Windows 7 hangs due to November 2017 patch tuesday

We have a boot problem with a number of Dell PC of different models  all from 2013/14 both laptops and desktops  running windows 7. I believe all the PC are 32 bit , but we have other PC that are 32 bit that are not affected so it is probably chipset related. ( Vostro 270, Latitude 3460 affected  -  Opltiplex 390 not)

Symptoms

system hangs on black windows screen with flag ie never get to welcome screen.

Boot into safe mode,

restore to earlier  point

 once restored system hangs on black windows screen with flag ie never get to welcome screen.

on boot into safe mode

system shows boot file list, and please wait

system hangs on totally black screen

Ideas on a postcard please guys!!

Thanks , a techie with a headache

F8 and last known good config got me back in, however if you restart, same issue.  Going to look further at it later, but it reported failure of KB4048957 & KB2952664.  sfc /scannow didn't fix.

AVG!  Start in safe mode, remove AVG, complete the updates correctly then try putting AVG back on.

Edited by caskie, 15 November 2017 - 12:08 PM.

Thanks Caskie

Five of the PCs we manage got hit with this issue today. Thankfully not every PC is affected - we have hundreds. They've all got AVG on. Windows 7 32bit seems disproportionately affected, considering how few 32bit machines we have. Hardware varies from ancient core2duo machines to 2nd gen i3, with a range of motherboard manufacturers.

We managed to get two of them to boot by getting the users to attempt Startup Repair. That said it failed to fix anything but then the PCs booted normally anyway. We then hid the KB4048957 & KB2952664 updates you mentioned and asked the users not to reboot/turn off until we know more.

I visited one of the problem machines this afternoon. Sadly "Last known good config" failed to load, as did Safe Mode. Safe mode went through all the usual .sys file loading white text on black background, then brought up a promising looking "Failure configuring windows updates. Reverting changes. Do not turn off your computer." That completed in like 3 mins, the pc reboot itself and then it got stuck loading normal windows again. I forced a reboot, tried safe mode again but it got stuck at the Reverting Changes screen that time and i gave up after 15 mins.

I then tried system restore to a point from 3 days ago. System restore finished by saying "system restore did not complete successfully. Your computer's system files and settings were not changed. Details: An unspecified error occurred during System Restore. (0x800700b7). Bizarrely, given this error message, Windows then booted fine. 

I've uninstalled AVG, run the windows updates again, let it automatically reboot and currently installing Avast anti-virus.

How did you determine AVG was the issue? 

Edited by MSP2017, 16 November 2017 - 02:26 AM.

I only had time to do one yesterday, safe mode, removed AVG, normal boot, check for updates and it was ok.  I haven't put AVG back on yet.

Whilst loading Safe mode it hung for a bit at at AVGidSHA.sys  

The last time there was an issue like this, it was a trusteer rapport interfering with AVG and or the other way rond.

20171116 10:36 UTC: Yesterday am I shut down computer and noticed msg. windows 7 update don't shut down. (The normal msg).  This morning is first time turning on PC since yesterday and failing to boot up. Ends up on screen "Start up normal" or "Try to repair".  After Normal failed numerous times I tried repair option that indicated it failed to repair. Did the further repair hyperlink option and noticed two restore points on 20171115 with critical update description. Selected show other restore points and luckily there were 3 others that popped up. 11/2, 11/6, 11/11. I tried them all and completed indicating unable to complete restore successfully. Normal exit from recover screen and hit F8 numerous times and received small window that you get giving you the option to pick drive you want to boot from. It also had a selection I don't remember exactly but it was something to the effect of more diagnosis. My blue ray dvd was on top and I have 3 HD's listed. I selected the SSD which is the boot drive and it booted up with a notice my system has been restored to 11/6. Which was strange because this was one of the restore points I tried earlier that said it failed. First thing I did was turn off automatic critical windows updates. I don't have AVG if you're talking about virus program. I only use the Windows 7 Microsoft Security Essentials Virus program. I'm going to do an Acronis mirror image immediately before I do anything else. 

Are your machines running Tusteer Rapport?

Caskie -   I've checked two of the affected machines and they both have Trusteer Rapport on them. That software is pretty rare in our organisation, only on these machines because the users wanted to do personal banking.

I've seen Trusteer Rapport cause a bunch of issues in the past but this would be a new low.

Edit: checked on a 4th affected machine and also see Trusteer Rapport installed. Will check on the other machines when/if i can and take it off where possible. 

Total of affected machines is now up to 6 today.

NB: trusteer rapport version number on computer 4 is 3.5.1804.161   (presume all the rest are the same but haven't been checking)

After the system restore, computer 4 was shutdown before I had a chance to do anything about trusteer, antivirus or windows updates, and yet it booted up normally (the trust relationship has failed with the domain controller but i suspect that's just a coincidence and is easy enough to sort)

Computer 3 automatically restarted after installing windows updates and it went back to getting stuck at startup. Went through system restore again successfully and strongly urged the user to remove Trusteer Rapport and this time he agreed.

Edited by MSP2017, 16 November 2017 - 11:41 AM.

I just wanted to chime in on this thread.  I had a client with the same problem, computer running paid version of AVG antivirus.  All attempts to rectify failed - last known good config, safe mode, and Macrium Reflect Windows PE environment "fix boot issues."   Eventually restored the computer to a Windows Backup backup from 3 days prior using a Windows 7 x64 install disk and the computer is just fine now.  Talk about a doozie of a patch bungle!

Sup All,

Wanted to add some info on this.

I ran into 5 computers with this issue. I tried uninstalling AVG Cloud Care but that didn't solve the issue.

