I have had problems all day long with Windows 7... I have accidentally removed some infected .sys files (cant remember exactly the name) although I have tried to discover where and what were they but without success. Eventually the os wont boot and i always get 2 options 1.normal startup 2. System recovery. I have tried to bring the system to a previous state with system restore but also without any luck. Anyway nothing works except when i boot the system recovery from cd drive, where i could browse partitions with exception of C drive which is said to be reserved (i presume its reserved for the System recovery). So i copied the memory dump file and analyzed it where i found this:


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
************************************************** **************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
************************************************** **************************
Executable search path is:
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c54000 PsLoadedModuleList = 0x82d9c810
Debug session time: Mon Sep 6 15:42:18.258 2010 (UTC + 1:00)
System Uptime: 0 days 15:31:13.513
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
...............................
Loading User Symbols

Loading unloaded module list
..............
2: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c0468438, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000009d, error status (normally i/o status code)
Arg3: 559f9be0, current process (virtual address for lock type 3, or PTE)
Arg4: 8d087000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 82c54000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c3fac

ERROR_CODE: (NTSTATUS) 0xc000009d - STATUS_DEVICE_NOT_CONNECTED

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR: 0x7a_c000009d

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 82d0861a to 82d30d10

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8dfc7af4 82d0861a 0000007a c0468438 c000009d nt!KeBugCheckEx+0x1e
8dfc7b68 82d000e5 895a7444 8dfc7bc0 82d88540 nt!NtFreeVirtualMemory+0xde9
8dfc7bfc 82cdbe5f 82d88540 8d087000 895a73b0 nt!IoSetThreadHardErrorMode+0x1657
8dfc7c80 82c88259 00000001 8d087000 00000000 nt!MmDisableModifiedWriteOfSection+0x3b4c
8dfc7d10 82c87f7a 891337f8 8dfc7d30 00000000 nt!RtlDelete+0xdea
8dfc7d44 82ce0023 8901d4dc 8dfc7d90 82e626d3 nt!RtlDelete+0xb0b
8dfc7d50 82e626d3 00000000 a77bab43 00000000 nt!KeRevertToUserGroupAffinityThread+0x5a6
8dfc7d90 82d140f9 82cdffab 00000000 00000000 nt!PsCreateSystemThread+0x19a
00000000 00000000 00000000 00000000 00000000 nt!wcsupr+0x14a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!NtFreeVirtualMemory+de9
82d0861a cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!NtFreeVirtualMemory+de9

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrpamp.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Is there a soultion to this?
Any help please i desperatly need to save docs on C drive...

To save your data, download the bootable Puppy Linux iso image. Get the latest version available, currently pup-431.iso. If you don't have a burning program that will burn .iso files get burncdcc, a small FAST no frills iso burning program.

NOTE...do not put a blank cd in until burncdcc opens the tray for you.

1. Start BurnCDCC
2. Browse to the .iso file you want to burn on cd/dvd ......in this case its puppy linux
3. Select the .iso file
4. Suggestion.... Check the option "Fix close"
5. Click on "Start"

Make sure in the BIOS Setup, the CD/DVD drive is the first boot device. Put the Puppy Linux CD in the drive, then reboot your computer. Puppy will boot and run totally in ram. After you get it running and you're at the Puppy Desktop, take the CD out and then you can use the burner software to save all your data to CD/DVD. You can also use it to backup your data to a external USB harddrive or Flash drive, just have it hooked to the computer when you boot up with Puppy.

Also, see this tutorial by theog on sevenforums.com for a neat trick to use to allow you to Copy & Paste from the Recovery Console to save files and folders.

hey thanks that did the trick...

You're welcome, glad I could help.