luck run out?

    I'm not sure what to do now. I can keep trying the restarts and scans but I fear I wont get anywhere...Any ideas now?

    I've posted a few pics on skydrive to explain....

    https://skydrive.live.com/redir?resid=B6776C39F95E0302!141 (this is my typical login screen - Twoshoes is the admministrator)

    https://skydrive.live.com/redir?resid=B6776C39F95E0302!142 (this is the sytem recovery options screen - why isnt Twoshoes in the drop down box?)

    https://skydrive.live.com/redir?resid=B6776C39F95E0302!140 (this is the CMD screen showing that the File Not Found...)

    Thanks

    Thursday, July 4, 2013 12:20 PM
  • The errors are my fault - sorry about that!

    Please use these instructions (hopefully, the files are actually in the right place already) - it looks to me as if you renamed the User account at some point (which is the default first admin account on many OEM machines)

    reboot to the Repair Environment - as soon as the machine restarts, start
    tapping F8 - this should bring up the Advanced Boot Menu, at the top of which
    should be the option 'Repair my Computer'

    Pick that

    You'll have to log in with your username and password.

    Pick the option to use a Command Prompt

    At the prompt type

    DIR C:\2wsaa

    hit the enter key - if you get a 'Not Found' error try

    DIR D:\2wsaa

    or

    DIR E:\2wsaa

     

    The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following
    command...

     

    XCOPY <drive>:\2wsaa  <drive>:\windows\winsxs /y /i /s /v /h

     

    (e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

     

    run the command (it should take almost no time) and when the prompt returns, type

    EXIT

    and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

    Now run SFC /SCANNOW in an Elevated Command Prompt

    then reboot and upload the new CBS.log file to your SkyDrive Public folder, and
    post a new link

    Also run a new MGADiag report, and post the result.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, July 4, 2013 12:44 PM
    Moderator
  • Hi there Noel

    Apologies for delayed response. I had real trouble getting my computer to get to windows this time but eventually got there (after a cold start the following morning actually!).

    So I am afraid to turn off my computer again so I am in the process of backing up all my data (which I do anyway) just in case I have to do a fresh install.

    I do have 2 queries though.

    1) I think I extracted the 2wsaa file correctly and wonder why I get file not found. It is interesting that I can't use "twoshoes" when I log in under the repair environment. I definitely haven't changed my username and it's a little concerning when 'twoshoes' has sole administrator rights. I have been choosing 'User'. Maybe this is why I get the 'file not found' in the CMD prompt environment?

    2) I actually ran a virus scan (never thought to previously do this). I had 69 threats using AVG free. They were IRP Hook Detections. So I dont know if these are the cause of my issues?

    Anyway, if you have any feedback with these 2 points then great otherwise, please be patient for a few days whilst I fully back up everything so I can confidently reboot my computer!

    Thanks 

    Sunday, July 7, 2013 8:42 AM
  • The reason for that is simple (sorta :) )

    Windows has a two (or even three)-tier way of identifying a user

    The SID (Security IDentifier) is the only one that matters - it's a long string of characters that starts S-1-5-, and ends -100x - where x increments by one, every time you create a new user.

    I can pretty much guarantee that your twoshoes identifier will end -1000

    The system then relates that to the originally-created username by means of a set of registry entries.

    If you change that name (without creating a new user account), then the original username is still used in the registry, but is linked to the new alias elsewhere in the registry so that you may see references to either name in various parts of the system.

    Outside the system - such as in the Repair Environment - the OS doesn't have the hooks into the registry to see the updated name, but only the original one, so that's why you see 'User' instead of 'twoshoes'.

    As far as your AVG detections are concerned, I'd want to see the details before pronouncing - and I recommend that you also run a full system scan with MalwareBytes Anti-Malware....

    Please download and install  Malwarebytes Anti-malware (free version) from  http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation -  and update it, then run a full scan  in your main account, and Quick scans in any other user accounts.

     

    Delete everything it finds   


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, July 7, 2013 8:53 AM
    Moderator
  • Hi there

    This is the report from Malwarebytes:

    Database version: v2013.07.07.02

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 10.0.9200.16618
    User :: USER-PC [administrator]

    7/7/2013 7:04:28 PM
    MBAM-log-2013-07-07 (19-22-32).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 364785
    Time elapsed: 13 minute(s), 31 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 1
    HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> No action taken.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 1
    C:\Users\User\Downloads\Setup.exe (PUP.IBryte) -> No action taken.

