Multiple issues after update (sfc /scannow and CheckSUR logs included)

EWG · 26 Mar 2013

Hi everyone,

I'm currently using Windows 7 Home Edition, 64bit. Back on 3/14 Windows installed some updates, and since then my computer has been acting strange. The updates that installed successfully were as follows:

KB915597 (Defender Update For Windows Explorer)
KB2553501 (Sec Update for Microsoft Silverlight)
KB890830 (Windows Malicious Software Removal Tool x64)

The following two updates failed to install:

KB2809289 (Cumulative Security Update for IE 9 for Windows 7 for x64)
KB2791765 (Updates for Windows 7 for x64-based Systems)

After the issues started I performed a System Restore to back before the updates, and it fixed all the issues. However, I then left for the weekend and forgot to turn off automatic-update. Windows then proceeded to continue to try (and fail) to install the two updates listed above. When I returned, the restore point that I originally used was gone, and the existing restore points did not solve my issues. Here is a listing of some of the (seemingly random) issues I experience:

1. When booting, I get an error saying that sidebar.exe cannot load due to missing urlmon.dll
2. When attempting to play any .WMV file I receive an error that "Server execution failed"
3. All folders open in a new Window when double-clicked
4. Clicking a link in IE opens a new tab instead of just opening the link
5. Searching for updates using the Windows Update tool fails due to error 802400E: Windows update encountered an unknown error
6. Attempting to add a .WMV to Windows DVD Maker throws an error that "<file>.WMV is not a supported type, and it cannot be imported."
7. Further attempts to install the following Windows Updates continue to fail and must be rolled back:
a. KB2809289 (Cumulative Security Update for IE 9 for Windows 7 for x64)
b. KB2670838 (Platform Update for windows 7 x64-Ediition)

While none of these are major errors, they appear to me to be indicative of a larger problem. I have taken the following actions, all with no results:

1. Ran a virus scan using avast! (no issues found)
2. Ran a system scan using Malwarebytes (no issues found)
3. Ran a System Repair using chkdsk /r
4. Ran a System Check using sfc /scannow, both online and offline (both ways say it could not fix some of the problems)
5. Ran a CheckSUR (could not fix all problems)

I also decided to try uninstalling all of the Windows Updates that had been successfully installed in March. Doing so did not fix any of the issues I am having, but it did result in cleaner logs for both sfc /scannow and CheckSUR.

I feel like I've run out of options at this point, and I was hoping someone might be able to provide some assistance or guidance. I'd really prefer not to have to perform a clean install (obviously), so anything would be helpful.

Thank you everyone for any help you can provide.

Sincerely,
EWG

Attachments:
1. SFC_1 (from original run of sfc /scannow)
2. CheckSUR_1 (from original run of CheckSUR)
3. SFC_2 (from second run of sfc /scannow, after uninstalling recent Windows Updates)
4. CheckSUR_2 (from second run of CheckSUR, after uninstalling recent Windows Updates)

ICIT2LOL · 26 Mar 2013

Hello and welcome EWG mate you seem to have done all the right things but you cold try some other scans try these

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Oh download ADW from bleeping computer

EWG · 27 Mar 2013

Thanks for the advice ICit. I'd actually already run the Malwarebytes scan, so I felt no need to do that again. I did download and run both the ADWCleaner and TDSKiller programs, but neither of them found any issues with my PC.

I've had (and dealt with) viruses and adware in the past, and while I don't know for certain, this just doesn't feel like anything malicious. It seems to me like something must have gotten messed up in the registry or the internal Windows settings with the install/fail/uninstall of the recent Windows Updates that is causing my weird issues

ICIT2LOL · 27 Mar 2013

Hum well I am surprised that the ADW didn't pick something up if it was lurking in the registry.

Have you had a check back through the event viewer for any "loud" errors?

A run with the CCleaner registry checker might be worth try mind you back up if you are going to let it fix the stuff it comes up with.

Might sound daft but date and time are correct? - just thinking why those two will not update because I am guessing you would have the Update Readiness tool on board by now?

NoelDP · 27 Mar 2013

The CHeckSUR reports these problems....

Code:

Unavailable repair files:
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~es-ES~7.1.7601.16492.mum
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~ja-JP~7.1.7601.16492.mum
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~pt-BR~7.1.7601.16492.mum
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~zh-HK~7.1.7601.16492.mum
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~es-ES~7.1.7601.16492.cat
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~ja-JP~7.1.7601.16492.cat
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~pt-BR~7.1.7601.16492.cat
    servicing\packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package~31bf3856ad364e35~amd64~zh-HK~7.1.7601.16492.cat

The SFC results are not present in the logs you posted - please post the entire CBS folder (zipped!) so we can tack back.

NoelDP · 27 Mar 2013

I've uploaded a file - ewgaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder ewgaa in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

EWG · 27 Mar 2013

Hi Noel,

Thanks for the assistance. I followed your instructions and CheckSUR appears to have been able to fix all the issues it found. However, all of the problems I mention in my original e-mail still continue to exist. I've attached a zipped copy of my CBS folder, containing both the CheckSUR and SFC logs.

Thanks,
EWG

NoelDP · 27 Mar 2013

Your SFC scan found no problems - but buried in the CBS logs I found a number of references to problems with the 'Localized property bag' which appears to relate specifically to .NET installations.

I suggest that you read the following article - .NET Framework Cleanup Tool User's Guide - Aaron Stebner's WebLog - Site Home - MSDN Blogs - and attempt a cleanup of your .NET installations.

EWG · 27 Mar 2013

I'm at work right now, but when I get home this evening I'll check out that thread and give it a shot.

Thanks!

EWG · 28 Mar 2013

So I downloaded and ran the .NET Framework Cleanup Tool, the logs of which I've attached in a folder.

I then reinstalled the .NET Framework 4 Client Profile, which was the only instance of .NET that I found in my Add/Delete programs listed.

I then ran SFC /scannow, and I have attached the CBS folder again with the logs.

Unfortunately, all of the random issues still exist