August Windows Update corrupts dlls/netframe?

[droolingelmo]

Join Date: Aug 2011

Windows 7 Home Not So Premium 64 bit SP1
4 posts​

​

I hope someone is still watching this
Home Premiunm 64 bit SP1 on Dell XPS 8300 (with problem) and Dell Inspiron (updates installed fine)

I have the same problem from the August updates but the suggested updates, KB2533523, KB2468871, KB2539636 all end with a Fatal Error.

The log is attached. (all three are the same in the error section) I have been working with MS and all of their suggestions on fixing Windows Update have failed also.

The three here ended with Error=2502 and Error=2503

I am signed in as the hidden admin to have all rights.

If anyone has any ideas it would be greatly appreciated.

As a former QA analyst I have and two (I think) very important clues for someone who knows Net Framework and Windows 7 update process better than I.

1. Is Net Framework there or is that what failed in the August restart?
My trail----
msconfig (doing a clean boot)
hide all Microsoft Services

Microsoft .NET Framework NGEN V4.0.30319 x86 AND x64 do not get hidden and the 'Manufacturer' is listed as UNKNOWN

Go to services
the V4.0.30319 x64 and x86 are there, delayed start, both stopped, both logon as local system account
the V2.0.50727 x64 and x 86 are both disabled.

Since the manufacturer is unknown it would seem to me partial failure during update lost some subset of needed data.

so

2. I run sfc /scannow to find corrupted dlls that sfc cannot fix.

msdaosp.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

odbccp32.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

jsproxy.dll V8.0.7601.17601
member file cannot be reapaired, source file in store also corrupted

odbctrac.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

odbcjt32.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted


SO.......
Can I resolve 2503 and 2502 errors from these Net Framework self installs?
Go get the dll's from my other dell, drop them in and then let sfc.exe fix it?

Please help me out if you have any ideas.

Tried every update fix approach in the KB already.

Join Date: Aug 2011

Windows 7 Home Not So Premium 64 bit SP1
4 posts​

​

I hope someone is still watching this
Home Premiunm 64 bit SP1 on Dell XPS 8300 (with problem) and Dell Inspiron (updates installed fine)

I have the same problem from the August updates but the suggested updates, KB2533523, KB2468871, KB2539636 all end with a Fatal Error.

The log is attached. (all three are the same in the error section) I have been working with MS and all of their suggestions on fixing Windows Update have failed also.

The three here ended with Error=2502 and Error=2503

I am signed in as the hidden admin to have all rights.

If anyone has any ideas it would be greatly appreciated.

As a former QA analyst I have and two (I think) very important clues for someone who knows Net Framework and Windows 7 update process better than I.

1. Is Net Framework there or is that what failed in the August restart?
My trail----
msconfig (doing a clean boot)
hide all Microsoft Services

Microsoft .NET Framework NGEN V4.0.30319 x86 AND x64 do not get hidden and the 'Manufacturer' is listed as UNKNOWN

Go to services
the V4.0.30319 x64 and x86 are there, delayed start, both stopped, both logon as local system account
the V2.0.50727 x64 and x 86 are both disabled.

Since the manufacturer is unknown it would seem to me partial failure during update lost some subset of needed data.

so

2. I run sfc /scannow to find corrupted dlls that sfc cannot fix.

msdaosp.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

odbccp32.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

jsproxy.dll V8.0.7601.17601
member file cannot be reapaired, source file in store also corrupted

odbctrac.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted

odbcjt32.dll V6.1.7601.17514
member file cannot be reapaired, source file in store also corrupted


SO.......
Can I resolve 2503 and 2502 errors from these Net Framework self installs?
Go get the dll's from my other dell, drop them in and then let sfc.exe fix it?

Please help me out if you have any ideas.

Tried every update fix approach in the KB already.



Like lots of others I have problems since the August 9th Updates. Below is last correspondence with MS tech suuport, now on 8th day.

