Windows 7 Pro x86, constantly de-regestering itself

SkrumpyJax · Mar 7, 2013

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc002001b
Windows Product Key: *****-*****-JW6W3-RHH8B-DY2T4
Windows Product Key Hash: kVEtlTjyRvVl6nCMhy78CAl9ghI=
Windows Product ID: 00371-220-3620136-86822
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {8E580F9E-59F8-4C86-95A3-6E54C1C9D095}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{8E580F9E-59F8-4C86-95A3-6E54C1C9D095}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DY2T4</PKey><PID>00371-220-3620136-86822</PID><PIDType>5</PIDType><SID>S-1-5-21-1113955543-3317005351-503478103</SID><SYSTEM/><BIOS/><HWID>68A13407018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>8ABE66D1AD36EC0</Val><Hash>RjTUlRFd4/Lq0jkHxrTRZNYjgI0=</Hash><Pid>89396-864-9221007-65728</Pid><PidType>8</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426 
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 3:6:2013 18:54
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc

HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAAABAAAAAgABAAEAJJRud+ggSOSqdoCfzAbEzz5mIiNq01A9KoU=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   041009  APIC1733
  FACP   041009  FACP1733
  MCFG   041009  OEMMCFG 
  OEMB   041009  OEMB1733
  GSCI   041009  GMCHSCI 
  SSDT   DpgPmm  CpuPm

This PC is constantly de-regestering itself, have tried alternate freshly generated keys from MSDN account, re-installed to a different HDD.
I am now at the end of my knowledge and seek help please.

NoelDP · Mar 7, 2013

You have a VERY rare error -
Cached Online Validation Code: N/A, hr = 0xc002001b

... and a service tamper
Tampered Service: sppsvc

Please open an Elevated (Administrator) Command Prompt window and use the following commands....

net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc

Copy and paste the output to your reply

Here are some instructions to make life easier

1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

(I'm asking a moderator to split this thread so it gets the attention it deserves.)

SkrumpyJax · Mar 7, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>net start sppsvc
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>sc qc sppsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: sppsvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\system32\sppsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Software Protection
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>sc queryex sppsvc

SERVICE_NAME: sppsvc
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 752
        FLAGS              :

C:\Windows\system32>sc qprivs sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
        PRIVILEGES       : SeAuditPrivilege
                         : SeChangeNotifyPrivilege
                         : SeCreateGlobalPrivilege
                         : SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE:  UNRESTRICTED

C:\Windows\system32>sc sdshow sppsvc

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\Windows\system32>

SkrumpyJax · Mar 7, 2013

Thanks for the help so far and in advance.

NoelDP · Mar 7, 2013

Odd - that's all perfectly normal.
I wonder if it's a SubKey in the registry, or a new Value?

Please run the following commands and post the results

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SPPSVC /s
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC

SkrumpyJax · Mar 7, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SPPSVC /s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPPSVC
    DisplayName    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-101
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\sppsvc.exe
    Description    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-100
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    DelayedAutoStart    REG_DWORD    0x1
    Type    REG_DWORD    0x10
    DependOnService    REG_MULTI_SZ    RpcSs
    ServiceSidType    REG_DWORD    0x1
    RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPPSVC\Security
    Security    REG_BINARY    01001480A0000000AC000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
010200010100000000000504000000000014009D0102000101000000000005060000000000140014
00000001010000000000050B000000010100000000000512000000010100000000000512000000


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
    Service    REG_SZ    spldr
    Legacy    REG_DWORD    0x1
    ConfigFlags    REG_DWORD    0x400
    Class    REG_SZ    LegacyDriver
    ClassGUID    REG_SZ    {8ECC055D-047F-11D1-A537-0000F8753ED1}
    DeviceDesc    REG_SZ    Security Processor Loader Driver
    Capabilities    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
    ActiveService    REG_SZ    spldr


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLS
VC
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPP
SVC
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>

NoelDP · Mar 7, 2013

That's normal as well.
Back to basics, then

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply

Post a new MGADiag report with details of any error messages encountered.

