Updates loop, SFC won't run, SURT doesn't work, Can't System Restore

[NoelDP]

SFC run from a Repair boot will not fix problems where the SFC in normal boot has successfully started.

CheckSUR shows (amongst others)

Unavailable repair files:
 winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_88dcc0bf2fb1b808.manifest
 winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_09bd717ffacfdd51.manifest

SFC shows

2014-06-03 11:55:40, Info                  CSI    0000022a [SR] Beginning Verify and Repair transaction
2014-06-03 11:55:40, Error                 CSI    0000022b (F) STATUS_FILE_IS_A_DIRECTORY #5003669# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowFileNotFound|AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_READ_DATA), oa = @0xcfcf80->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[131]"\SystemRoot\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xcfd030, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd00000ba]
2014-06-03 11:55:40, Error                 CSI    [EMAIL="0000022c@2014/6/3:16:55:40.153"]0000022c@2014/6/3:16:55:40.153[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error STATUS_FILE_IS_A_DIRECTORY originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2014-06-03 11:55:40, Error                 CSI    0000022d (F) STATUS_FILE_IS_A_DIRECTORY #5003668# from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingFile(...)[gle=0xd00000ba]
2014-06-03 11:55:40, Error                 CSI    0000022e (F) STATUS_FILE_IS_A_DIRECTORY #5003667# from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingFile(flags = (MissingFileIsOk|SharingViolationIsOk|AccessDeniedIsOk), da = (SYNCHRONIZE|FILE_READ_DATA), oa = @0xcfd628->SIL_OBJECT_ATTRIBUTES {s:40; on:"MpEvMsg.dll"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE), file = NULL, disp = Invalid)

This is typically a ZeroAccess problem - but since you've run MBAM, we'll assume that it's residuals only.

Please open an Elevated Command Prompt, and run the following command

DIR C:\ /AL /S >>%userprofile%\desktop\npal.txt

this will create a file on your desktop - npal.txt - please compress it and upload it to your reply.

 

[TalbotM]

Attached.

 

[NoelDP]

Here's the critical problem from that output...

 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
               7 File(s)      1,907,712 bytes
 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.17316_none_b3fe3b6771a68ecd
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
               7 File(s)      1,907,712 bytes
 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.21531_none_b46d38ce8ad8e4ed
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
               7 File(s)      1,907,712 bytes
 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
11/20/2010  08:27 AM    <SYMLINK>      MsMpCom.dll [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
               8 File(s)      1,968,640 bytes
 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.18170_none_b59db7296f030a55
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
05/27/2013  12:50 AM    <SYMLINK>      MpClient.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
05/27/2013  12:50 AM    <SYMLINK>      MpCommu.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
05/27/2013  12:50 AM    <SYMLINK>      MpSvc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
11/20/2010  08:27 AM    <SYMLINK>      MsMpCom.dll [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
              11 File(s)      3,867,136 bytes
 Directory of C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.22341_none_b648c5e888076cca
07/13/2009  08:41 PM    <SYMLINK>      MpAsDesc.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MpCmdRun.exe [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpOAV.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MpRTP.dll [c:\windows\system32\config]
07/13/2009  08:39 PM    <SYMLINK>      MSASCui.exe [c:\windows\system32\config]
11/20/2010  08:27 AM    <SYMLINK>      MsMpCom.dll [c:\windows\system32\config]
07/13/2009  08:29 PM    <SYMLINK>      MsMpLics.dll [c:\windows\system32\config]
07/13/2009  08:41 PM    <SYMLINK>      MsMpRes.dll [c:\windows\system32\config]
               8 File(s)      1,968,640 bytes

I'll see what I can do about producing a specific fix protocol for them. - it may take a day or two.

 

[TalbotM]

Thanks. I take it that NONE of that stuff should be symbolically linked to anything. Just regular files.

 

[TalbotM]

Not to try to interrupt your process, but what if I deleted those 6 folders and put replacements in the C:\Windows\Temp\CheckSUR\winsxs folder? Assuming I have replacments, of course.

 

[NoelDP]

That's correct - the trick is to delete the symlinks without disturbing the rest of the filesystem.

It means taking ownership and then attempting to delete the files individually. My limited experience tells me that using wildcard deletes doesn't work.

 

[NoelDP]

I can provide the appropriate replacement files (I have almost every file ever issued for win7), so worry not

 

[TalbotM]

Understood.
I have no problem procedurally doing that.
And it is few enough that I don't care about wildcards. I'll change ownership on them individually if that's what it takes. Still beats the pants off of a clean reinstall.

 

[NoelDP]

If you're happy to go for it - here's the short version

1) take ownership of each identified folder- recurse down the branch
2) Give the Administrators group Full permissions for all folders and then recurse the permissions down
3) delete each file individually. (DEL)
4) then delete the folders involved. (RD /S)
5) run the command in post #21 again and post the results - then run CheckSUR and SFC again, and post the new logs.

