Permission error when updating Windows

[privera0]

Greetings,
I have been having some problems when my computer does automatic updates. I've been getting the Code 80070005 error (lacking administrator access) even though i'm logged in as the admin. This happens for "Update for Windows 7 for x64-based Systems (KB2732487)". I get error code 800F0826 for "update for user-driver framework version 1.11 for Windows 7 (KB2685813)"
When i tried to update adobe flash I got the following error "the user does not have sufficient priviledges to install adobe flash player". I believe both problems are related.
I've removed all other antivirus software thinking this may have caused the problem. I also installed one update at a time until i got to the above mentioned problem updates.
I've tried downloading to the desktop, right click and install as admin, but to no avail.

any assistance is appreciated.

 

[ICIT2LOL]

Hello and welcome privera have a look at this

Windows Update Error code 80070005 - Microsoft Community

 

[NoelDP]

Open an Elevated Command Prompt, and run the following commands

sc sdshow plugplay
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /S

Copy and paste the results to your reply

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[ICIT2LOL]

I'll leave this one to Noel

 

[privera0]

Open an Elevated Command Prompt, and run the following commands

sc sdshow plugplay
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /S

Copy and paste the results to your reply

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

thanks for your response, Noel. Just curious, what is this report you had me cut and paste?

Here are the results:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sc sdshow plugplay

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-18" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-18
Flags REG_DWORD 0xc
State REG_DWORD 0x0
RefCount REG_DWORD 0x1
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprof
ile


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-19" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-19
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\LocalService

Flags REG_DWORD 0x0
State REG_DWORD 0x0


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-20" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-20
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\NetworkServi
ce
Flags REG_DWORD 0x0
State REG_DWORD 0x0


C:\Windows\system32>^V

 

[NoelDP]

It's a registry dump of some of the Keys that give rise to similar problems - in this case, they all look normal, so we'll have to go through the more conventional tests....

In an Elevated Command Prompt, please run the following commands (one at a time this time!)
just report the number of files and folders in the summary at the end of each....

DIR C:\Windows /AR /S
DIR C:\Windows\SoftwareDistribution /AR /S
DIR C:\Windows\System32 /AR /S
DIR C:\Windows\System32\Catroot2 /AR /S

 

[privera0]

It's a registry dump of some of the Keys that give rise to similar problems - in this case, they all look normal, so we'll have to go through the more conventional tests....

In an Elevated Command Prompt, please run the following commands (one at a time this time!)
just report the number of files and folders in the summary at the end of each....

DIR C:\Windows /AR /S

521 files 854,739,618 bytes
9 dirs 399,187,718,144 bytes

DIR C:\Windows\SoftwareDistribution /AR /S
Volume in Drive C has no label.
Volume serial number is E039-03B2
File not found

DIR C:\Windows\System32 /AR /S
Directory of C:\windows\system32\macromed\flash
11/17/2012 10:41pm 20,304,824 flash64_11_5_502_110.ocx
1 file 20,304,824 bytes
Directory of C:\windows\system32\restore
3/29/2012 12:12 76 machineguid.txt
1 file 76 bytes

Total files listed:
2 files 20,304,900
0 dirs 399,372,222,464 bytes free

DIR C:\Windows\System32\Catroot2 /AR /S

volume in drive C has no label.
volume serial number is E039-03B2
File not found

Thanks again!

 

[NoelDP]

Those are perfectly normal results.
It sounds as if there may be a problem with the Trustedinstaller service....
...but first, some standard system checks.... (before I get too carried away!)

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply.

Please also post an MGADiag report - it can show problems with the system quite quickly...

Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html


Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

 

[privera0]

Those are perfectly normal results.
It sounds as if there may be a problem with the Trustedinstaller service....
...but first, some standard system checks.... (before I get too carried away!)

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply.

Please also post an MGADiag report - it can show problems with the system quite quickly...

Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html


Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

Thanks for your continued help.
There were no errors found in the SFC. I tried to attach the CBS log after creating a shortcut on the desktop and it said "you don't have permission to open this file." I tried to change the permissions for the file, but I got the same result. Do I have to compress it first, or is this a non-issue for this problem? Am i doing something wrong, or is this part of my overall issue?