SkrumpyJax · Mar 8, 2013

When I've run SFC /scannow on this pc in an elevated cmd prompt previously it's given a windows protection error.
There was only so much I could do on RDP last night and the chkdsk must have error'd as the pc didn't come back online. I will try and get round there over the weekend and see what went wrong.
Thanks for the help so far!

SkrumpyJax · Mar 11, 2013

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JW6W3-RHH8B-DY2T4
Windows Product Key Hash: kVEtlTjyRvVl6nCMhy78CAl9ghI=
Windows Product ID: 00371-220-3620136-86822
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {8E580F9E-59F8-4C86-95A3-6E54C1C9D095}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\WineCellar\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{8E580F9E-59F8-4C86-95A3-6E54C1C9D095}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DY2T4</PKey><PID>00371-220-3620136-86822</PID><PIDType>5</PIDType><SID>S-1-5-21-1113955543-3317005351-503478103</SID><SYSTEM><Manufacturer>BIOSTAR Group</Manufacturer><Model>G31-M7 TE</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>080014 </Version><SMBIOSVersion major="2" minor="5"/><Date>20090410000000.000000+000</Date></BIOS><HWID>68A13407018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>8ABE66D1AD36EC0</Val><Hash>RjTUlRFd4/Lq0jkHxrTRZNYjgI0=</Hash><Pid>89396-864-9221007-65728</Pid><PidType>8</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 770bc271-8dc1-467d-b574-73cbacbeccd1
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00172-220-362013-00-2057-7601.0000-0662013
Installation ID: 010436807745340052020934108910242202151016895816377255
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: DY2T4
License Status: Notification
Notification Reason: 0xC004F009 (grace time expired).
Remaining Windows rearm count: 4
Trusted time: 11/03/2013 19:13:57

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004C532
HealthStatus: 0x0000000000000000
Event Time Stamp: 3:8:2013 09:53
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAAABAAAAAgABAAEAJJRud+ggSOSqdoCfzAbEzz5mIiNq01A9KoU=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			041009		APIC1733
  FACP			041009		FACP1733
  MCFG			041009		OEMMCFG 
  OEMB			041009		OEMB1733
  GSCI			041009		GMCHSCI 
  SSDT			DpgPmm		CpuPm

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Windows Resource Protection could not perform the requested operation.

C:\Windows\system32>

NoelDP · Mar 11, 2013

The installed Key is an MSDN license - I trust that the user is a member of MSDN/TechNet?? (otherwise the license is counterfeit, and cannot be activated)

There are a lot of errors in the CBS.log - here's the list from yesterday alone.....

Code:

