Windows Update - won't install SP1 and other updates- error 0x80071a90

Faalks1 · 11 Apr 2014

Hello

I am struggling to make my windows update run properly.
There are 3 important updates that I cant make it work, they are:
1- 2 of them concerning .NET framework 4 (KB2742595 and KB2789642)
2- Service Pack 1 (KB976932)

For the .NET framework 4 updates: windows actually do update them and says they are sucessfully updated, but when I check for updates again, they are still there. The SP1 is a little different, it does install normally, but when PC logs off to continue installation, it never goes through 14%. Then it restarts, says failure and it rolls back, aborting the update, so when I check windows updates again, if shows SP1 failure, error 0x80071a90.
I've tried many different things, like manual update, safe mode or clean startup config, none work.

Also, I downloaded SURT and installed it, but it seems nothing really happened.

Following Windows Update Posting Instructions
1- installed SURT, but seems nothing happened
2- SFC scan is normal; error-checking tool is also ok.
3- No errors appear on that screen. I will only find the error code for SP1 if I click on "View update history"
4- CBS.zip attached

Any help will be greatly appreciated.

EDIT = couldn't attach zip file because it's size is 20mb.

Faalks1 · 11 Apr 2014

I just found out that when I open 'msconfig' , there are many services stopped, including many microsoft ones. If I try to enable then and restart my PC, simply nothing happens, they keep stopped.

I tryed to manually start them through 'services.msc', some of them start to work, like 'Vaio Event Service' which enables my Fn key, but when I restart, every alteration made is undone ( I quickly notice this when I try to use Fn key in attempt to raise/lower the volume, after I restart).

I thought of virus/malware could possibly doing so, so I ran MSE,adwcleaner, spybot but the errors remain. Any suggestions please?

NoelDP · 11 Apr 2014

Sounds like perhaps a corrupted profile - but it may be one of the major profiles, or your own.

Please open an Elevated Command Prompt, and run the following commands.

REG QUERY HKU
REG QUERY HKU\S-1-5-18
REG QUERY HKU\S-1-5-19
REG QUERY HKU\S-1-5-20

Post the results.

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Faalks1 · 11 Apr 2014

Hello Noel, thanks for your reply
I did exactly as you said and here are the results:

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-3980854241-2801257987-2136857027-1000
HKEY_USERS\S-1-5-21-3980854241-2801257987-2136857027-1000_Classes
HKEY_USERS\S-1-5-18

C:\Windows\system32>REG QUERY HKU\S-1-5-18

HKEY_USERS\S-1-5-18\Control Panel
HKEY_USERS\S-1-5-18\Environment
HKEY_USERS\S-1-5-18\EUDC
HKEY_USERS\S-1-5-18\Keyboard Layout
HKEY_USERS\S-1-5-18\Printers
HKEY_USERS\S-1-5-18\Software
HKEY_USERS\S-1-5-18\SYSTEM

C:\Windows\system32>REG QUERY HKU\S-1-5-19

HKEY_USERS\S-1-5-19\AppEvents
HKEY_USERS\S-1-5-19\Console
HKEY_USERS\S-1-5-19\Control Panel
HKEY_USERS\S-1-5-19\Environment
HKEY_USERS\S-1-5-19\EUDC
HKEY_USERS\S-1-5-19\Keyboard Layout
HKEY_USERS\S-1-5-19\Network
HKEY_USERS\S-1-5-19\Printers
HKEY_USERS\S-1-5-19\Software
HKEY_USERS\S-1-5-19\System

C:\Windows\system32>REG QUERY HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\Windows\system32>

NoelDP · 12 Apr 2014

Looks like all the system profiles are likely to be OK

Let's see what a quick scan may reveal..

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

Faalks1 · 12 Apr 2014

Here it is, Noel

Code:

Farbar Service Scanner Version: 25-02-2014
Ran by L C L (administrator) on 12-04-2014 at 12:28:11
Running from "C:\Users\L C L\Desktop"
Microsoft Windows 7 Home Premium   (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
IE proxy is enabled.



Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2013-03-31 17:18] - [2013-01-04 02:41] - 1893224 ____A (Microsoft Corporation) 5CFB7AB8F9524D1A1E14369DE63B83CC

C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

NoelDP · 12 Apr 2014

That all looks normal - Let's have a look at the history...

Please open Event Viewer
In the left pane, navigate to the Windows Logs
right-click on Applications and select 'Save all events as...' save as Apps.evtx
repeat for the System logs - save as Sys.evtx
Compress both files, and attach to your reply

Faalks1 · 12 Apr 2014

Hello again Noel. Here they are.
I was wondering if those files CBS folder suggested on 'Windows Update Posting Instructions' are of any help. Since it is 20mb large I think I will need 3 posts to upload them.

NoelDP · 13 Apr 2014

They could help - just remove the oldest CBSPersist files from the upload until it gets below 8MB (they are the archive, and not often too much use, but occasionally handy!)

Faalks1 · 13 Apr 2014

OK, CBS folder attached.
I am thankful, Noel, for all your help so far, but I was wondering if a windows repair/reinstall could hasten things up? My PC is already 3~4 years old, and I believe that maybe many errors have been accumulated over the years. I don't want to sound that my PC is old and faulty though, it works just fine. I've already downloaded the .iso file ... I just wanted to have some time to spare to backup everything. I am also concerned about screwing genuine windows doing so or something like this ...

So I wanted your suggestion, maybe we continue our investigation? And leave reparir/reinstall as a 'last resort'?