If anyone here is good at CBS and CheckSUR logs maybe you can skip to the end. Windows update log too large to upload but I can reduce and uplad if needed.

BACKGROUND

This may be long but as an old IT guy from programming early years on IBM System 36 to later on AS/400, QA Manager, Ops later on, I don't want to leave something out.

Two Dell PC's run my business. The XPS 8300 is the one with issues after update. The Inspiron is just a backup but for license issues doesn't contain my three critical business softwares, so a clean install is my last resort. But data is three places one backed up close to real time, 2nd hard drive and Carbonite is #3.

Ran Windows Update on Inspiron, all OK.
Ran Windows Update on XPS, hung at reboot, did not touch for over an hour just in case, but no sound, no lights, screen on Windows logo. Call my MS business support person.

Start Up Repair could not repair
All System Restore Points failed and rooled back.

After several hours called it a night and in the morning booted up fine, but

• all users gone except my admin CRIOffice
• click on main business software and Installer for Roxio CD burner starts and so does the business software. Cancel Roxio, comes back, cancel again, goes away, but business software loads and works perfectly.
• Troubleshooters don't work
• Control Panel cannot see,create or modify and users
• Some programs like WMovie Maker do not start.
• Event Viewer loads and reports seemingly accurate data, but click on anything an error occurs and shuts down Event Viewer.
• Tried startup repair from disk, could not fix
• Tried System Restore again, thought I had lost her but the miracle, 'rollback failed' message but it's a lie, happened again.
• Tried every MS technique to fix updates, they failed the first time and ever since with Err 8000FFFF and sometimes Code 643 but only 20% of the time and with no pattern.
• Only technique that did not 'fail' was sfc /scannow but it found 5 corrupt dll's it could not fix.
• Tried a repair install, got to the end (twice) had to roll back, failed at 100%. (But this was before I found permissions for SYSTEM and Admin were gone on Windows Installer Folder and subs, have not tried since)

And so we go into the last correspondence with MS Support in Update Dept, but I think I need to be somewhere else, perhaps .Net Framework (you'll see below)



Subject: xxxxxxxxx Microsoft Online Support
Windows Certificate of Authenticity direct from Dell on new PC built 5/2011 purchased 6/2011
Windows7 Home Premium 64 bit with SP1


Hi R,

I still cannot update and there are new updates showing up that also fail, but I think there are several pieces of info that will help you solve this along with the attached logs which seem to indicate what is happening. Important points I have bolded.

I hope this will help you and the MS team help resolve this for me and many thanks in advance for your help.

I had tried all of your steps last week from researching the support site. I did everything over again following the order you sent exactly. Since everything failed from my admin account last week I revealed and then ran your list from the Hidden Admin account

Where different I noted what succeeded or failed on the admin versus the hidden admin accounts.

Step 1. Selective Start Up / Disable Internet Security / Clean Boot

Selected “Hide All Microsoft Services”
BUT MS .Net Framework NGEN V4.0.30319 x86 AND x64 were still visible.
Manufacturer Column “Unknown” instead of Microsoft

Checked my other PC and it shows Microsoft as the Manufacturer of .Net Framework V4xxx

(The PC with the Windows Update problem is a Dell XPS 8300, I have a Dell Inspiron 546 also manufactured in May of 2011 that is running the same W7 Home Premium 64bit SP1 to look at for reference, but all Windows Updates have been applied successfully)

I tried running all of your steps first with both the x64 and x86 V4 net framework services running even though they were not listed as Microsoft and then again with them disabled, since they showed when Hide All MS Services was selected. The results did not change.

