Multiple issues after update (sfc /scannow and CheckSUR logs included)

EWG · 29 Mar 2013

A manual scan for updates still results in a 8024000E error, so I just picked the next available update in the list I posted, which had a release date of 9/13/2011:

KB2533523: Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 R2 for x64-based Systems

The update installed without issue, I rebooted my PC, and have attached the new log file!

Should I just start going through (ONLY) the .NET updates and installing them in order, as long as I don't hit any errors?

NoelDP · 29 Mar 2013

Yes please - I can't tell from the update log which file is causing the problem, although the problem appears to be with an xml file rather than any of the individual updates.

Please upload the following file...
c:\Windows\SoftwareDistribution\WuPackages.xml

EWG · 29 Mar 2013

I don't see any such file...

Two more updates installed without error:

KB2656351 (12/29/2011): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

KB2600217 (2/14/2012): Update for Microsoft .NET Framework on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

NoelDP · 29 Mar 2013

So far, so good - carry on!.
I suspect that it's note one of the .NET updates causing the problem 0 and it may be something else entirely.
Let's get all the updates installed that we can - if any fail, stop there, and post the new windowsupdate and CBS logs, and I'll see what I can find there.

NoelDP · 29 Mar 2013

This error seems to be the core problem...

Code:

2013-03-27 21:49:13:228  120 bb8 Agent FATAL: fail to register class object 0x80004015
2013-03-27 21:49:13:228  120 bb8 Agent FATAL: Client call recorder fails to init with error 0x80004015
2013-03-27 21:49:13:228  120 bb8 Agent   * FATAL: Failed to initialize with error 0x80004015 from component Agent

Please open an Elevated Command Prompt and run the following commands.

SC SDSHOW BITS
SC SDSHOW WUAUSERV

Post the results - and then

Please download http://kb.eset-la.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe and save it to your desktop.
Double-click ServicesRepair.exe
If security notifications appear, click
Continue or Run and then click Yes when asked if you want to proceed.
Once the tool has finished, you will be prompted to restart your computer.
Click Yes to restart.

and run the above two commands again - post the new results.
Then do a manual check for updates, and attempt to install only the oldest of the updates found - what happens?

EWG · 29 Mar 2013

All of the following .NET updates installed without error:

KB2604121 (5/8/2012): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

KB2729449 (11/13/2012): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

KB2737019 (11/13/2012): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

KB2742595 (1/8/2013): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

KB2789642 (2/12/2013): Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 for x64

I've attached the Windows Log, CBS Log, and the remaining Important Updates.

I'll now try your suggestions from the above post as well!

EWG · 29 Mar 2013

sc sdshow bits:

d: (a;ci;ccdclcswrpwpdtlocrsdrcwdwo;;;sy)(a;;ccdclcswrpwpdtlocrsdrcwdwo;;;ba)(a;;
cclcswlocrrc;;;iu)(a;;cclcswlocrrc;;;su)s: (au;safa;wdwo;;;ba)

sc sdshow wuauserv:

d: (a;;cclcswrplorc;;;au)(a;;ccdclcswrpwpdtlocrsdrcwdwo;;;ba)(a;;ccdclcswrpwpdtlo
crsdrcwdwo;;;sy)s: (au;fa;ccdclcswrpwpdtlosdrcwdwo;;;wd)

When attempting to run the Services Repair file I get the following error:

ServicesRepair_x64.exe - System Error

The program can't start because WININET.dll is missing from your computer. Try reinstalling the program to fix this problem.

NoelDP · 30 Mar 2013

Oooh!
There are some very interesting changes to the services permissions there - and the fact that the repair tool says that wininet is missing doesn't bode well. It probably means that permissions are preventing access, since SFC isn't complaining about its lack.

Please run the following commands

ICACLS C:\Windows\system32\wininet.dll /T
ICACLS C:\Windows
ICACLS C:\Windows\System32

post the results.

EWG · 30 Mar 2013

Done:

ICACLS C:\Windows\system32\wininet.dll /T

C:\Windows\system32>ICACLS C:\Windows\system32\wininet.dll /T
C:\Windows\system32\LogFiles\WMI\RtBackup\*: Access is denied.
Successfully processed 0 files; Failed processing 1 files

ICACLS C:\Windows

C:\Windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(M)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

ICACLS C:\Windows\System32

C:\Windows\system32>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(M)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

NoelDP · 31 Mar 2013

OK- we'll have to do the file search in detail, then...

DIR C:\Windows\winsxs\wininet.* /S
DIR C:\Windows\System32\wininet.dll /S
ICACLS C:\Windows\winsxs\wininet.* /T
ICACLS C:\Windows\System32\wininet.* /T