Unable to Install Windows 7 SP1 or IE9 using Windows Update

[NoelDP]

Great - while I'm looking through that, please run another CheckSUR and post the new CheckSUR.log file

 

[jmak18]

Awesome, hopefully everything will work out now. Here's the new logs:

 

[jmak18]

Also several new things. I opened up the Windows Update Panel, and apparently the SP1 Update is not there anymore. I'm just wondering if this was somehow fixed by all the CheckSUR's, etc because the update is not listed in the update history. The IE9 update however is still there waiting to be installed. Also my settings are not set to automatically update, I set it to manual after repeated failures in the past with those 2 updates.

Another thing that is more urgent and not sure if related to my problems is that I opened Internet Explorer after many months if not years of not using it. And I noticed the front page is redirected to search.conduit which I heard is some sort of spyware. Not sure exactly how worried I should be over this but just thought I'd let you know.

 

[NoelDP]

That's fixed a few 'new' problems!

CheckSUR results...

Summary:
Seconds executed: 2274
 Found 4 errors
 Fixed 4 errors
  CBS MUM Missing Total count: 4
  Fixed: CBS MUM Missing.  Total count: 4
  Fixed: CBS Paired File.  Total count: 4

All errors relate to original RTM Win7 files.


If we're lucky, this may cure the problem. - please try ONLY the oldest update, and see what happens - post any error message, the CBS.log file, and the C:\Windows\windowsupdate.log file.

 

[jmak18]

That's kind of what I'm saying in my last post, the SP1 was the oldest update but is not showing anymore in the list of things to update. But neither does it say that was successfully installed in the update history. So I'm not sure whether this was intended through all the hotfixes done or whether something went wrong. I'll attach a screenshot of what I mean.

As for the search.conduit, should I start a new thread after this is finished or could this be somehow related?

 

[NoelDP]

search.conduit is adware/spyware.

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

You may be able to install SP1 using the standalone installer from here...
Download Windows 7 and Windows Server 2008 R2 Service Pack 1 (KB976932) from Official Microsoft Download Center

 

[jmak18]

ok ran about 4 Scans up til now with Malwarebytes. 2 Threat scans, and 2 Custom Scans with everything checked off. The last one I did came up clean. The first 2 caught a lot of the garbage PUP's (PUP.Optional.Counduit, PUP.Optional.Conduit.A, PUP.Optional.PriceGong.A, PUP.Optional.InstallCore.A)[FONT=&quot] [/FONT]which I believe are all gone now, though am not sure how they got there in the first place since I'm always careful when installing things.

However, the 3rd scan caught Trojan.FakeMS ([FONT=&quot]C:\Windows\System32\audiodg.exe)[/FONT] which I believe is a False Positive, as it appears to be an audio file and audio isn't working anymore. I have only quarantined all files and haven't deleted any yet. I'll upload the logs for confirmation on the Trojan and the go ahead to install SP1. Thanks Noel.

 

[NoelDP]

Conduit, PriceGong, and the like are easy access points for malware, and may attract it like magnets attract iron filings.

They are often installed as 'by-blows' with software that you may actually want - and may or may not be announced along the way, depending on the source of the installer.


As far as your audiodg file is concerned, I'd suggest running SFC /SCANNOW again, and posting the resulting CBS.log file - we can then see whether Windows thinks it's legit or not.

 

[jmak18]

The SFC scan appears to have found errors this time. Attaching CBS log.

Also it appears the option to install SP1 through Windows Update is back again (will post screenshot). Although it has this weird size range which was not there before. After the Trojan thing is sorted out, should I install it from Windows Update or the link your provided. Many thanks again.

 

[NoelDP]

It looks like the file may well have been infected.

2014-06-05 20:33:37, Info                  CSI    00000305 [SR] Cannot repair member file [l:22{11}]"audiodg.exe" of Microsoft-Windows-Audio-AudioCore, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-06-05 20:33:37, Info                  CSI    00000306 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7600.16385_none_d294b5cdfe50c681\audiodg.exe do not match actual file [l:22{11}]"audiodg.exe" :
  Found: {l:32 b:2vDz6WtbJPDWZR+YzMuOzFdsK2NFty7hAxZNGb1kqV8=} Expected: {l:32 b:sDLMfL1xUZa+w7C3wt/R1habZswXcN1LcIlRzIfdhxs=}

I'll post a fix protocol for it later.

 

[NoelDP]

I've uploaded a file - jmkad.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\jmkad
hit the enter key - if you get a 'Not Found' error try
DIR D:\jmkad
or
DIR E:\jmkad



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\jmkad <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[jmak18]

I think I screwed it up. At first everything was ok, inputted the first command into the prompt fine and found that it was the D: drive again that was working with the C: drive not found. However, when inputting the second command I hit enter too early before I completed the command when a relative barged in demanding to use the computer *sigh*.