Step 1 - Success with anomaly noted

Step 2 – Run System Update Readiness Tool
Step 2 – System Readiness Tool Completed Successfully / Attempt to Install Updates Failed with Error 8000FFFF and Code 643

Step 3A – Run Windows Update Troubleshooter
Step 3A – Failed – Troubleshooter Couldn’t Identify Problem (View Details is BLANK)
It suggested running the other troubleshooters to attempt to resolve the problem. All other Troubleshooters returned “A problem is preventing the troubleshooter from starting” with Error Code 0x80070005

Step 3B – Run Default Troubleshooter to fix Windows Updates Components
Step 3B – Failed – Details show Error 2503 and 2502

Step 3C – Run Aggressive Troubleshooter to fix Windows Updates Components
Step 3C – Failed – Details show Error 2503 and 2502

Step 4 Use SFC /SCANNOW from Elevated Command Prompt
SFC Details with my original support request were the same but if you need a copy I can send it.

Step 4 – Failed - SFC was unable to fix the following dll’s.
· Jsproxy.dll
· Odcbcp32.dll
· Odbctrac.dll
· Odbcjt32.dll
· Msdaosp.dll

SFC details.txt states dlls could not be Repaired or Reprojected and that the source file in store is also corrupted.

After your document instructions:

I researched Errors 2502 and 2503 and discovered my Windows Installer File had changed so that SYSTEM and the Hidden Administrator (S-1-5-32-544) only had Read and Execute permission to the folder and subfolders,

I changed the permissions and checked the registry permissions also (they were fine).
Then I did the following.

Step 1 – Ran Default Troubleshooter to fix Windows Updates Components
Step 1 – Completed Successfully

Step 2 – Ran Default Troubleshooter to fix Windows Updates Components
Step 2 – Completed Successfully

Step 3 – Did not use Windows Update but individually download directly from support the .Net Framework V4xxx updates, since I thought the problem with the “Unknown” manufacturer in msconfig was a clue something was wrong with V4.

I had tried a direct download from Microsoft before contacting support and all ended with Error 2502 and 2503

I ran these directly from Microsoft DL Center

NDP40-KB2468871-v2-x64
NDP40-KB2539636-x64
NDP40-KB2533523-x64

All completed the download, unpack and began the install. All three returned a fatal error with a Code 643. (Error = 0x80070643)

I have attached the three logs.

I then ran SFC again and it returned the same report again with the same exact problems.

I also am attaching the CBS, the CheckSUR and CheckSUR.persist logs.

ANYTHING would be a help. All of my data is backed up three different ways but since I lost a motherboard just 2 months ago and had to spend two full weeks here reinstalling the business software packages I am hoping to be able to save this without having to do software reinstalls.

Thank you again, Elmo

 

[JMH]

droolingelmo...

Below is last correspondence with MS tech support, now on 8th day.

ANYTHING would be a help. All of my data is backed up three different ways but since I lost a motherboard just 2 months ago and had to spend two full weeks here reinstalling the business software packages I am hoping to be able to save this without having to do software reinstalls.

Thank you again, Elmo

Dear Elmo,

Your patience & persistence truly amaze me.

It appears that you have been through all the steps we would recommend.
Plus you have sought Tech Support help via MS.

I suggest the time is well & truly here to do the unmentionable.....after all your data IS backed up three different ways you say above.

Links for you to peruse -

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

http://www.sevenforums.com/tutorials/3413-repair-install.html

Jan

 

[zigzag3143]

Wonderful posts and I wish there were a magic way to help but if you cant repair this in start up, JMH's suggestion to clean install is probably your last and best option.

It is a PITA but it may get you going faster than trying to diagnose the current problem.

 

[droolingelmo]

I would love to do a Repair Install, but before I try again I am hoping to find out why the last attempt could not finish after reaching 100%. And the fact is, my business software is functioning right now, so I would rather move slowly than do a clean install. (Also the fear a clean install would not finish and I would be double fd)

So questions I have, and if they should be posted elsewhere please let me know where it would best best.