    (end)

    And this is the report from VG (please ignore the 'Reboot required to finish action - this is an action that I have to complete......)

    "";"IRP hook, \Driver\volmgr IRP_MJ_SYSTEM_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_SHUTDOWN -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_SET_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_SET_SECURITY -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_SET_QUOTA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_QUERY_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_QUERY_SECURITY -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_QUERY_QUOTA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_POWER -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_PNP -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_LOCK_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_INTERNAL_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_FLUSH_BUFFERS -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_FILE_SYSTEM_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_DIRECTORY_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_DEVICE_CHANGE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_CREATE_NAMED_PIPE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_CREATE_MAILSLOT -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_CREATE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\volmgr IRP_MJ_CLEANUP -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_WRITE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SYSTEM_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SHUTDOWN -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SET_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SET_SECURITY -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SET_QUOTA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SET_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_SET_EA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_READ -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_QUERY_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_QUERY_SECURITY -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_QUERY_QUOTA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_QUERY_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_QUERY_EA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_POWER -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_PNP -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_LOCK_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_INTERNAL_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_FLUSH_BUFFERS -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_FILE_SYSTEM_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_DIRECTORY_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_DEVICE_CHANGE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_CREATE_NAMED_PIPE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_CREATE_MAILSLOT -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_CREATE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_CLOSE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\partmgr IRP_MJ_CLEANUP -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_WRITE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_SHUTDOWN -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_SET_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_SET_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_SET_EA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_READ -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_QUERY_VOLUME_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_QUERY_INFORMATION -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_QUERY_EA -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_LOCK_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_INTERNAL_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_FLUSH_BUFFERS -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_FILE_SYSTEM_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_DIRECTORY_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_DEVICE_CONTROL -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_CREATE_NAMED_PIPE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_CREATE_MAILSLOT -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_CREATE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_CLOSE -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"
    "";"IRP hook, \Driver\Disk IRP_MJ_CLEANUP -> fltsrv2125.sys +0x26AC, C:\Windows\system32\DRIVERS\fltsrv2125.sys";"Reboot is required to finish the action"

    I'll keep you updated in a couple of days....

    Sunday, July 7, 2013 9:39 AM
  • The fltsrv2125.sys file appears to be from Acronis TruImage

    I would suggest uploading a copy of the file to virustotal.com and seeing if anyone else reports it as infected, as it may be a false-positive. (AVG has developed an unfortunate tendency for FP's over the years)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, July 7, 2013 10:00 AM
    Moderator
  • OK. You're right. I do use Acronis True Image so I guess it's okay.

    So, I am having trouble getting to the DeskTop again. But I have backed up my data so I am this close to doing a clean reinstall.

    What do you think? If I can't access or get the 2wsaa file to work I think this is looking pretty tempting.

    Would you do a clean install or just a reinstall of windows that keeps or your documemts intact?

    twoshoes.

    Tuesday, July 9, 2013 7:14 AM
  • I can't see any good reason why you shouldn't have access to the file - please check that you precisely followed the instructions I posted.

    A repair install 'should' leave your files and installed programs functional - but there is always the chance of problems, so you should back up to external media first.

    A clean install will wipe everything on at least the C: drive - so you MUST back everything up!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Tuesday, July 9, 2013 8:24 PM
    Moderator
  • Hi Noel Apologies for the delayed reply. I've been on extended leave but should close this with you as a matter of etiquette. In the end I decided to reformat the drive which wasnt a big deal for me. I didnt feel defeated. I will say though that your solution at the beginning definitely held credennce. During the process of: "DIR C:\wfire hit the enter key - if you get a 'Not Found' error try DIR D:\wfire or DIR E:\wfire The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command..." I noticed that my hard drive was classified as G. I hadnt gone through the alphabet enough to reach 'G' (I went as far as F)! So I guess had I chosen that letter, I would have been underway. Thank you for your time and consideration on this matter though. All the best. Kevin
    Tuesday, August 27, 2013 4:23 AM