Please help repairing windows not genuine dialog popping up

tenjuna · 27 Nov 2012

how the heck can there be pending deletes from 2009? this is a fresh install of windows 7 lol.

tenjuna · 27 Nov 2012

it didn't like those commands for some reason, but I figured it out. file attached.

NoelDP · 27 Nov 2012

It's the modify date that shows, rather than the creation date :)
I'm testing some scenarios at teh moment to see what happens - back later

NoelDP · 27 Nov 2012

(just rambling and recording some results - you can ignore this post :) )
.... a reboot clears the deletes on my VM, but not the renames.
My Win 7 VM on the other hand, has no files in either folder at least in its current state).
Running an SFC populates the renames folder with almost 1800 files (all of them cdf-ms type) - which remain after a reboot.

Since the Deletes are themselves deleted after a reboot - what are they deleting, and are they required?????
Back to Vista... delete 5 files (advapi.dll variants) from the deletes folder and reboot - the folder is not emptied.
Run SFC - no integrity violations, and no error messages about 'Unable to delete'
permissions??remove TrustedInstaller from the ACL... nothing in an SFC eitehr before or after a reboot.
Remove SYSTEm from the ACL...
Checked your entries against the source files, and they appear to be simple copies.
Checked registry entries for the 'missing' deletes I created.... nothing that I could see was relevant.

On deletion of the folders, (takeown and permissions required) reboot is OK, SFC /SCANNOW rebuilds the renames, but not the deletes.

NoelDP · 27 Nov 2012

OK - I'm back live now :)

Please open an Elevated Command Prompt, and run the following commands

TAKEOWN /F C:\Windows\winsxs\Temp\pendingdeletes /A /R
ICACLS C:\Windows\winsxs\Temp\pendingdeletes /grant AdministratorsF) /T
DEL C:\Windows\winsxs\Temp\pendingdeletes\*.* /Q

Note any error messages! - if you do get any, STOP THERE, and post back with details.

otherwise, close the window, and reboot

now run another SFC /SCANNOW.
reboot, and post the new CBS.log file

tenjuna · 28 Nov 2012

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>TAKEOWN /F C:\Windows\winsxs\Temp\pendingdeletes /A /R

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes" now owned
 by the administrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe
.sortkey.nlp.01cd2dbd122c48d3.0007" now owned by the administrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe
.sorttbls.nlp.01cd2dbd1227dbf2.0006" now owned by the administrators group.

C:\Windows\system32>ICACLS C:\Windows\winsxs\Temp\pendingdeletes /grant Administ
rators:(F) /T
processed file: C:\Windows\winsxs\Temp\pendingdeletes
processed file: C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sortkey.nlp.01c
d2dbd122c48d3.0007
processed file: C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sorttbls.nlp.01
cd2dbd1227dbf2.0006
Successfully processed 3 files; Failed processing 0 files

C:\Windows\system32>DEL C:\Windows\winsxs\Temp\pendingdeletes\*.* /Q
C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sortkey.nlp.01cd2dbd122c48d3.00
07
Access is denied.
C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sorttbls.nlp.01cd2dbd1227dbf2.0
006
Access is denied.

C:\Windows\system32>

tenjuna · 28 Nov 2012

actually what's odd is there isn't a PendingDeletes folder, but there is a PendingRenames...not sure how there could be successful operations on a folder that doesn't exist?

tenjuna · 28 Nov 2012

tenjuna said:

actually what's odd is there isn't a PendingDeletes folder, but there is a PendingRenames...not sure how there could be successful operations on a folder that doesn't exist?

ignore this, I apparently have lost the ability to spehl my werds currectly.

edit: I did check and Administrators do have Full Control privs over those 2 files.

NoelDP · 28 Nov 2012

The PendingDeletes folder is normally hidden - which is why you can't see it in Windows Explorer.

From the look of the results you got, there is file corruption.
Please run (another?) CHKDSK C: /R and see what happens.

Your best option in that case is to run the CHKDSK and SFC in offline mode from a Recovery Environment boot.

Reboot the computer, and tap the F8 key until you get the advanced boot menu up - one option should be 'Repair your computer'. Pick that one.

Log into your normal account.
You'll get a set of options - pick the Command Prompt one.
At the command prompt, type DIR C:\
- if we're lucky this will bring up a listing of your normal C: drive contents, including the Program Files folder(s) and the Windows folder.
If not, try D:\ or E:\ (etc. until you get the right letter)
then type the following command

CHKDSK <drive>: /R

and wait for it to complete - it could take a few hours, depending on the size of the drive.

reboot to Normal windows, and post the results you saw in the Recovery Environment (you can try copying them to a Notepad file and saving them in your system drive.)

tenjuna · 28 Nov 2012

the first time I ran it, it hung at 98% complete while scanning free space. I did not see any errors in the output.

it just finished running for the 2nd time and reported no problems at the end.

edit: I take that back, it reported failed to transfer logged message to the event log with status 50. but otherwise the file system looks fine.