1. I think the repair install failed due to the permissions problem (SYSTEM and Hidden Admin not having permissions to Windows Installer folder) So I want to find out Should / Can I set permissions for SYSTEM and Hidden Admin to have full control of Windows before the next attempt at repair install?
2. A second possibility. I have read a little about how MS keeps a control number of some sort in the system to control for legal copies. This is a new PC with a 100% legit WIndows 7 copy, but the repair install picked up "RECOVERED" copy of my prior, also legal copy, of Vista 64bit. That was on my last PC (motherboard fried) on the E drive I am using as an internal data back up. I never wiped the OS thinking my son might rebuild the old HP. I had disconnected it but Repair still sees this RECOVERED copy. How can I get rid of W7 seeing this ghost of the old Vista, that was never on this PC as an OS?

Again, to all, THANKS

 

[niemiro]

Hello, and welcome to the Seven Forums!

An excellent level of detail in your posts! That is always really nice to see!

I need to have a look at your CBS.log if I may?

Please create a new folder on your Desktop called LOGS.

Copy into that new folder the C:\Windows\Logs\CBS folder, and the C:\Windows\WindowsUpdate.log file.

Right click on your new LOGS folder > Send to > Compressed (Zipped) folder, and upload it here for me.

Thanks a lot!

Richard

 

[droolingelmo]

Thank You Richard

CBS and WU Logs are in the zip file.

• Original Unable to Start on reboot to install Updates occurred on 8/9
• Today at 15:55:00 I submitted WU again, it failed the same way as usual, this time with both 8000FFFF and 643, but I thought you should have a clean atempt in case anything MS Support has had me do had an effect.
• MS Support on two occasions had me rename the SoftwareDistribution Folder. If you need to see earlier they are saved and I can send. From purchase 6/4 until WU reboot 8/9 all installed without fail first time.
• Right click - send to ended with Access is Denied, used 7z to zip file.

I hope you can help but even if you cannot whatever you could teach me about what you see would be greatly appreciated! Thanks.

 

[niemiro]

Hello again!

Can you please create a new LOGS folder on your Desktop, and add logs to it as we go along, please?

Firstly, can you please add "C:\Windows\inf\defltbase.inf". More on this later.

Can you please then open a Command Prompt, and type in:

icacls C:

and press enter. Then please right click > Mark, highlight the results, right click again, and then paste into a new txt file in your LOGS folder. (Alternatively, icacls C: > %UserProfile%\Desktop\LOGS\icacls.txt)

The next thing I want to do is to look more into those SFC corrupt file, and ideally repair them. Now, in addition to the CBS.log, I think that I will just get a second opinion that those files actually are corrupt. I have never yet actually seen it happen, but it is possible that SFC makes a mistake.

OTL - Download or alternative link here and here

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

/md5start
Jsproxy.dll
Odcbcp32.dll
Odbctrac.dll
Odbcjt32.dll
Msdaosp.dll
/md5stop

• Click the None button, followed by the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open one notepad window. OTL.Txt These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post them here.

Now, I want to look more at this Access is Denied (code 5) theme through...well...everything!

What anti-malware tools do you have installed? Can you please list them all for me? Usually, code 5 is caused by anti-malware tools preventing Windows Update from overwriting files. I have seen this many times before, in particular Spybot S+D Tea Timer, and I have seen big situations like this caused by Norton Corporate Edition. Thanks

Lastly, can you please copy the C:\Windows\Logs\CBS folder into your Desktop\LOGS folder, zip it up, and upload, again. (I am really sorry for asking for this again - basically, when a CBS.log becomes too long, it is persisted in Vista and 2K8, and persisted into .cab files in 7 and 2K8R2. Unfortunately, you have so much logging data that the first log alone is not much help, and didn't even include the SFC scans. However, it did have some information in it )

Just incase you are interested, to find errors in a CBS.log, scroll to the bottom > Ctrl-F > Search UP for the following phrase: "Error ". Notice the additional space after the word 'error'. In WindowsUpdate.log, the same, except using this phrase: "FATAL". But don't worry about that.

Also, then scroll down the log in approximately 5 seconds, looking closely at the shapes caused by where the lines end. Using this technique, I can spot the SFC section very easily, and other interesting details. I tried to explain that to my apprentice - in text over the internet - and it turned out to be both difficult to explain and understand!

