Computer works in safe mode. Restore/repair fail...help!

[scott l]

My computer is very inconsistent and extremely slow in normal made. i use msconfig to only use windows programs and that worked for a couple weeks and now has failed me. I tried restoring it and the restore fails. I used the sfc/scanow and it cant finish. I do not have a disk drive on my computer just an fyi. I just want it to work again, i would be up to do a clean install but i dont have a windows disk or product key. Please help get my computer working like normal again i need it for school!

 

[archer]

Hi scott I, Welcome to Seven Forums. Have you tried, in safe mode, opening a command prompt and typing "sfc/scannow" and hitting enter? This scans windows files and will repair them if they are corrupt. May work May not but well worth the try.

 

[NoelDP]

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to a reply so I can take a look.

 

[scott l]

I cannot completet a sfc scannow.

When i tried the chkdsk prompt and reboot it says " the type of system is NTFS and the volume is clean and cannot be opened for direct access. cannot run due to recent installed software package. It says try to restore to a point before the software."

I do not know what software thsi is and when i tried a restore point it fails about halfway through for every restore point i have.

 

[NoelDP]

OK - try this, then....


Your best option in that case is to run the CHKDSK and SFC in offline mode from a Repair Environment boot.

Reboot the computer, and tap the F8 key until you get the advanced boot menu up - one option should be 'Repair your computer'. Pick that one.

Log into your normal account.
You'll get a set of options - pick the Command Prompt one.
At the command prompt, type DIR C:\
- if we're lucky this will bring up a listing of your normal C: drive contents, including the Program Files folder(s) and the Windows folder.
If not, try D:\ or E:\ (etc. until you get the right letter)
then type the following command

CHKDSK <drive>: /R

and wait for it to complete - it could take a few hours, depending on the size of the drive.

Once complete, type

sfc /scannow /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\Windows

where <drive> is the letter you found above.
(example - sfc /scannow /OFFBOOTDIR=P:\ /OFFWINDIR=P:\Windows)

Wait for the command to complete. (make a note of the response!).

Once it has, type EXIT and the pick the option to reboot.

 

[Fantail]

".. I do not have a disk drive on my computer" ? huh cd/dvd optical ?
Is this a notebook? Presuming you can still have the hard disk removed, plugged into a usb external and have someone run malwarebytes on it, full scan.

 

[scott l]

I ran the sfc scannow and it worked this time. its says there are files corrupted but some cannot be repaired. details are included in the cbs log. I tried to type in C:\Windows\Logs\CBS\CBS.log to see it but it said access denied. i was running the command prompt as a admin/owner. How do i see the cbs log and then attach it here so you can look at it?

SEE BELOW POST FOR CBS file.

 

[scott l]

View attachment 282580

 

[gregrocker]

You'd likely be better off following the steps to get a perfect Clean Reinstall - Factory OEM Windows 7 which is the same for retail. Compare the install you have to the best practices compiled in the blue link.

Otherwise work through the Troubleshooting Steps for Windows 7

 

[NoelDP]

There's only one corrupt file identified by SFC -

 Line 14344: 2013-08-22 13:26:06, Info                  CSI    00000309 [SR] Repairing 1 components
 Line 14345: 2013-08-22 13:26:06, Info                  CSI    0000030a [SR] Beginning Verify and Repair transaction
 Line 14348: 2013-08-22 13:26:06, Info                  CSI    0000030c [SR] Cannot repair member file [l:22{11}]"wuaueng.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 14351: 2013-08-22 13:26:07, Info                  CSI    0000030e [SR] Cannot repair member file [l:22{11}]"wuaueng.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 14352: 2013-08-22 13:26:07, Info                  CSI    0000030f [SR] This component was referenced by [l:150{75}]"WUClient-SelfUpdate-Core-CoreComp~31bf3856ad364e35~amd64~~7.6.7600.256.Core"
 Line 14357: 2013-08-22 13:26:07, Info                  CSI    00000312 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"wuaueng.dll"; source file in store is also corrupted
 Line 14362: 2013-08-22 13:26:07, Info                  CSI    00000314 [SR] Repair complete

I'll post a fix protocol for it later.
In the meantime, please try running the CheckSUR tool

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply.

