Windows Update - total failure. TrustedInstaller.exe ==> 25% CPU.

[shiphen]

Hi

I had a virus/trojan, but now it seems I am in the clear security wise.
http://www.sevenforums.com/system-s...i-am-still-infected-win32-small-ca-virus.html

Jacee was helping me with security issues but I think I have exhausted her skills.

But now I cant get Window Update to work at all. I have tried this Mr Fixit, which admits that there is a problem but fails to solve it.
How do I reset Windows Update components?

One clue is that TrustedInstaller.exe is running all the time, hogging about 25% of my CPU.

I searched for Reliability on my Start button and it took me to a place called:
"Control Panel\All Control Panel Items\Action Center\Problem Reports"
I then tried to delete everything but I can see that I am getting a vast number of "WindowsWcpOtherFailure3" problems - they are coming in every couple of seconds in fact.
Here is one of these problems in more detail:
Problem signature
Problem Event Name: WindowsWcpOtherFailure3
OsVersion: 6.1.7601
File: base\lstring\lblob.cpp
Function: RtlTranscodeLBlobs
Line: 2221
Status: c0000161
StackHash: 0xe2a94a52
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 2057
Extra information about the problem
Bucket ID: 1947205397

Out of desperation I have uninstalled everything I dont really, really need including Skype.

If I try to run Windows Update, after a very long time (2 minutes?) I eventually get an error message.

Also if I click on Installed Updates, it claims that there arent any on my PC. This is clearly nonsense - I have had my PC (running Windows 7 x64 for about 1 year now and there have been innumerable updates).

Can anyone help??

Many thanks

J

 

[NoelDP]

This is actually pretty normal under certain circumstances - TrustedInstaller has access to the system that no other parts do, and will run at a high priority.
It's in use when checking for updates, installing updates, and cleaning up - as well as when doing system maintenance.
What is unusual is that it's limited to a single processor, rather than utilizing more.

I can't find any mention of your having run any SFC scan, or CheckSUR scan lately?? - or even a chkdsk?


Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply



Please download the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)
Run it from the saved download.
Then zip the CheckSUR.log and attach it to your reply

The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.

 

[shiphen]

I ran the CHKDSK okay (I think - I am now away for a few days so am having to do it remotely...)

SFC WONT RUN
But I even though I ran it as Administrator, and even thought the initial message is
"Beginning systems scan. This process can take some time."
I cant run SFC because if give the error message:
"Windows Resource Protection could not preform the requested operation"

DAMN Windows. OKay I managed to get a command prompt to start called
"Adminsitrator: Command Prompt" and to show the default director to be
"C:\windows\system32" (which I am assuming to be what people call "an elevanted command prompt" ...But I a still getting the same error messages as above.

Any suggestions?

J


P.S. I have taken SO long trying to fix this problem that I am now having to work remotely. So please do NOT ask me to do anything that requires dirt-work access (such as insert a CD or press F8 to get access to Safe Mode!)

 

[NoelDP]

Bother - I was about to suggest an offline SFC, which can't be done remotely.

Never mind....
one thing that may give us some more data is an MGADiag report....

Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html


Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspx

Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

 

[shiphen]

CheckSUR.log is only 2KB so here is is:



=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-18 18:18
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739 Bad identity
(f) CSI Manifest Missing 0x00000002 msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f Bad identity
(f) CSI Manifest Missing 0x00000002 wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f
Summary:
Seconds executed: 189
Found 4 errors
CSI Manifest Missing Total count: 2
CSI Corrupt Identity Total count: 2
Unavailable repair files:
winsxs\manifests\msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest
winsxs\manifests\wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest


P.S. Meanwhile Trustedinstalle.exe has gone quiet.

 

[NoelDP]

Looks to me like you have some bit-flipping going on there - Tom is the expert on that, so I'll give him a shout.

 

[tom982]

Hi Shiphen, me again!