Thanks a lot!

Richard

 

[droolingelmo]

I have not started with your to-do list, I am still at work until 10 pm eastern US daylight savings time

MS Support has had me do the following (below) and I will start on your list as soon as I am off work. But the partial success and failures may give you some added insight.

As always, thank you Richard for kindly giving your time. I will post as soom as I am home and completed the tasks.

From MS Support I received the following-

Hi Jim, This is Rakesh,

I have gone through the log files. This issue can be fixed.

I request you to go through below steps:
Click on the link to open

http://go.microsoft.com/?linkid=9665683
Click on Run > Run > Select I Agree > Click Next >Select Run Aggressive Options (Not Recommended) > Click Next.
You must choose that Run Aggressive Options for this issue.
After the fix it complete it's process Restart the computer.(Do not skip Restart)
Next we will have to Run few Dll commands.
>Click on Start Menu and selecting Run. Type "cmd" and hit Enter.
In the new window that came up, type each of the following commands, hitting enter after each one:
REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUWEB.DLL
REGSVR32 WUAUENG.DLL

My response:
Hi Rakesh,

Did clean start with only MS services.
Disabled Kaspersky Security

Ran the agressive option of the FixIt at linkid=9665683
Completed Sucessfully.

Rebooted

Went to elevated command prompt
REGSVR32 WUAPI.DLL Success
REGSVR32 WUAUENG1.DLL Failed to Load
REGSVR32 ATL.DLL Success
REGSVR32 WUPS2.DLL Success
REGSVR32 WUCLTUI.DLL Failed to Load
REGSVR32 WUPS.DLL Success
REGSVR32 WUWEB.DLL Failed to Load
REGSVR32 WUAUENG.DLL Success

Looks like we are getting close but something still wrong. I feel it must still be with the permissions getting messed up/corrupted during the update.

Also FYI: I did a search for WUAUENG1.DLL and no results were returned

 

[droolingelmo]

One quick thing I can answer:

I am running Kasperky Internet Security 2011, Windows Defender and Windows Firewall are off. At the recomenndation of MS Answers I downloaded and ran Malwarebytes Anti-Malware for a one time complete scan and nothing was found. It is on PC but not running active defense.

There was something delivered with the new PC two months ago, I think Norton, but never activated. I can search for remnants if needed.

 

[niemiro]

Hello again!

Don't worry, there is never any rush. Don't ever feel that you have to reply within 24hours, or anything like that. You can come back weeks later if convenient. I shall still be here Enjoy work

Not all .dlls are meant to register successfully. There is a lot of debate as to whether registering .dlls which aren't meant to be registered does any good. I personally don't think that it does, but people really don't know, hence why all .dlls are listed in such KB articles! Madness!

Anyway, WUAUENG1.DLL, WUCLTUI.DLL, WUWEB.DLL are not meant to register according to my list But the rest are! That step looks good!

"Disabled Kaspersky Security" Noted.

"Ran the agressive option of the FixIt at linkid=9665683" Noted.

I don't think that I can say anything else at the moment, but just sit tight for the log files.

BTW, I have relatives coming over tomorrow, so please forgive any delay in response. I can't say whether I will be online or not.

Thanks a lot for your patience,

Richard

 

[droolingelmo]

Run icacls C:

From Administrator Prompt returns:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Administrator>icacls C:
C: NT AUTHORITY\SYSTEMOI)(CI)(F)
The system cannot find the file specified.
(OI)(CI)(F)
CrossroadsInn\AdministratorOI)(CI)(F)
Successfully processed 1 files; Failed processing 0 files
C:\Users\Administrator>

Run from elevated prompt returns:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>icacls C:
C: NT AUTHORITY\SYSTEMF)
The system cannot find the file specified.
(F)
Successfully processed 1 files; Failed processing 0 files
C:\windows\system32>

 

[niemiro]

Hello again!

Well, that doesn't look too good! I shall return C: and C:\ (for this, they are different!) to default security, and then we can go from there.

