Problem after disabling windows features.

[netoxr2000]

Hi, I'm not sure if this is the right place to ask for help but the error message that I got gave me a hunch that it was here. I disabled some windows features that I was sure I wasn't using and after some time I noticed that I actually needed IE9 because of compatibility issues with my campu's homepage.

Now to the problem, after re-enabling IE9 and other features of windows i got the message "Configuring Windows updates x% complete Do not turn off your computer." while restarting and after the restart it got stuck for a good couple of hours at "Preparing to configure Windows. Do not turn off your computer." After that I had to do a system restore and tried to re-enable the windows features and kept getting the same error.

I don't want to screw up my OS so I thought this was the place to ask because the problem itself had no error codes, the computer was stuck with a windows update message.

My question is, Can I turn on/off the windows features again without freezing/restoring my system? I followed the instructions in the sticky, if it helps I was using a custom theme for windows but I am in doubt if that was the cause of the problem.

 

[NoelDP]

Many custom themes screw up Explorer/IR functionality, and break updates - so it could be that (which ones are you using?).



Having said that, the problem is shown well in the CheckSUR report....

Summary:
Seconds executed: 448
 No errors detected
(w) Unable to open Event Log 0x000006B5 Application  OpenEventLog failed: 0x000006B5 - The interface is unknown.
.
(w) Unable to open Event Log 0x000006B5 System  OpenEventLog failed: 0x000006B5 - The interface is unknown.
.

as for your SFC scan...

 Line 3409: 2013-06-25 05:11:34, Info                  CSI    000002f1 [SR] Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.
 Line 3410: 2013-06-25 05:11:34, Info                  CSI    000002f2 [SR] Repairing 6 components
 Line 3411: 2013-06-25 05:11:34, Info                  CSI    000002f3 [SR] Beginning Verify and Repair transaction
 Line 3414: 2013-06-25 05:11:35, Info                  CSI    000002f5 [SR] Repairing corrupted file [ml:520{260},l:28{14}]"\??\C:\Windows"\[l:24{12}]"explorer.exe" from store
 Line 3417: 2013-06-25 05:11:35, Info                  CSI    000002f7 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"uxtheme.dll" from store
 Line 3420: 2013-06-25 05:11:35, Info                  CSI    000002f9 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"themeui.dll" from store
 Line 3423: 2013-06-25 05:11:35, Info                  CSI    000002fb [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:34{17}]"ExplorerFrame.dll" from store
 Line 3426: 2013-06-25 05:11:35, Info                  CSI    000002fd [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"shell32.dll" from store
 Line 3429: 2013-06-25 05:11:35, Info                  CSI    000002ff [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:32{16}]"themeservice.dll" from store
 Line 3444: 2013-06-25 05:11:35, Info                  CSI    00000301 [SR] Repair complete

So yes, the Theme is definitely part of the problem!

We need to see what the problem is with the Event log services....


Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[netoxr2000]

Thanks for the reply, I'll stick to the regular aero theme while I fix these windows update problems. Here's the report from farbar

Farbar Service Scanner Version: 16-06-2013
Ran by Netoxic (administrator) on 25-06-2013 at 16:47:46
Running from "C:\Users\Netoxic\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[Kaktussoft]

Service "Windows Event Log" is running? Started type=automatic?
If not runnig... can you start it manually?

 

[NoelDP]

Please open an Elevated Command Prompt, and run the following commands....


NET START WECSVC
NET START WERSVC
NET START EVENTLOG
SC QUERYEX WERSVC
SC QUERYEX WECSVC
SC QUERYEX EVENTLOG

post the results...


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[netoxr2000]

This is what i get on the cmd commands

C:\Users\Netoxic>NET START WECSVC
The Windows Event Collector service is starting.
The Windows Event Collector service was started successfully.


C:\Users\Netoxic>NET START WERSVC
System error 1058 has occurred.

The service cannot be started, either because it is disabled or because it has n
o enabled devices associated with it.


C:\Users\Netoxic>NET START EVENTLOG
The Windows Event Log service is starting.
The Windows Event Log service could not be started.

A system error has occurred.

The system cannot find message text for message number 0x1069 in the message fil
e for (null).

More help is available by typing NET HELPMSG 4201.