It's very odd that you're having registry corruptions again. No one should get file corruptions, especially at this kind of level. How long have you had your computer? I would've hinted that your HDD was failing, but seeing as CHKDSK reported no errors, I guess that isn't the case. If you're interested Noel, here's the thread:

http://www.sevenforums.com/windows-...error-codes-8007371b-800736b3-80070246-a.html

Could you upload your components hive again please? Like we did last time.

C:\Windows\system32\config\COMPONENTS

I don't know whether those files are actually corrupt or not at this stage, so I'll take a look at your hive and get back to you

Tom

 

[shiphen]

> Could you upload your components hive again please? Like we did last time.
>
> C:\Windows\system32\config\COMPONENTS

Sorry please can you remind me how to do this?

J

 

[tom982]

No need to apologise Find the file, copy it to your Desktop, right click > send to > compressed zipped folder. Then attach this to your next post by clicking on the paperclip icon in the reply box.

Tom

 

[shiphen]

components - double zipped

 

[tom982]

Hi shiphen,

It's strange, the corruption pattern is identical to what we faced a few weeks ago. It isn't the same keys, but it's the same process.

If you have installed/removed any updates since uploading that file, do NOT follow these instructions. Instead, upload another copy of your COMPONENTS hive please

Warning: This fix is specific to this user (shiphen), no one else should follow these instructions as it will cause a lot more problems than it will solve! I will remove this file after the fix has been completed.

Download this file please: https://dl.dropbox.com/u/16537616/components

Navigate to the following folder:

C:\Windows\system32\config

Delete the file: COMPONENTS. Then paste the file that you downloaded from the link above

Reboot, then run the SURT and upload the CheckSUR.persist.log please.

Tom

 

[shiphen]

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-18 18:18
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739 Bad identity
(f) CSI Manifest Missing 0x00000002 msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f Bad identity
(f) CSI Manifest Missing 0x00000002 wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f
Summary:
Seconds executed: 189
Found 4 errors
CSI Manifest Missing Total count: 2
CSI Corrupt Identity Total count: 2
Unavailable repair files:
winsxs\manifests\msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest
winsxs\manifests\wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-19 20:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 189
No errors detected


OK what next?

Wfiw, I am using a SSD.
Do you think it smell of malware or of SSD/hardware failure?

Many thanks

J

 

[Layback Bear]

I'm not barging in but I though this might help understand things.
http://www.sevenforums.com/system-s...i-am-still-infected-win32-small-ca-virus.html

Seams like two repair threads on same computer at the same time.
The right hand might not know what the left hand is doing.

 

[tom982]

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-18 18:18
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739 Bad identity
(f) CSI Manifest Missing 0x00000002 msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f Bad identity
(f) CSI Manifest Missing 0x00000002 wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f
Summary:
Seconds executed: 189
Found 4 errors
CSI Manifest Missing Total count: 2
CSI Corrupt Identity Total count: 2
Unavailable repair files:
winsxs\manifests\msil_microsoft.web.ftpserver.resourceó_31bf3856ad364e³5_6.1.7600.1638µ_en-us_¶1c361facf36a739.manifest
winsxs\manifests\wow64ßmicrosoæt-windows-ftpsvã.resources_31bf3856ad36´e35_6.1.7600.16385_en-us_6cd75eb3d2573c5f.manifest

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.21645
Package Version 16.0
2012-11-19 20:42
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 189
No errors detected


OK what next?

Wfiw, I am using a SSD.
Do you think it smell of malware or of SSD/hardware failure?

Many thanks

J

Hi J,

If you don't mind, I would prefer it if you stick to this thread and this thread alone for Windows Update issues. I'm confident that between Noel and myself, we have the expertise to be able to solve this

How is Windows Update running now? That COMPONENTS replacement fixed everything.

I'm not barging in but I though this might help understand things.
http://www.sevenforums.com/system-s...i-am-still-infected-win32-small-ca-virus.html

Seams like two repair threads on same computer at the same time.
The right hand might not know what the left hand is doing.

Thanks for pointing this out!

Tom

 

[Layback Bear]

You welcome Tom. I will go back to watching and learning.