Can you please type in all of the following commands into a new Command Prompt, and then mark and copy the entire thing here or into a new file.

Just to confirm, you are using C:\ as your system drive?

wmic path win32_useraccount where name="%username%" get sid
icacls C:
icacls C:\
icacls C:\Windows
icacls C:\Windows\

Can you also please get me a copy of "C:\Windows\inf\defltbase.inf"

Then we shall do some permissions resetting!

Thanks a lot!

Richard

 

[droolingelmo]

Attached:

Logs sevenforums contains:

1. CBS Log
2. OTL Log
3. OTL Log after custom run
4. Extras Log produced by OTL
5. defltbase
6. Results of wmic run from Hidden Admin command prompt
7. Reselt of wmic run from hidden Admin elevated command prompt

WindowsUpdate.txt is from MS Support and has not, and WILLNOT be run without your instruction.

The instructions are to rename as a vbs file, run, rebooot, try to install updates. I haven't done anything with VB since the 90's so I haven't looked at it.

I am now well into MS second level support and I thought this might give you an insight into their thought pattern. They have indicated this is the last step before removing and reinstalling the Net Framework. But as I said I will not process unless directed by you.

I would havenever gotten anywhere in my IT career if it was handed to me and even 2nd level MS support does not seem to like to explain what their plan, process or the expected outcome, other than 'you will now be able to process your updates'. If I am ever to be as helpful as you, and others on this forum, the only way is to experience the pain of learning. So as always, thank you.

On the C:\ system drive question....
Sorry, I should have given all background upfront but I did not realize going in this would be such a forensic adventure.

• C is system drive. (Hitachi HDS721010CLA332)
• D is CD/DVD drive and is first in boot sequence just in case
• F is RECOVERY
• G is SYSTEM IMAGE
• F and G are on same Hitachi Disk
• E, L, M when attached are external HD or flash drives being used for backups
• This is a 2 month old Dell XPS 8300 that is relatively unchanged from delivery (with the exception of whatever changes occurred in this update and anything subsequent run to address the WU issues)
• There has never been a problem with ANY Windows Update
• There has never been a problem with the execution or behaviour of any Windows element or application (including original software and post delivery installed software)
• On two occasions the Dell has been unable to start up. Once about a week after purchase, start up repair found nothing and for the next 6 weeks all was well. The second occurance of 'unable to start' was after the August 9 Windows Update
• This PC is not used for anything much other than to run my home business managment software, REZODesktop. So there are no 'oddball' programs installed. These are the only ones that I believe could have an effect.
  • Kaspersky Internet Security 2011
  • Malwarebytes (post WU failure)
  • MS Office 2007
  • REZODesktop (seems to run fine in W7 but is run in compatibility mode XP SP3 per software vendor)
  • MS SOAP Toolkit Version Three (for REZO)
• The PC is on a network with two other PC's and there is a Netgear Wireless N Router with a DSL connection
• Kaspersky and Malwarebytes have never reported an issue.

Please enjoy the day with friends and family. I am going to mow my well overgrown lawn and try to think about non-electronic things.

 

[niemiro]

Hello again!

Thanks for all of the additional information! It really is so helpful for me! Any updates on the state of the upload

Also, (really sorry to push this issue) is "CBS Log" a single log file or a folder?

Thanks so much!

Richard

 

[droolingelmo]

Sorry I had attached them, saw it with my own eye.

 

[droolingelmo]

Hello again!

is "CBS Log" a single log file or a folder?

I just included the CBS log.
If you need them I also have the CheckSUR and CheckSur.persist logs.

Or are you in need of the entire folder? (ie with CBSpersist cabinet folders?)

 

[niemiro]

Sorry I had attached them, saw it with my own eye.

Sorry about that. I honestly have no idea what happened. I can see them now though, and that is the most important bit!

