Hi Noel,
Okay, I waited 10 minutes, then ran the REG UNLOAD HKLM\COMPONENTS command.
Here's what I got:
C:\Windows\system32>REG UNLOAD HKLM\COMPONENTS
ERROR: The parameter is incorrect.
Then I rebooted and ran CheckSUR. Here's the log:
Attachment 260918
I also got a Windows Update notification of a couple of available updates...one of which seems fairly old. I've attached a screenshot. Not sure if it's relevant, but providing for completeness.
One additional tidbit that may be of interest: the "Turn Window Features On and Off" box is now completely empty.
Well, that seems to be an improvement, at least! :)
[edit] The WU offerings, that is! [/edit]
Having said that, there's no change in the CheckSUR, so we need to run some more tests.
Let's check that the registry changes survived the reboot...
Please open an Elevated Command Prompt, and run the following commands - post the results.
REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
REG QUERY HKLM\COMPONENTS
REG UNLOAD HKLM\COMPONENTS
also please run a new SFC /SCANNOW, and post the new CBS.log file
...Have you ben using any form of Registry Cleaner on this machine??
Please download the Farbar Service Scanner from
http://www.bleepingcomputer.com/download/farbar-service-scanner/
Run it, and tick all the options, then click on the Scan button - copy and paste the report to your response.
No, I haven't used any kind of registry cleaner, at least not intentionally :) I'm posting the results you asked for previously, then will download the Farbar Service and report back.
Here's the results of the Registry Commands and the sfc /scannow
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
The operation completed successfully.
C:\Windows\system32>REG QUERY HKLM\COMPONENTS
HKEY_LOCAL_MACHINE\COMPONENTS
LastScavengeCookie REG_QWORD 0x1ce0a708a595a96
LastScavengeFlags REG_DWORD 0x7
StoreArchitecture REG_BINARY 0009000000
StoreFormat REG_BINARY 30002E0030002E0030002E003600
HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData
HKEY_LOCAL_MACHINE\COMPONENTS\ccpinterface
HKEY_LOCAL_MACHINE\COMPONENTS\Configuration
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData
HKEY_LOCAL_MACHINE\COMPONENTS\Installers
HKEY_LOCAL_MACHINE\COMPONENTS\ServicingStackVersions
C:\Windows\system32>REG UNLOAD HKLM\COMPONENTS
The operation completed successfully.
C:\Windows\system32>
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Windows Resource Protection could not perform the requested operation.
C:\Windows\system32>
Here's the CBS.zip file:
Attachment 260924
Aaargh! - I got the value name wrong.
Please run the following in an Elevated command prompt to correct my error, and insert the proper value
Code:REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS REG DELETE HKLM\COMPONENTS /v StoreFormat /F REG ADD HKLM\COMPONENTS /v StoreFormatVersion /t REG_BINARY /d 30002E0030002E0030002E003600 /f REG UNLOAD HKLM\COMPONENTS .
No worries!
OK, I ran the new set of registry commands - no errors. :) Then rebooted and ran the SUR tool and sfc /scannow.
This is what I got
I couldn't upload the entire CBS.zip file, it was too large. I got rid of the .CAB files and the CheckSUR.persist log and zipped it. Here's the abbreviated resultMicrosoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Windows Resource Protection could not perform the requested operation.
C:\Windows\system32>
Attachment 260931
Also, the Add/Remove Windows components box is still empty, FWIW
The CheckSUR log is a lot healthier (if you want to call it that)
Here's the summary
(I think that's the largest number I've ever seen there!)Code:Summary: Seconds executed: 243 Found 63488 errors Fixed 63488 errors CSI Missing Component Key Total count: 6037 Fixed: CSI Missing Component Key. Total count: 6037 CSI Missing Pinned Component Key Total count: 9128 Fixed: CSI Missing Pinned Component Key. Total count: 9128 CSI Missing Identity Total count: 15165 Fixed: CSI Missing Identity. Total count: 15165 CSI Missing C Mark Total count: 17617 Fixed: CSI Missing C Mark. Total count: 17617 CSI F Mark Missing Total count: 24669 Fixed: CSI F Mark Missing. Total count: 24669
The CBS log is interesting, to say the least - it has a large number (~1600?) of this type of error....
I think it's worth running CheckSUR again - since there was so much corruption last time, it may have completely missed many errors.Code:Line 47589: 2013-03-24 13:49:53, Error CSI 00000e4a (F) Store architecture value set, but not sizeof ulong: {l:5 b:0009000000}[gle=0x80004005] Line 47590: 2013-03-24 13:49:53, Error CSI 00000e4b@2013/3/24:20:49:53.194 (F) d:\win7sp1_gdr\base\wcp\componentstore\com\store.cpp(5303): Error STATUS_SXS_COMPONENT_STORE_CORRUPT originated in function Windows::COM::VerifyStoreVersionNumber expression: (null)
it may however be that these errors are from updates which are not covered by the CheckSUR tool - in which case, the only solution is probably going to be a repair install (or even a clean install)
Of the 145200+ lines in the CheckSUR report, 143000+ are related to either the original RTM issue of files or the SP1 issue - only 2000 or so are related to updates.
Given the size of your Components file, I would have expected there to be many more update entries present - but it's very difficult to get similar results from a 'known good' machine (I may play and try to do it tomorrow)
Quote