New
#11
Beats me. Didn't work for me either. Must have been a bad paste. Try this:
http://1drv.ms/1rEB9lN
Beats me. Didn't work for me either. Must have been a bad paste. Try this:
http://1drv.ms/1rEB9lN
YOur CheckSUR shows these problems -The CBS log shows the following problem...Code:Unavailable repair files: winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2.manifest winsxs\manifests\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822.manifest winsxs\manifests\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4.manifest winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_88dcc0bf2fb1b808.manifest winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_49e66f4952a1b53b.manifest winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_09bd717ffacfdd51.manifest
I've only seen this error type once before - and it turned out to be the result of a ZeroAccess infection, as I was later told.Code:2014-06-02 15:24:30, Error CSI 00000227 (F) STATUS_FILE_IS_A_DIRECTORY #4938246# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowFileNotFound|AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_READ_DATA), oa = @0xc6d1c0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[131]"\SystemRoot\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xc6d270, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab = NULL, eal = 0, disp = Invalid) [gle=0xd00000ba] 2014-06-02 15:24:30, Error CSI 00000228@2014/6/2:20:24:30.310 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error STATUS_FILE_IS_A_DIRECTORY originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null) [gle=0x80004005] 2014-06-02 15:24:30, Error CSI 00000229 (F) STATUS_FILE_IS_A_DIRECTORY #4938245# from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingFile(...)[gle=0xd00000ba] 2014-06-02 15:24:30, Error CSI 0000022a (F) STATUS_FILE_IS_A_DIRECTORY #4938244# from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingFile(flags = (MissingFileIsOk|SharingViolationIsOk|AccessDeniedIsOk), da = (SYNCHRONIZE|FILE_READ_DATA), oa = @0xc6d868->SIL_OBJECT_ATTRIBUTES {s:40; on:"MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE), file = NULL, disp = Invalid) [gle=0xd00000ba]
I think that you'd best scan for malware first.
Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.
Delete everything it finds
It could be remnants from a prior infection. Before I started this exercise, I ran everything in the book on this computer. Malwarebytes, TDSSKiller, Norton Power Eraser, Panda Security and about 3 other generic engines. Shows clean.
I even have Malwarebytes installed now (licensed copy!). I'll make sure it is updated and I'll run a full scan again to make sure, but I'm reasonably confident this is prior-infection damage.
OK - Looking through the logs again, I noticed something I didn't see before...
I think I'd better take a close look at your COMPONENTS registry hive.Code:2014-03-25 05:03:28, Info CSI 00000004 No store version format found; DLL store format 0.0.0.6 2014-03-25 05:03:28, Error CSI 00000005@2014/3/25:10:03:28.468 (F) d:\win7sp1_gdr\base\wcp\componentstore\storelayout.cpp(6636): Error STATUS_SXS_COMPONENT_STORE_CORRUPT originated in function ComponentStore::CRawStoreLayout::OpenCanonicalDataKey expression: (null) [gle=0x80004005] 2014-03-25 05:03:28, Info CBS NonStart: Failed to get store. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT] 2014-03-25 05:03:28, Info CBS Failed to ensure no startup processing was required. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT] 2014-03-25 05:03:28, Info CBS Failed during startup processing, continuing with Trusted Installer execution [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.
If the file won't copy (saying file in use), reboot to Safe Mode, and try there - it may be too damaged to complete loading.
Remember that the COMPONENTS file was fubar, and I restored it from a prior image (albeit an old one).
So, what you're looking at in that log file is stale and no longer applies. If you will want it knowing that, I'm happy to make it available.
After that restore, a LOT of things that were broken started working, but it isn't 100% yet.
The key things were:
SFC gets to about 54% now instead of "Bzzt, I can't run."
SURT doesn't bail out on store corruption complaints
The Add/Remove Windows Programs (what started me on this odyssey) is no longer a blank screen.
Ooops! - good point.
Please run a new SFC and CheckSUR and we'll take a look at the entire CBS folder afterwards - it'll give us some detailed info.
FWIW, SFC stopped at the 54% mark...
Updated ZIP at... http://1drv.ms/1rEB9lN
If you have the Windows disk you can try running SGC from there.
Boot from the DVD.
Click on Repair
Under advance options click on Command Prompt.
Type in:
sfc /scannow /offbootdir=<drive>:\ /offwindir=<drive>:\windows
Drive letter should be either C: or D:. You can do a DIR C: or DIR D: to finout which has the windows folder
May also want to run a chkdsk from here.
Chkdsk is 100% clean. I did a complete boot-time check on that yesterday. (Also it is SSD, so I'm waiting to see what failures are going to look like in solid state in the future)
I will build a DVD from the Volume License media and try that. I'm thinking I'm going to have to fix that symbolically linked file that's referenced as a folder before making substantial progress. Seen in Noel's post above.