Computer works in safe mode. Restore/repair fail...help!

Hi scott I, Welcome to Seven Forums. Have you tried, in safe mode, opening a command prompt and typing "sfc/scannow" and hitting enter? This scans windows files and will repair them if they are corrupt. May work May not but well worth the try.

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to a reply so I can take a look.

OK - try this, then....


Your best option in that case is to run the CHKDSK and SFC in offline mode from a Repair Environment boot.

Reboot the computer, and tap the F8 key until you get the advanced boot menu up - one option should be 'Repair your computer'. Pick that one.

Log into your normal account.
You'll get a set of options - pick the Command Prompt one.
At the command prompt, type DIR C:\
- if we're lucky this will bring up a listing of your normal C: drive contents, including the Program Files folder(s) and the Windows folder.
If not, try D:\ or E:\ (etc. until you get the right letter)
then type the following command

CHKDSK <drive>: /R

and wait for it to complete - it could take a few hours, depending on the size of the drive.

Once complete, type

sfc /scannow /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\Windows

where <drive> is the letter you found above.
(example - sfc /scannow /OFFBOOTDIR=P:\ /OFFWINDIR=P:\Windows)

Wait for the command to complete. (make a note of the response!).

Once it has, type EXIT and the pick the option to reboot.

".. I do not have a disk drive on my computer" ? huh cd/dvd optical ?
Is this a notebook? Presuming you can still have the hard disk removed, plugged into a usb external and have someone run malwarebytes on it, full scan.

I ran the sfc scannow and it worked this time. its says there are files corrupted but some cannot be repaired. details are included in the cbs log. I tried to type in C:\Windows\Logs\CBS\CBS.log to see it but it said access denied. i was running the command prompt as a admin/owner. How do i see the cbs log and then attach it here so you can look at it?

SEE BELOW POST FOR CBS file.

There's only one corrupt file identified by SFC -

Code:

 Line 14344: 2013-08-22 13:26:06, Info                  CSI    00000309 [SR] Repairing 1 components
 Line 14345: 2013-08-22 13:26:06, Info                  CSI    0000030a [SR] Beginning Verify and Repair transaction
 Line 14348: 2013-08-22 13:26:06, Info                  CSI    0000030c [SR] Cannot repair member file [l:22{11}]"wuaueng.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 14351: 2013-08-22 13:26:07, Info                  CSI    0000030e [SR] Cannot repair member file [l:22{11}]"wuaueng.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 14352: 2013-08-22 13:26:07, Info                  CSI    0000030f [SR] This component was referenced by [l:150{75}]"WUClient-SelfUpdate-Core-CoreComp~31bf3856ad364e35~amd64~~7.6.7600.256.Core"
 Line 14357: 2013-08-22 13:26:07, Info                  CSI    00000312 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"wuaueng.dll"; source file in store is also corrupted
 Line 14362: 2013-08-22 13:26:07, Info                  CSI    00000314 [SR] Repair complete

I'll post a fix protocol for it later.
In the meantime, please try running the CheckSUR tool

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply.