Updates loop, SFC won't run, SURT doesn't work, Can't System Restore

[TalbotM]

How's that for a Topic?

I first noticed the problem while trying to install QuickBooks.
It complained about the .NET framework.
When I went to Add/Remove Windows components, it was blank.
I googled and studied more.
I tried SFC /scan now. "Windows Resource Protection could not perform the requested operation."
Notice Application log is full of 1001 - Windows Error reporting with the following:
WindowsWcpOtherFailure3Not available06.1.7601base\wcp\componentstore\storelayout.cpp

SURT appears to install, but really doesn't run.
There are more symptoms, but that's enough for starters.

CBS logs attached.

I appreciate any help you can offer.
TalbotM

 

[NoelDP]

The CheckSUR reports this...

Checking Packages
(f) CSI Unable to Query Store Version 0x00000002

This means that there is a major problem with your registry.

I need to have a look at your COMPONENTS registry hive

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

 

[TalbotM]

Here's components:
https://onedrive.live.com/redir?resid=EDDBF4CF74633D11%21634

 

[NoelDP]

Oh Dear
The file should have been around 40MB uncompressed and 10MB compressed. It was only 704 bytes compressed, and 256KB uncompressed.
This effectively means that unless you are very lucky and have a restore point to which you can return which has the registry hive in it, then your only option is a Repair install of Windows.

See this tutorial for details. - http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

 

[TalbotM]

System restore is not functioning properly, I'm sad to say. Off to a repair install. Thank you very much for looking at my situation. I appreciate it.

 

[NoelDP]

You're welcome - good luck!

 

[TalbotM]

I just can't win today. "An error prevented a required compliance check from completing. Cancel the installation and try upgrading again."

Incidentally, this is Windows 7 Enterprise. I erred when I said Pro earlier. Of course my installation media matches.

 

[NoelDP]

Ouch! - possibly your disk is for RTM and you have SP1 installed?

 

[TalbotM]

Well, I managed to dig up a pretty ancient backup and restore my COMPONENTS store, and things seem to have improved greatly. I can now run SFC (at least to about 54%), and I have re-run SURT. My latest CBS folder is ZIPed here: https://onedrive.live.com/redir?resid=EDDBF4CF74633D11%21642 , would you mind giving it another look? I'm still having a few update issues, but maybe it is just down to missing manifests and such now.
Thanks,
Talbot

 

[NoelDP]

I can't access the file? - "This item might have been deleted, expired or you might not have permission to view it." - did you remember to Share it?

 

[TalbotM]

Beats me. Didn't work for me either. Must have been a bad paste. Try this:

http://1drv.ms/1rEB9lN

 

[NoelDP]

YOur CheckSUR shows these problems -

Unavailable repair files:
 winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2.manifest
 winsxs\manifests\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822.manifest
 winsxs\manifests\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4.manifest
 winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_88dcc0bf2fb1b808.manifest
 winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_49e66f4952a1b53b.manifest
 winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_09bd717ffacfdd51.manifest

The CBS log shows the following problem...

2014-06-02 15:24:30, Error                 CSI    00000227 (F) STATUS_FILE_IS_A_DIRECTORY #4938246# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowFileNotFound|AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_READ_DATA), oa = @0xc6d1c0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[131]"\SystemRoot\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xc6d270, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd00000ba]
2014-06-02 15:24:30, Error                 CSI    [EMAIL="00000228@2014/6/2:20:24:30.310"]00000228@2014/6/2:20:24:30.310[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error STATUS_FILE_IS_A_DIRECTORY originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2014-06-02 15:24:30, Error                 CSI    00000229 (F) STATUS_FILE_IS_A_DIRECTORY #4938245# from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingFile(...)[gle=0xd00000ba]
2014-06-02 15:24:30, Error                 CSI    0000022a (F) STATUS_FILE_IS_A_DIRECTORY #4938244# from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingFile(flags = (MissingFileIsOk|SharingViolationIsOk|AccessDeniedIsOk), da = (SYNCHRONIZE|FILE_READ_DATA), oa = @0xc6d868->SIL_OBJECT_ATTRIBUTES {s:40; on:"MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE), file = NULL, disp = Invalid)
[gle=0xd00000ba]

I've only seen this error type once before - and it turned out to be the result of a ZeroAccess infection, as I was later told.

I think that you'd best scan for malware first.

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[TalbotM]

It could be remnants from a prior infection. Before I started this exercise, I ran everything in the book on this computer. Malwarebytes, TDSSKiller, Norton Power Eraser, Panda Security and about 3 other generic engines. Shows clean.
I even have Malwarebytes installed now (licensed copy!). I'll make sure it is updated and I'll run a full scan again to make sure, but I'm reasonably confident this is prior-infection damage.

 

[TalbotM]

Malwarebytes Scan is clean.

 

[NoelDP]

OK - Looking through the logs again, I noticed something I didn't see before...

2014-03-25 05:03:28, Info                  CSI    00000004 No store version format found; DLL store format 0.0.0.6
2014-03-25 05:03:28, Error                 CSI    [EMAIL="00000005@2014/3/25:10:03:28.468"]00000005@2014/3/25:10:03:28.468[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\componentstore\storelayout.cpp(6636): Error STATUS_SXS_COMPONENT_STORE_CORRUPT originated in function ComponentStore::CRawStoreLayout::OpenCanonicalDataKey expression: (null)
[gle=0x80004005]
2014-03-25 05:03:28, Info                  CBS    NonStart: Failed to get store. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2014-03-25 05:03:28, Info                  CBS    Failed to ensure no startup processing was required. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2014-03-25 05:03:28, Info                  CBS    Failed during startup processing, continuing with Trusted Installer execution [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]

I think I'd better take a close look at your COMPONENTS registry hive.

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

If the file won't copy (saying file in use), reboot to Safe Mode, and try there - it may be too damaged to complete loading.

 

[TalbotM]

Remember that the COMPONENTS file was fubar, and I restored it from a prior image (albeit an old one).
So, what you're looking at in that log file is stale and no longer applies. If you will want it knowing that, I'm happy to make it available.

After that restore, a LOT of things that were broken started working, but it isn't 100% yet.
The key things were:

SFC gets to about 54% now instead of "Bzzt, I can't run."
SURT doesn't bail out on store corruption complaints
The Add/Remove Windows Programs (what started me on this odyssey) is no longer a blank screen.
​

 

[NoelDP]

Ooops! - good point.

Please run a new SFC and CheckSUR and we'll take a look at the entire CBS folder afterwards - it'll give us some detailed info.

 

[TalbotM]

FWIW, SFC stopped at the 54% mark...
Updated ZIP at... http://1drv.ms/1rEB9lN

 

[dlc41]

If you have the Windows disk you can try running SGC from there.

Boot from the DVD.
Click on Repair
Under advance options click on Command Prompt.
Type in:
sfc /scannow /offbootdir=<drive>:\ /offwindir=<drive>:\windows

Drive letter should be either C: or D:. You can do a DIR C: or DIR D: to finout which has the windows folder

May also want to run a chkdsk from here.

 

[TalbotM]

Chkdsk is 100% clean. I did a complete boot-time check on that yesterday. (Also it is SSD, so I'm waiting to see what failures are going to look like in solid state in the future)

I will build a DVD from the Volume License media and try that. I'm thinking I'm going to have to fix that symbolically linked file that's referenced as a folder before making substantial progress. Seen in Noel's post above.