Trying to Restore After HDD Failure

[NoelDP]

Ouch!

Summary:
Seconds executed: 7894
 Found 769 errors
  CSI Payload File Missing Total count: 1
  CBS MUM Corrupt Total count: 384
  CBS Catalog Corrupt Total count: 384

I've uploaded a file - sstaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder sstaa in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages


Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

 

[Slapshot]

Sorry for the delay. There has been a major setback as the computer will not boot and I am working online from my iPad.
I will try to get the order of events right. Prior to this morning, I had not been able to download the SUR Tool program, and would only get the 0cx8000247 error. I am guessing that was why the 2 CheckSur logs were old. After loading the IRST drivers I was able to do a successful download and install. I clicked "close" on the install complete screen. After a reboot, the computer began installing approx. 35 updates even though I had the update settings set to not install automatically. Anyway, after the update install process, I got an error message that referred to the codecs.dll file. Before I could write the entire message down, the computer rebooted itself, and now will not boot up at all. It hangs at the starting Windows logo screen then reboots. I started Startup Repair, and I get an unsuccessful repair. It gives the following details:
Problem signature 01 - 6.1.7600.16385
02 - 6.1.7600.16385
03 - unknown
04 - 21200749
05 - AutoFailOver
06 - 3
07 - no root cause
O.s. version 6.1.7.7600.2.0.0.256.1
Locale I.d. 1033

I have tried to boot into safe mode without luck. I booted into system repair mode and tried to restore back to a restore point earlier in the day with no luck. I get an error message that "System restore failed while scanning the file system on the drive D:\
The drive might be corrupt. You might want to retry System Restore after running chkdsk /R on this disk. An unspecified error occurred during System Restore. (0x80070057)"

I am confused by this reference to the D: drive. At the top of the window there is a reference to "Operating System Windows 7
D:\ " and the diagnosis and repair details indicate the Windows Directory = D:\Windows. The restore point window indicated I was restoring from the C: drive.

 

[NoelDP]

Don't worry about the drive letter - it gets re-evaluated in the Repair Environment so is often quite different to the one you usually see.

I'd run a CHKDSK /R from the Repair environment and see if that picks anything up - you'll need to use the command
CHKDSK D: /R
to do the system partition, rather than C:

 

[Slapshot]

Ran chkdsk /r and no change. Nothing was obvious from the chkdsk report. No bad sectors.

 

[Slapshot]

Is reinstalling the system image and starting this process over the best solution?

 

[NoelDP]

It may be - how much data will you lose in the process? - can you copy it to an external HD?

 

[Slapshot]

I am in the process of restoring from a system image. Data loss will be minimal. I will then go back through the steps I completed with you and Golden. Any advice? It will probably be late tonight here before I am done.

 

[Slapshot]

This is the MGADiag report after reinstalling the IRST drivers:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {99FFC692-AD49-4929-8BCA-6DEC6DFA0334}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130708-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
Microsoft Office Small Business 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_672A8F41-307-80004005_672A8F41-349-80004005_672A8F41-244-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{99FFC692-AD49-4929-8BCA-6DEC6DFA0334}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1986910065-1566111469-2135244464</SID><SYSTEM><Manufacturer>Gateway</Manufacturer><Model>DX4831</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-B1</Version><SMBIOSVersion major="2" minor="6"/><Date>20100323000000.000000+000</Date></BIOS><HWID>F9693007018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>54E9E38C0DF0340</Val><Hash>9MREcMzk6dB9C+j+wFjL1PcdQ5M=</Hash><Pid>81602-416-0107411-68288</Pid><PidType>10</PidType></Product><Product GUID="{91120000-00CA-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Small Business 2007</Name><Ver>12</Ver><Val>828737365AB3F12</Val><Hash>KttxEXhWfzM3jcxfmML2SO+CUSQ=</Hash><Pid>81606-905-6831334-64162</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-1033-7600.0000-3352009
Installation ID: 017611270644575073925570131701582141591095055964203294
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7QJB7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 11/18/2013 7:46:46 PM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 11:18:2013 17:49
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAQABAAAAAQABAAEAonayI77PQsgeyQBr+HOkwKhIXF0=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS APIC0935
FACP ACRSYS FACP0935
HPET ACRSYS OEMHPET
MCFG ACRSYS OEMMCFG
SLIC ACRSYS ACRPRDCT
OEMB ACRSYS OEMB0935
GSCI ACRSYS GMCHSCI
AWMI ACRSYS OEMB0935
SSDT DpgPmm CpuPm

 

[Golden]

That looks good. No problems there.

 

[Slapshot]

Still trying to install and run the SUR Tool.

 

[NoelDP]

Tun SFC /SCANNOW first if you're having problems

 

[Slapshot]

I finally got the SURTool to download and install. Then ran SFC /scannow, and it found no violations on the first run. Previously I had run it 4 times and it still found errors. Attached are the 3 logs from the CBS folder. I had to attache them separately as the CBS folder was over 8MB.View attachment 294186

View attachment 294187

View attachment 294188

I have not installed any additional updates yet, and was planning to do so in small groups of 4 or 5. I will wait until I hear back from you. I have not yet installed the content info you had previously posted to your Skydrive, and will wait for further instructions. Also, my antivirus (Kaspersky) upon reinstall detected 3 trojan files: "Heur:exploit.java.generic" which have been quaranteened. I uninstalled Java at least 6 months ago.

 

[NoelDP]

That's the second time in a week that I've seen this type of massive error. - both in this thread

Summary:
Seconds executed: 7672
 Found 769 errors
  CSI Payload File Missing Total count: 1
  CBS MUM Corrupt Total count: 384
  CBS Catalog Corrupt Total count: 384

Apply the fix as in Post #21 and let's see what happens.


[edit] - FWIW you've had this problem for more than a year, probably - at least according to the CheckSUR results!

 

[Slapshot]

Will do post 21 fix. Since you mentioned a year long problem, last November the system crashed with similar problems:
WU not working, VSS errors, unable to restore from restore points, etc. It was caused when I was doing a Flash Player or Adobe update and Google Chrome got installed by my inattention. I tried to uninstall Chrome and the system came crashing down. It took weeks to get it back up and running.

 

[Slapshot]

After Post 21 fix, ran SURTool again, and here are logs:

View attachment 294222

View attachment 294223

 

[NoelDP]

Are we good, or what?

Checking Component Store
(f) CSI Payload File Missing 0x00000000 bitsadmin.exe x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7600.16385_none_4ce7e7256dbfa16f 
 Summary:
Seconds executed: 1332
 Found 385 errors
 Fixed 384 errors
  CSI Payload File Missing Total count: 1
  CBS MUM Corrupt Total count: 384
  Fixed: CBS MUM Corrupt.  Total count: 384
  Fixed: CBS Paired File.  Total count: 384

...and I haven't even tried to fix the payload issue yet


We do need a new CBS log after running the SFC /SCANNOW - it'll show up any new problems brought to light by repairing the other errors.

 

[Slapshot]

New CBS log:

View attachment 294237

 

[NoelDP]

Good - there's no other files found by SFC.

I'll post a fix for that payload file later