 

[TalbotM]

That wasn't so bad.
SFC still dumps out at 54%.
Same OneDrive link: http://1drv.ms/1rEB9lN

 

[NoelDP]

CheckSUR has found the following files missing - which we'd normally have SFC find/fix

 Line 19: (f) CSI Payload File Missing 0x00000000 msvcr80.dll amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2 
 Line 20: (f) CSI Payload File Missing 0x00000000 msvcp80.dll amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2 
 Line 21: (f) CSI Payload File Missing 0x00000000 msvcm80.dll amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2 
 Line 22: (f) CSI Payload File Missing 0x00000000 msvcr90.dll amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4 
 Line 23: (f) CSI Payload File Missing 0x00000000 msvcp90.dll amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4 
 Line 24: (f) CSI Payload File Missing 0x00000000 msvcm90.dll amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4 
 Line 26: (f) CSI Payload File Missing 0x00000000 MsMpRes.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 29: (f) CSI Payload File Missing 0x00000000 MpRTP.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 30: (f) CSI Payload File Missing 0x00000000 MpClient.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 31: (f) CSI Payload File Missing 0x00000000 MpCmdRun.exe amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 32: (f) CSI Payload File Missing 0x00000000 MpAsDesc.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 33: (f) CSI Payload File Missing 0x00000000 MpSvc.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 34: (f) CSI Payload File Missing 0x00000000 MsMpCom.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 35: (f) CSI Payload File Missing 0x00000000 MsMpLics.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 36: (f) CSI Payload File Missing 0x00000000 MSASCui.exe amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 37: (f) CSI Payload File Missing 0x00000000 MpCommu.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 38: (f) CSI Payload File Missing 0x00000000 MpOAV.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306 
 Line 39: (f) CSI Payload File Missing 0x00000000 MpEvMsg.dll amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea 
 Line 43: (f) CSI Payload File Missing 0x00000000 MsMpRes.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 46: (f) CSI Payload File Missing 0x00000000 MpRTP.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 47: (f) CSI Payload File Missing 0x00000000 MpClient.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 48: (f) CSI Payload File Missing 0x00000000 MpCmdRun.exe amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 49: (f) CSI Payload File Missing 0x00000000 MpAsDesc.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 50: (f) CSI Payload File Missing 0x00000000 MpSvc.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 51: (f) CSI Payload File Missing 0x00000000 MsMpCom.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 52: (f) CSI Payload File Missing 0x00000000 MsMpLics.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 53: (f) CSI Payload File Missing 0x00000000 MSASCui.exe amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 54: (f) CSI Payload File Missing 0x00000000 MpCommu.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c 
 Line 55: (f) CSI Payload File Missing 0x00000000 MpOAV.dll amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c

It's also found the following missing files which we'll use it to fix.

Unavailable repair files:
 winsxs\manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_88dcc0bf2fb1b808.manifest
 winsxs\manifests\amd64_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_09bd717ffacfdd51.manifest

I'll post the SFC files first - with luck, they'll allow an SFC scan to complete properly.

back soon!

 

[NoelDP]

I've uploaded a file - tbmaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\tbmaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\tbmaa
or
DIR E:\tbmaa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\tbmaa <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[TalbotM]

I'm having a helluva time getting into an environment that will allow me to copy those files.
The repair my computer option has some strange issue. Any other attempt (DVD boot) results in 0 files copied by XCOPY. Still working...

 

[TalbotM]

Wooo HOOOOO! SFC completed. Log attached.

 

[TalbotM]

Last SURT run:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 25.0
2014-06-03 21:51
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 136
No errors detected

 

[NoelDP]

Odd that the manifest errors in CheckSUR have disappeared - I didn't do anything with them?

SFC managed to find and fix one more problem...

 Line 10763: 2014-06-03 21:58:16, Info                  CSI    000003e3 [SR] Repairing 1 components
 Line 10764: 2014-06-03 21:58:16, Info                  CSI    000003e4 [SR] Beginning Verify and Repair transaction
 Line 10767: 2014-06-03 21:58:16, Info                  CSI    000003e6 [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store

Still - CheckSUR and SFC are now clear, so with any luck the updates will now install properly.

 

[TalbotM]

While you were at the pub, I was still working on the issue some from this end. I was able to find the manifests on another system and move them over. So I updated the last 2 posts of mine as I went along.
Sorry for not making that clear. I didn't start out to do that, it just kinda evolved.

I still can't get updates to run now, thought the symptom has changed. Originally I had two in perpetuity that appeared to install, but never did. Now that things are more fixed, I have 27 updates, but none will install - because of an assortment of errrors, depending on what I try.

Most commonly I get 8007371B and 80073701.

There are far, far fewer errors in Application event log pertaining to windows error reporting. Here are a couple of interest:

Fault bucket , type 0
Event Name: CbsPackageServicingFailure2
Response: Not available
Cab Id: 0
Problem signature:
P1: 6.1.7601.17592
P2: Package_for_KB2574819
P3: 6.1.2.0
P4: amd64
P5: unknown
P6: 80073701
P7: Resolve
P8: Absent
P9: Staged
P10: WindowsUpdateAgent

Fault bucket , type 0
Event Name: WindowsWcpOtherFailure3
Response: Not available
Cab Id: 0
Problem signature:
P1: 6.1.7601
P2: base\wcp\componentstore\csd_locking.cpp
P3: CCSDirectTransaction::LockComponent
P4: 324
P5: c015000c
P6: 0xe3d24231
P7:
P8:
P9:
P10:

 

[NoelDP]

OK - please find the oldest of the currently-offered updates, and attempt to install ONLY that one.
Which one is it? - and what error message do you get?

 

[dlc41]

Actually wasn't at the pub LOL

I've had a few customer computers with this issue.

Download the Windows Repair. Run all steps, minus the malware checks. When you do the repair make sure all boxes are check with the exception on Windows 8 items. Restart the computer and try your updates again.

Tweaking.com

 

[TalbotM]

7 of 27 were dated 10/8/2013. So I picked one. Got 8007371b. It was KB2861698.
Another attempt got 80246007 (same date, but KB2847311)