Here is the MGAdiag report
Diagnostic Report (1.9.0027.0):
-----------------------------------------

Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-8RCRG-4T6DG-JX464
Windows Product Key Hash: RmDVRUPGhX9OAgs7E09QLTZyuG8=
Windows Product ID: 00359-OEM-9810872-08540
Windows Product ID Type: 8
Windows License Type: COA SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {E581C9B7-1821-41AD-9AF2-56CAAEFEF600}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard Edition 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{E581C9B7-1821-41AD-9AF2-56CAAEFEF600}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JX464</PKey><PID>00359-OEM-9810872-08540</PID><PIDType>8</PIDType><SID>S-1-5-21-1359348841-835194265-2848403664</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv6 Notebook PC</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20100914000000.000000+000</Date></BIOS><HWID>7BD33F07018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard Edition 2003</Name><Ver>11</Ver><Val>268989C30238070</Val><Hash>WCNPEHoHwAvyiUi2pmA2KreUr3I=</Hash><Pid>70141-056-5149101-56112</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00196-108-708540-02-1033-7600.0000-0892012
Installation ID: 014021116735853824608070893333232441163735829354128626
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: JX464
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 11/21/2012 10:36:55 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 10:2:2012 08:19
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAEAAAACAAAAAgABAAEA6GGWDM4PZs7OzCqJBLME1poCzuBcXQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			HPQOEM		SLIC-MPC
  FACP			HPQOEM		SLIC-MPC
  HPET			HPQOEM		SLIC-MPC
  BOOT			HPQOEM		SLIC-MPC
  MCFG			HPQOEM		SLIC-MPC
  WDAT			HPQOEM		SLIC-MPC
  ASF!			HPQOEM		SLIC-MPC
  SLIC			HPQOEM		SLIC-MPC
  ASPT			HPQOEM		SLIC-MPC
  SSDT			PmRef		CpuPm

 

[NoelDP]

As I said in the instructions - you have to copy the file to the desktop and work on teh copy. The file itself is permanently open by the system so you have minimal rights to it.

 

[privera0]

As I said in the instructions - you have to copy the file to the desktop and work on teh copy. The file itself is permanently open by the system so you have minimal rights to it.

i created a shortcut of the CBS file to the desktop and right clicked on it to see if i could compress it, but i didn't have that option. I tried to attach it via the Seven Forums attachment option, but when i clicked on it, it said i didn't have permission to open that file.
I was clicking on the shortcut that i created in the desktop. Is this what you mean by "creating a copy to the desktop"?

 

[NoelDP]

You MUST COPY the file - creating a shortcut does nothing.

In Windows Explorer, navigate to the C:\Windows\Logs\CBS folder
right-click on the CBS.log file and select Copy
minimise the Windows Explorer window, and right-click on an empty area of the desktop
Select Paste.
The file should appear on your desktop
right-click on it and select Send to .... > Compressed (zipped folder)
The CBS.zip file should appear on the desktop
attach that to your reply.

 

[privera0]

for some reason when i right click i don't see the "send to compressed file" option. i have other destination available... but my compressor is not one. not sure why. i'm looking into this and will then upload file.

thanks for your patience.

 

[privera0]

cbs file

attached is cbs file

 

[NoelDP]

Possible cause of 1935 error with HRESULT 0x80070002 - Aaron Stebner's WebLog - Site Home - MSDN Blogs may apply -


Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[privera0]

i ran the scan... it didn't find any malicious items. Here is the report:

Malwarebytes Anti-Malware 1.65.1.1000
Malwarebytes : Free anti-malware download

Database version: v2012.11.28.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
User :: USER-PC [administrator]

11/27/2012 10:06:27 PM
mbam-log-2012-11-27 (22-06-27).txt

Scan type: Full scan (C:\|D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 382549
Time elapsed: 45 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

[ICIT2LOL]

Noel Just as a thought what about a SuperAntiSpyware scan? I find it picks stuff that MBAM and my Kaspersky doesn't.

Plus I wonder if the Microsoft Malicious tool might be of help.

SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!