 

[scott l]

it says that the checksur cannot work in safe mode. That is all i can use right now.

 

[NoelDP]

Have you tried a Clean Boot?
How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista

 

[scott l]

i have done that. the checksur still fails, its says there was an error. i can clean boot but it ends up freezing after a couple minutes.

 

[NoelDP]

OK - I'll see if there are any other indicators in the CBS logs as well.

 

[gregrocker]

How far have you gotten through the Troubleshooting Steps for Windows 7?

If it won't remain booted then switch to the steps for Troubleshooting Windows 7 Failure to Start.

I would start with the hardware tests. If you'll tell us your HD maker, we can help you find a bootable flash stick version of HD Diagnostic.

 

[NoelDP]

These seem to be the relevant background errors in the CBS log....

Line 7161: 2013-08-21 23:15:03, Error                 CSI    00000188 (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #3700180# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile(h = a10 ("\Device\HarddiskVolume3\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.6.7600.256_none_d5f513f25190f276\wuaueng.dll"), evt = 0, apcr = NULL, apcc = NULL, iosb = @0xb2cd30, data = {l:0 b:}, byteoffset = 1703936 (0x00000000001a0000), key = (null))
 Line 7163: 2013-08-21 23:15:03, Error                 CSI    [EMAIL="00000189@2013/8/22:06:15:03.911"]00000189@2013/8/22:06:15:03.911[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error c0000185 [Error,Facility=(system),Code=389 (0x0185)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile expression: (null)
 Line 7165: 2013-08-21 23:15:11, Error                 CSI    0000018a (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #3700179# from Windows::Rtl::SystemImplementation::CFile_IRtlFileTearoff::ReadFile(Flags = 3, Buffer = {l:0 ml:65536 b:}, Offset = 1703936 (0x00000000001a0000), Disposition = 0)[gle=0xd0000185]
 Line 10881: 2013-08-22 13:02:44, Error                 CSI    00000042 (F) STATUS_TOO_LATE #1203035# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowKeyNotFound|AllowAccessDenied), key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0x98cf50->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[114]"\Registry\Machine\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 10014448 (0x0098cef0))[gle=0xd0000189]
 Line 10882: 2013-08-22 13:02:44, Error                 CSI    [EMAIL="00000043@2013/8/22:20:02:44.849"]00000043@2013/8/22:20:02:44.849[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_TOO_LATE originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
 Line 10886: 2013-08-22 13:02:45, Error                 CSI    00000044 (F) STATUS_TOO_LATE #1203034# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowKeyNotFound), key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0x98cf50->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[114]"\Registry\Machine\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 10014836 (0x0098d074))[gle=0xd0000189]
 Line 10887: 2013-08-22 13:02:45, Error                 CSI    [EMAIL="00000045@2013/8/22:20:02:45.270"]00000045@2013/8/22:20:02:45.270[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_TOO_LATE originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
 Line 10891: 2013-08-22 13:02:45, Error                 CSI    00000046 (F) STATUS_TOO_LATE #1203033# from Windows::Rtl::SystemImplementation::CBufferedRegistryProvider::SysOpenKey(flg = (AllowKeyNotFound), key = {provider=NULL, handle=0}, da = (KEY_ALL_ACCESS), oa = @0x98d300->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[114]"\Registry\Machine\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 10016456 (0x0098d6c8))[gle=0xd0000189]
 Line 10892: 2013-08-22 13:02:45, Error                 CSI    00000047 (F) STATUS_TOO_LATE #1203032# from Windows::Rtl::SystemImplementation::CKey::OpenExistingKey(f = 3, da = (KEY_ALL_ACCESS), oa = @0x98d788, key = NULL, disp = 0)[gle=0xd0000189]
 Line 10893: 2013-08-22 13:02:45, Error                 CSI    00000048 (F) STATUS_TOO_LATE #1202990# from CCSDirectTransaction::OperateEnding at index 0 of 1 operations, disposition 0[gle=0xd0000189]

Please open an elevated Command Prompt, and run the following commands....

DIR C:\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.6.7600.256_none_d5f513f25190f276
REG QUERY HKLM\components\DerivedData\Components\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.6.7600.256_none_d5f513f25190f276
.

post the results.

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.