When I saw that WindowsUpdate.txt -> .vbs, I nearly jumped out of my skin! I was shocked stiff! It is not that it doesn't work, and it won't harm your computer, but it isn't actually owned by Microsoft, nor is it very good! I can tell you one thing! If they are sending you that, they are running out of ideas, badly!

Here is the actual source of that script: Windows Update Troubleshooter v1.3 | HackSys Team

As you can see, not Microsoft!

I have looked into that script before, to decide whether I would use it on this forum or not. In the end, I decided that although not dangerous, I wouldn't be using it.

Here is what it does:

• Creates a folder on your Desktop called "Logs"
• Stops all of the Windows Update Services, and renames SoftwareDistribution and CatRoot2, and then restarts these services. This is what this fix-it does in Aggressive Mode: How do I reset Windows Update components?, but not as thoroughly!
• Runs SFC (you already have done so)
• Then goes and runs that Microsoft Fix-It linked above - yes, the same one, but not in aggressive mode. Why try to re-write Aggressive Mode, but use Microsoft's product for the rest!?
• It then adds Microsoft update sites to the Trust List (first good part of the script)
• It then runs the System Update Readiness Tool
• It then copies CheckSUR.log and CBS.log to the Logs folder, but I have use of more logs than that.
• It then launches msconfig - but what you are supposed to do in it is anybody's guess!

Often, I won't use all of these tools. If I have a network error code, I add to the Trusted List, Firewall etc. etc., but if I have a file corruption error code, I don't. If I have errors in a System Update Readiness Tool (SURT) log, I don't run SFC unless I fix all in the SURT log and still have problems, and because of the deletion of history, I don't empty SoftwareDistribution unless I find a corrupt file in it from the CBS.log, which is why I chose not to use this script.

However, it is safe. If I were you, I WOULD run it, and report back to Microsoft, and hopefully you will get another elevation (because this level two guy is obviously out of ideas as well). The reason is that I honestly don't know exactly what is going on here. I intend to check out your CBS.log, see if there is anything I can do, repair those SFC corruptions, and check out your SURT logfile, and your C:\ drive. If there is still a problem, I shall elevate you to the one very best of the best across all forums. And I tell you now, if he can't fix this, nobody can. But I shall do all of the preliminary work, and simple stuff first (simple relative to his knowledge!)

I just included the CBS log.
If you need them I also have the CheckSUR and CheckSur.persist logs.

Or are you in need of the entire folder? (ie with CBSpersist cabinet folders?

If you could provide me with the entire folder, that would be great. The most important parts are the persisted CBS.logs, because you have so much logging data that the important information has already been persisted, and I haven't yet seen any of the important CBS.logs yet, and they are my most important log file. Also, if you could provide me with your CheckSUR.logs, and filterlists, I will look over them as well (basically, I want the WHOLE folder if that is OK)

Thanks a lot!

Richard

P.S. I need to go out for a couple of hours now, and I shall look through your logs later today, but I will say now that those SFC found files were corrupt, and I shall be performing a fix.

 

[droolingelmo]

Complete CBS Folder w/cabinet files 8/21/2011

Complete Folder of windows\logs\CBS

E drive is currently attached and doing todays full data backup.

Normally I would leave the drive attached all of the time, but since this occurred with Windows Update I have been running minimalistic, only MS services running and only Kaspersky in startup, all peripherals eccept printer are generally remaiing removed, but I have to still do my daily and weekending backups.

 

[droolingelmo]

LETTER TO RAKESH Microsoft Support

Dear Rakesh,

Thank you for the VB Script. I ran it as you instructed but the results were not as expected. Was the script run through Microsoft Quality Assurance before sending it to me?

From the results, it appears the script was written by Apple.



Thank you for all of your help so far, but would it be possible to refer me to 3rd level suport? Ask them to bring sticks and marshmallows please.

Elmo

 

[droolingelmo]

OTL installed trojan swisyn.bsgf on my machine. It's all over the security sites and even being posted on the OTL site.

OTL by OldTimer – A Modern Replacement for HijackThis « Geeks to Go! – Free help from tech experts