C:\Users\Netoxic>SC QUERYEX WERSVC

SERVICE_NAME: WERSVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

C:\Users\Netoxic>SC QUERYEX WECSVC

SERVICE_NAME: WECSVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 1484
        FLAGS              :

C:\Users\Netoxic>SC QUERYEX EVENTLOG

SERVICE_NAME: EVENTLOG
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 4201  (0x1069)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

 

[NoelDP]

The fact that the EventLog service can't start is blocking the WERSVC from starting....

Reboot to Safe Mode
Navigate to
C:\Windows\System32\LogFiles\WMI
(you'll have to enable access to the folder)

In there should be the RtBackup folder - rename it to RtBackup.old

Reboot to Normal Mode and WAIT 15 minutes for the system to rebuild any data before running the above SC/NET commands again - post the new results.

 

[netoxr2000]

I restarted in safe mode and renamed the RtBackup to RtBackup.old, after waiting more than 15 minutes I ran the commands again:

C:\Users\Netoxic>NET START WECSVC
The Windows Event Collector service is starting.
The Windows Event Collector service was started successfully.


C:\Users\Netoxic>NET START WERSVC
System error 1058 has occurred.

The service cannot be started, either because it is disabled or because it has n
o enabled devices associated with it.


C:\Users\Netoxic>NET START EVENTLOG
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Users\Netoxic>SC QUERYEX WERSVC

SERVICE_NAME: WERSVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

C:\Users\Netoxic>SC QUERYEX WECSVC

SERVICE_NAME: WECSVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 1388
        FLAGS              :

C:\Users\Netoxic>SC QUERYEX EVENTLOG

SERVICE_NAME: EVENTLOG
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 476
        FLAGS              :

 

[NoelDP]

Good - that seems to have fixed the EventLog error.
It hasn't enabled the WERSVC, though

Please run the following commands, and post the results.
SC QC WERSVC
SC QPRIVS WERSVC

 

[netoxr2000]

C:\Users\Netoxic>SC QC WERSVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WERSVC
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k WerSvcGroup
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Windows Error Reporting Service
        DEPENDENCIES       :
        SERVICE_START_NAME : localSystem

C:\Users\Netoxic>SC QPRIVS WERSVC
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: WERSVC
        PRIVILEGES       : SeDebugPrivilege
                         : SeTcbPrivilege
                         : SeImpersonatePrivilege
                         : SeAssignPrimaryTokenPrivilege

 

[NoelDP]

Ah - good.

Open an Elevated Command Prompt, and run the following commands.

SC CONFIG WERSVC Start= Demand
NET START WERSVC

With any luck, it should start this time.
If not, post the error message you get.

 

[netoxr2000]

I got this now

C:\Users\Netoxic>SC CONFIG WERSVC Start= Demand
[SC] ChangeServiceConfig SUCCESS

C:\Users\Netoxic>NET START WERSVC
The Windows Error Reporting Service service is starting.
The Windows Error Reporting Service service was started successfully.

What comes next?

 

[NoelDP]

Great - that should have things working again now.
Please run the CheckSUR tool again, and post the new CheckSUR.log file.

 

[netoxr2000]

What do I do to run CheckSUR?

 

[NoelDP]

It's the KB947821 download you saved from the Windows Update Posting Instructions

 

[netoxr2000]

This is what I got now.

Edit: Oops wrong file.

 

[NoelDP]

Good - that's OK now.
See what happens if you attmpt Windows Update now - do a manual Check For Updates, and attempt to install only the oldest available - what error message do you get, if any?

 

[netoxr2000]

Hi, it didn't seem to fix the problem, when I attempted to enable IE9 and disable Desktop Gadgets in "Turn Windows Features on or off" my computer got the "Configuring Windows updates % complete. Do not turn off your computer." message and after the restart it got stuck in the Welcome loading at least 30 minutes (when it usually loads in a couple of seconds) before I had to manually shut down the computer and after the second restart, waiting the same time, the same happened so I booted into safe mode and restored the system, otherwise I wouldn't be able to use it.

 

[NoelDP]

Please post the Event Logs


Please open Event Viewer
In the left pane, navigate to the Windows Logs
right-click on Applications and select 'Save all events as...' save as Apps.evtx
repeat for the System logs - save as Sys.evtx
repeat for the Setup log - save as Setup.evtx
Compress the files, and attach to your reply.

 

[netoxr2000]

Here.