The command didn't go through so I closed that window, reopened it and inputted it again correctly a second time. Not sure if I should have done that, but it reported that file was replaced successfully, or something along those lines. Ran the SFC scan again and it found errors. Attaching log. Sorry

 

[NoelDP]

Shame you can't choose family, huh? One reason why I live alone!

Anyhow - the same error is still present in the latest SFC scan...

 Line 34705: 2014-06-07 11:26:59, Info                  CSI    00000302 [SR] Repairing 1 components
 Line 34706: 2014-06-07 11:26:59, Info                  CSI    00000303 [SR] Beginning Verify and Repair transaction
 Line 34709: 2014-06-07 11:26:59, Info                  CSI    00000305 [SR] Cannot repair member file [l:22{11}]"audiodg.exe" of Microsoft-Windows-Audio-AudioCore, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 34712: 2014-06-07 11:26:59, Info                  CSI    00000307 [SR] Cannot repair member file [l:22{11}]"audiodg.exe" of Microsoft-Windows-Audio-AudioCore, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

This usually means either you messed up the commands, or I posted the wrong file (a not unheard-of happening!).
...
In this case, it was my fault - I gave you the file for the SP1 version rather than the RTM version


Let's see if I can get it right this time!

I've uploaded a file - jmkae.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\jmkae
hit the enter key - if you get a 'Not Found' error try
DIR D:\jmkae
or
DIR E:\jmkae



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\jmkae <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[jmak18]

That is great news! I was dreading reading the words "sorry ... irreparable ... reinstall". And in that case would be ready to throw both my computer and relative together out the window!

Anyways, it seems this round went smoothly and SFC doesn't seem to be reporting any unfixable errors. But I'll let you be the judge of that

 

[NoelDP]

SFC is clear

Try SP1 again now - if it fails, post the new CBS.log file.

 

[jmak18]

It failed again. But this time it gives a new error code of 80073701. So not sure whether this is a good or bad thing. Uploading CBS log.

 

[NoelDP]

Here's what I think is the root error now...

2014-06-09 12:11:28, Info                  CBS    Exec: Resolving Package: Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~amd64~fr-FR~6.1.7601.17514, Update: INF_netrndis, PinDeployment: amd64_netrndis.inf-languagepack_31bf3856ad364e35_6.1.7600.16385_fr-fr_5779dd43d35fd44d
2014-06-09 12:11:28, Error                 CSI    [EMAIL="000001af@2014/6/9:16:11:28.164"]000001af@2014/6/9:16:11:28.164[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\componentstore\csd_locking.cpp(324): Error STATUS_SXS_ASSEMBLY_MISSING originated in function CCSDirectTransaction::LockComponent expression: (null)
[gle=0x80004005]
2014-06-09 12:11:42, Error                 CSI    000001b0 (F) STATUS_SXS_ASSEMBLY_MISSING #1031827# from CCSDirectTransaction::OperateEnding at index 0 of 1 operations, disposition 2[gle=0xd015000c]
2014-06-09 12:11:43, Error                 CSI    000001b1 (F) HRESULT_FROM_WIN32(ERROR_SXS_ASSEMBLY_MISSING) #1031712# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_PinDeployment(Flags = 0, a = netrndis.inf-LanguagePack, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"fr-FR", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, cb = (null), s = (null), rid = [97]"Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~amd64~fr-FR~6.1.7601.17514.INF_netrndis", rah = (null), manpath = (null), catpath = (null), ed = 0, disp = 0)[gle=0x80073701]
2014-06-09 12:11:44, Info                  CBS    Failed to pin deployment while resolving Update: INF_netrndis from file: (null) [HRESULT = 0x80073701 - ERROR_SXS_ASSEMBLY_MISSING]
2014-06-09 12:11:44, Info                  CBS    Failed to resolve item[0] in Package: Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~amd64~fr-FR~6.1.7601.17514, Update: INF_netrndis [HRESULT = 0x80073701 - ERROR_SXS_ASSEMBLY_MISSING]
2014-06-09 12:11:44, Info                  CBS    Failed to resolve execution update. [HRESULT = 0x80073701 - ERROR_SXS_ASSEMBLY_MISSING]
2014-06-09 12:11:44, Error                 CBS    Failed to resolve execution package: Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~amd64~fr-FR~6.1.7601.17514 [HRESULT = 0x80073701 - ERROR_SXS_ASSEMBLY_MISSING]

This does seem to be a fairly common error - unfortunately, I believe that it's caused by a bad root image from the manufacturer, and the only certain answer that I know is a repair install (preferably using SP1 media).

Look here for instructions. http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R
.

 

[jmak18]

Well I read the link you provided. A repair install isn't as bad as I thought. But still seems troublesome and time consuming. Do I have any other options available or is this the only one?

And when you say manufacturer, do you mean like Acer? Because in that case I'm not going to buy from them ever again.