I believe the issue is Trusteer Report. I saw it on at least 3 of the machine and I remember having an issue with it with Internet Explorer in the past.

I am able to get the machine to boot into windows by going into the command prompt and replacing the backed up system file from the regback folder into the config folder.

That works every time until the machine is rebooted.

I hopes this helps,

Yes it is trustee rapport, it doesn't work well with AVG. we had to remove AVG, then remove Rapport, then re-install AVG, all ok now.  AVG talks about whitelisting rapport, but that still didn't work for us, so we left off rapport, it only occurred after patch Tuesday.  We're all good now.

I have experienced this same issue on a Win 7 Pro machine running a MSI 970A-G46 motherboard.  This machine runs Avira antivirus.

Also, truster raport was installed (which has now been removed).

I fixed the problem by restoring a system image of my system drive.  This was complicated by the fact that the external drive where the system image was stored was a USB3 6TB drive... and the system lost the USB3 driver required by the MSI board.

I installed an old system image from dvd, installed the correct USB3 drivers and found that windows backup would not locate the system image installed on the external drive, even though windows backup had placed it there.

I then copied the system image file (and supporting files) to an internal hard drive, windows backup recognized the image, and restored it from the internal hard drive.

Even after the restore, the system took quite a while to show the windows desktop... but everything now seems to work.

I will be skipping the November updates, unless this is verified fixed by MS.

Any word from them?

Edited by Baaaaaaa, 19 November 2017 - 02:00 AM.

Spent hours on a handful of machines doing the same thing, coincidentally/not so coincidentally all now having both AVG and Trusteer Rapport, and Last Known Good-->Uninstall Trusteer Rapport-->Reboot to Start Windows Normally is confirmed working on all. I left AVG in place just to take one step at a time and so far, so good. Thank you again all...I was just about getting ready to give up and reformat/restore them all.

Here is Rapport's support team's response to the issue:

The issue you have reported is currently being investigated by our company experts and we expect it to be resolved in a future release of Rapport.

In the meantime, as a workaround, we recommend you to disable one of Rapport mechanisms in order to resolve the issue you experienced.

To download Rapport's latest version:

http://www.trusteer.com/support/rapport-installation-links

Restart your computer at the end of the installation. Try to disable Rapport Cerberus in Safe Mode and let us know if the issue is resolved.

To do so, please follow the below instructions (we recommend writing them down before restarting your computer):

1. Restart your PC.

2. Press and hold the F8 key as your computer restarts until you reach the Advanced Boot Options screen. Please press F8 before the Windows logo appears.

3. On the Advanced Boot Options screen, use the arrow keys to choose the Safe Mode option and press Enter.

4. Log on to your computer with a user account that has administrator rights.

5. Open the Run command box by pressing the 'Windows' and 'R' keys on your keyboard simultaneously (alternatively, click Start > Programs > Accessories > Run). 

6. Enter the following directory:

C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus

7. Locate and open the folder named 'Baseline'.

8. Re-name all system files named 'RapportCerberus.sys' so that their names will contain an underscore first (e.g. '_RapportCerberus00_00000.sys'). Do not re-name files which do not end with '.sys'.

9. Reboot your computer and check if the issue is resolved.

Please note, these steps are temporary as part of our investigation. Please notify us regarding the results so we can provide a permanent solution.

Thank you for your cooperation.

http://www.trusteer.com/support/submit-ticket

http://www.trusteer.com/support/faq

Edited by MSP2017, 21 November 2017 - 06:11 AM.

Yes, my DELL OPITPLEX 755 stuck at 'Starting Windows' in early Novemebr 2017, probably after an update of AVG.

I searched the internet and tried many, many things.  I was able to get the system to work, but as soon as I powered off the computer the same thing happened.  I was able to keep the computer working by allowing it to sleep only, but not power off.  Today, I finally managed to fix it permanently.

The reason that it stuck was that windows started successfully, but other essential programs had to be started before the Users ID screen appeared.  However, it never got there because the anti-virus AVG was 'corrupted'.  The following was what I did to fix the problem.

1. Power on your computer and keep hitting the F8 key.

2. Choose start in Safe Mode.  I chose 'start in safe mode with networking'.  Don't know whether it is essential to have 'with networking'.

3. Uninstall AVG.  (I tried 'repair' when prompted, but the computer said it could not repair. it.)

4. Restart, and the computer should restart normally, passing through the 'Starting Windows', and ending in the users sign in page.

5. Sign into an Administrator account.  Chances are, you are one if you end up in this blog.

6.  The computer should now work.  You can verify it by 'restarting' to make sure that it does not stick at 'Starting Windows'.

The computer will now gives you a warning that you do not have an anti-virus' program.  Otherwise, it should be working normally.  To fix the 'no anti virus program', I guess you can reinstall AVG, but I found that MS now provides a ''Microsoft security essentials' program.  I did the following to add it as my default anti virus program.

7. Go to 'Control Panel' and navigate to 'Windows Update'.  Click on 'Restore Hidden Updates"

8. Restore the update for 'Microsoft Security Essentials', and install it along with any other updates.

9. After installing and restarting, your.computer should be back to normal startup and functioning.

Postscript

If the 'Microsoft Security Essentials' update is not available to you in your list of updates available or hidden updates, I suppose it is possible to request it through a web search.  I have not tried it. 

I spent many stressful days and nights trying many suggestions.  The only one that helped was a blog where a responder asked whether the user on the verge of committing a self destruction was by any chance using AVG.  I read that but unfortunately did not try to remove AVG until many more stressful days and nights.  After I fixed the problem, I googled 'windows 7 stuck at starting windows avg', and ended up in this site among many others.  The time stamp of the blog of early November 2017 was when I encountered the problem.