Windows Update - total failure. TrustedInstaller.exe ==> 25% CPU.

Hi shiphen,

It's strange, the corruption pattern is identical to what we faced a few weeks ago. It isn't the same keys, but it's the same process.

If you have installed/removed any updates since uploading that file, do NOT follow these instructions. Instead, upload another copy of your COMPONENTS hive please :)

Warning: This fix is specific to this user (shiphen), no one else should follow these instructions as it will cause a lot more problems than it will solve! I will remove this file after the fix has been completed.

Download this file please: https://dl.dropbox.com/u/16537616/components

Navigate to the following folder:

C:\Windows\system32\config

Delete the file: COMPONENTS. Then paste the file that you downloaded from the link above :)

Reboot, then run the SURT and upload the CheckSUR.persist.log please.

Tom

I'm not barging in but I though this might help understand things.
How can I be sure if I am still infected with "Win32/Small.CA" virus".

Seams like two repair threads on same computer at the same time.
The right hand might not know what the left hand is doing.

shiphen said:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-18 18:18
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739 Bad identity
(f) CSI Manifest Missing 0x00000002 msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f Bad identity
(f) CSI Manifest Missing 0x00000002 wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f
Summary:
Seconds executed: 189
Found 4 errors
CSI Manifest Missing Total count: 2
CSI Corrupt Identity Total count: 2
Unavailable repair files:
winsxs\manifests\msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest
winsxs\manifests\wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-19 20:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 189
No errors detected


OK what next?

Wfiw, I am using a SSD.
Do you think it smell of malware or of SSD/hardware failure?

Many thanks

J

Hi J,

If you don't mind, I would prefer it if you stick to this thread and this thread alone for Windows Update issues. I'm confident that between Noel and myself, we have the expertise to be able to solve this :)

How is Windows Update running now? That COMPONENTS replacement fixed everything.

Layback Bear said:

I'm not barging in but I though this might help understand things.
How can I be sure if I am still infected with "Win32/Small.CA" virus".

Seams like two repair threads on same computer at the same time.
The right hand might not know what the left hand is doing.

Thanks for pointing this out!

Tom

You welcome Tom. I will go back to watching and learning.