Solved Please help repairing windows not genuine dialog popping up

[tenjuna]

how the heck can there be pending deletes from 2009? this is a fresh install of windows 7 lol.

 

[tenjuna]

it didn't like those commands for some reason, but I figured it out. file attached.

 

[NoelDP]

It's the modify date that shows, rather than the creation date
I'm testing some scenarios at teh moment to see what happens - back later

 

[NoelDP]

(just rambling and recording some results - you can ignore this post )
.... a reboot clears the deletes on my VM, but not the renames.
My Win 7 VM on the other hand, has no files in either folder at least in its current state).
Running an SFC populates the renames folder with almost 1800 files (all of them cdf-ms type) - which remain after a reboot.

Since the Deletes are themselves deleted after a reboot - what are they deleting, and are they required?????
Back to Vista... delete 5 files (advapi.dll variants) from the deletes folder and reboot - the folder is not emptied.
Run SFC - no integrity violations, and no error messages about 'Unable to delete'
permissions??remove TrustedInstaller from the ACL... nothing in an SFC eitehr before or after a reboot.
Remove SYSTEm from the ACL...
Checked your entries against the source files, and they appear to be simple copies.
Checked registry entries for the 'missing' deletes I created.... nothing that I could see was relevant.

On deletion of the folders, (takeown and permissions required) reboot is OK, SFC /SCANNOW rebuilds the renames, but not the deletes.

 

[NoelDP]

OK - I'm back live now

Please open an Elevated Command Prompt, and run the following commands

TAKEOWN /F C:\Windows\winsxs\Temp\pendingdeletes /A /R
ICACLS C:\Windows\winsxs\Temp\pendingdeletes /grant AdministratorsF) /T
DEL C:\Windows\winsxs\Temp\pendingdeletes\*.* /Q



Note any error messages! - if you do get any, STOP THERE, and post back with details.

otherwise, close the window, and reboot

now run another SFC /SCANNOW.
reboot, and post the new CBS.log file

 

[tenjuna]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>TAKEOWN /F C:\Windows\winsxs\Temp\pendingdeletes /A /R

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes" now owned
 by the administrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe
.sortkey.nlp.01cd2dbd122c48d3.0007" now owned by the administrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe
.sorttbls.nlp.01cd2dbd1227dbf2.0006" now owned by the administrators group.

C:\Windows\system32>ICACLS C:\Windows\winsxs\Temp\pendingdeletes /grant Administ
rators:(F) /T
processed file: C:\Windows\winsxs\Temp\pendingdeletes
processed file: C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sortkey.nlp.01c
d2dbd122c48d3.0007
processed file: C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sorttbls.nlp.01
cd2dbd1227dbf2.0006
Successfully processed 3 files; Failed processing 0 files

C:\Windows\system32>DEL C:\Windows\winsxs\Temp\pendingdeletes\*.* /Q
C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sortkey.nlp.01cd2dbd122c48d3.00
07
Access is denied.
C:\Windows\winsxs\Temp\pendingdeletes\$$DeleteMe.sorttbls.nlp.01cd2dbd1227dbf2.0
006
Access is denied.

C:\Windows\system32>

 

[tenjuna]

actually what's odd is there isn't a PendingDeletes folder, but there is a PendingRenames...not sure how there could be successful operations on a folder that doesn't exist?

 

[tenjuna]

actually what's odd is there isn't a PendingDeletes folder, but there is a PendingRenames...not sure how there could be successful operations on a folder that doesn't exist?

ignore this, I apparently have lost the ability to spehl my werds currectly.

edit: I did check and Administrators do have Full Control privs over those 2 files.

 

[NoelDP]

The PendingDeletes folder is normally hidden - which is why you can't see it in Windows Explorer.

From the look of the results you got, there is file corruption.
Please run (another?) CHKDSK C: /R and see what happens.


Your best option in that case is to run the CHKDSK and SFC in offline mode from a Recovery Environment boot.

Reboot the computer, and tap the F8 key until you get the advanced boot menu up - one option should be 'Repair your computer'. Pick that one.

Log into your normal account.
You'll get a set of options - pick the Command Prompt one.
At the command prompt, type DIR C:\
- if we're lucky this will bring up a listing of your normal C: drive contents, including the Program Files folder(s) and the Windows folder.
If not, try D:\ or E:\ (etc. until you get the right letter)
then type the following command

CHKDSK <drive>: /R

and wait for it to complete - it could take a few hours, depending on the size of the drive.

reboot to Normal windows, and post the results you saw in the Recovery Environment (you can try copying them to a Notepad file and saving them in your system drive.)

 

[tenjuna]

the first time I ran it, it hung at 98% complete while scanning free space. I did not see any errors in the output.

it just finished running for the 2nd time and reported no problems at the end.

edit: I take that back, it reported failed to transfer logged message to the event log with status 50. but otherwise the file system looks fine.

 

[NoelDP]

That error message is normal when running in the RE - it has no access to anywhere to save the files (it doesn't redirect to the HD, and the folder it wants to save to doesn't exist in the RAMDrive that RE runs from)
Please go back into RE and run the offline SFC scan -


sfc /scannow /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\Windows

where <drive> is the letter you found above.

 

[tenjuna]

"...did not find any integrity violations."

 

[NoelDP]

great - now what happens if you run the scan in normal windows?
SFC /SCANNOW

 

[tenjuna]

cbs attached

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

C:\Windows\system32>

 

[NoelDP]

...in that case I have no idea what's happening!

I'll call in the troops and see if they can help.

 

[NoelDP]

...second thoughts....

Please try this......
(It's very similar to what we've laready done, but seems to work when everythig else fails)

Please run the following commands in an Elevated Command Prompt
NET STOP CRYPTSVC
REN C:\WINDOWS\SYSTEM32\CATROOT2 CATROOT2OLD
NET START CRYPTSVC

once complete, leave the system alone for at least an hour to rebuild the database, then reboot, and run another MGADiag report.
Note that this will delete your Update History - but all updates will remain installed, and can be viewed in the Installed Updates listing.

 

[tenjuna]

sigh.

can't say that I am surprised lol.

 

[tenjuna]

there was already a catroot2old, so I added a new one. am waiting an hour.

Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>dir catroot*
 Volume in drive C is System
 Volume Serial Number is F240-5C20

 Directory of C:\Windows\system32

11/29/2012  08:09 AM    <DIR>          catroot
11/25/2012  09:25 PM    <DIR>          catroot2
11/29/2012  08:50 AM    <DIR>          CATROOT2OLD
08/07/2012  07:35 PM    <DIR>          CatRoot2_2012111221298
11/23/2012  08:36 PM    <DIR>          CatRoot2_2012112510542
               0 File(s)              0 bytes
               5 Dir(s)  429,840,687,104 bytes free

C:\Windows\system32>NET STOP CRYPTSVC
The Cryptographic Services service is stopping..
The Cryptographic Services service was stopped successfully.


C:\Windows\system32>REN C:\WINDOWS\SYSTEM32\CATROOT2 CATROOT2OLD
A duplicate file name exists, or the file
cannot be found.

C:\Windows\system32>REN C:\WINDOWS\SYSTEM32\CATROOT2 CATROOT2OLDTOO

C:\Windows\system32>NET START CRYPTSVC
The Cryptographic Services service is starting.
The Cryptographic Services service was started successfully.


C:\Windows\system32>

 

[NoelDP]

we crossed in the post

Please see my post #56.

 

[NoelDP]

...and again!