Windows 7 Errors and Update Download Problems-Second Attempt

[Len]

Hello, I seem to be getting a lot of errors in Windows 7. I click on something within Windows like Firewall or to adjust the screen brightness and something pops up indicating that Windows can not find something or other. Or nothing pops up at all and I just just click futilely and nothing happens. Also I have not been getting any Windows Updates recently. I think the two problems might be related. I've run virus checks and nothing shows up. Searched a little about this and it seems either that programs are locked or certain values are missing in the registry. Don't really know what that means. Another site said something about "Windows Can Not Find" errors. Well, thanks for any help you could provide. Okay, I'm pretty hapless with this stuff but I was able to do a couple of things. I could not run the SURT; for some reason it wouldn't install. And I couldn't find any Update Error Codes; because there aren't any. They are not downloading so no errors are being registered it seems. I did the SFC Scan and the Log Collection thing and have attached those. Hope it helps.

 

[NoelDP]

Please post the C:\Windows\windowsupdate.log file
also
Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

 

[Len]

Okay, I can not open the Event Viewer. I get a message that says MMC can not open the file C:\Windows\system32\eventvwr.msc. It says the file may not exist or I may not have sufficient access rights to the file. I think I'm able to post the update log file. Thanks.

 

[NoelDP]

Hmm...

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[Len]

Farbar Service Scanner Version: 17-01-2015
Ran by Administrator (administrator) on 29-01-2015 at 11:11:39
Running from "C:\Users\Administrator\Documents"
Microsoft Windows 7 Starter Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcore.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

 

[NoelDP]

That looks OK.
Please open an Elevated Command Prompt, and run the following commands

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\EventLog /S >>"%userprofile%\desktop\reglog.txt"
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\Wecsvc /S >>"%userprofile%\desktop\reglog.txt"


They should create a file on your desktop - reglog.txt - please upload that file to your reply.

 

[Len]

Okay, I got something. I got an ERROR message that indicated that the system was unable to find the specified registry key or value. On both commands. I don't what that means but it seems like I've seen that ERROR message before. Thanks again.

 

[NoelDP]

Hmmm - maybe we need to be looking deeper? (I was fairly certain that Farbar actually checked one of these services - but maybe I was mistaken)

In the meantime, run these commands, and post the results...

SC QC WECSVC
SC QC EVENTLOG

 

[Len]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Administrator>SC QC WECSVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WECSVC
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k NetworkService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Event Collector
DEPENDENCIES : HTTP
: Eventlog
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Users\Administrator>SC QC EVENTLOG
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EVENTLOG
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\System32\svchost.exe -k LocalServiceNetw
orkRestricted
LOAD_ORDER_GROUP : Event Log
TAG : 0
DISPLAY_NAME : Windows Event Log
DEPENDENCIES :
SERVICE_START_NAME : NT AUTHORITY\LocalService

I hope I did this right.

 

[NoelDP]

They look normal enough - I wonder why the earlier commands failed?
Please try them again, using copy/paste...

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\EventLog /S >>"%userprofile%\desktop\reglog.txt"
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\Wecsvc /S >>"%userprofile%\desktop\reglog.txt"



Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[Len]

Ok, I think I got some results that I put in this attachment. Don't know what it means or if I did the right thing. But it looks like something.

 

[Len]

Any ideas left?

 

[NoelDP]

The output from the log is normal, as far as I can tell - I'm scratching around now, trying to think of a way to avoid a repair install.