Line 83281: 2013-03-10 09:37:36, Error                 CSI    00000005 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83282: 2013-03-10 09:37:36, Error                 CSI    00000006@2013/3/10:09:37:36.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83284: 2013-03-10 09:37:36, Error                 CSI    00000007 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #81315# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83301: 2013-03-10 09:37:38, Error                 CSI    00000009 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83302: 2013-03-10 09:37:38, Error                 CSI    0000000a@2013/3/10:09:37:38.475 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83304: 2013-03-10 09:37:39, Error                 CSI    0000000b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #162658# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83327: 2013-03-10 09:38:01, Error                 CSI    0000000d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83328: 2013-03-10 09:38:01, Error                 CSI    0000000e@2013/3/10:09:38:01.225 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83330: 2013-03-10 09:38:01, Error                 CSI    0000000f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #244002# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83353: 2013-03-10 09:38:23, Error                 CSI    00000011 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83354: 2013-03-10 09:38:23, Error                 CSI    00000012@2013/3/10:09:38:23.459 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83356: 2013-03-10 09:38:23, Error                 CSI    00000013 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #325346# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83379: 2013-03-10 09:38:46, Error                 CSI    00000015 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83380: 2013-03-10 09:38:46, Error                 CSI    00000016@2013/3/10:09:38:46.053 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83382: 2013-03-10 09:38:46, Error                 CSI    00000017 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #406690# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83405: 2013-03-10 09:39:10, Error                 CSI    00000019 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83406: 2013-03-10 09:39:10, Error                 CSI    0000001a@2013/3/10:09:39:10.850 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83408: 2013-03-10 09:39:11, Error                 CSI    0000001b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #488034# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83431: 2013-03-10 09:39:35, Error                 CSI    0000001d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83432: 2013-03-10 09:39:35, Error                 CSI    0000001e@2013/3/10:09:39:35.709 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83434: 2013-03-10 09:39:36, Error                 CSI    0000001f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #569378# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83457: 2013-03-10 09:39:58, Error                 CSI    00000021 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83458: 2013-03-10 09:39:58, Error                 CSI    00000022@2013/3/10:09:39:58.834 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83460: 2013-03-10 09:39:59, Error                 CSI    00000023 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #650722# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83483: 2013-03-10 09:40:23, Error                 CSI    00000025 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83484: 2013-03-10 09:40:23, Error                 CSI    00000026@2013/3/10:09:40:23.788 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83486: 2013-03-10 09:40:24, Error                 CSI    00000027 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #732066# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83501: 2013-03-10 09:50:26, Error                 CSI    00000029 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83502: 2013-03-10 09:50:26, Error                 CSI    0000002a@2013/3/10:09:50:26.676 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83504: 2013-03-10 09:50:27, Error                 CSI    0000002b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #813399# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83533: 2013-03-10 10:56:41, Error                 CSI    00000005 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83534: 2013-03-10 10:56:41, Error                 CSI    00000006@2013/3/10:10:56:41.897 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83536: 2013-03-10 10:56:42, Error                 CSI    00000007 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #81315# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83553: 2013-03-10 10:56:44, Error                 CSI    00000009 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83554: 2013-03-10 10:56:44, Error                 CSI    0000000a@2013/3/10:10:56:44.256 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83556: 2013-03-10 10:56:44, Error                 CSI    0000000b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #162658# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83579: 2013-03-10 10:57:08, Error                 CSI    0000000d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83580: 2013-03-10 10:57:08, Error                 CSI    0000000e@2013/3/10:10:57:08.741 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83582: 2013-03-10 10:57:09, Error                 CSI    0000000f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #244002# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83605: 2013-03-10 10:57:31, Error                 CSI    00000011 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83606: 2013-03-10 10:57:31, Error                 CSI    00000012@2013/3/10:10:57:31.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83608: 2013-03-10 10:57:31, Error                 CSI    00000013 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #325346# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83631: 2013-03-10 10:57:53, Error                 CSI    00000015 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83632: 2013-03-10 10:57:53, Error                 CSI    00000016@2013/3/10:10:57:53.366 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83634: 2013-03-10 10:57:53, Error                 CSI    00000017 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #406690# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83657: 2013-03-10 10:58:23, Error                 CSI    00000019 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83658: 2013-03-10 10:58:23, Error                 CSI    0000001a@2013/3/10:10:58:23.069 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83660: 2013-03-10 10:58:23, Error                 CSI    0000001b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #488034# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83683: 2013-03-10 10:58:47, Error                 CSI    0000001d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83684: 2013-03-10 10:58:47, Error                 CSI    0000001e@2013/3/10:10:58:47.022 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83686: 2013-03-10 10:58:47, Error                 CSI    0000001f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #569378# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83709: 2013-03-10 10:59:11, Error                 CSI    00000021 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83710: 2013-03-10 10:59:11, Error                 CSI    00000022@2013/3/10:10:59:11.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83712: 2013-03-10 10:59:11, Error                 CSI    00000023 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #650722# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83735: 2013-03-10 10:59:34, Error                 CSI    00000025 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83736: 2013-03-10 10:59:34, Error                 CSI    00000026@2013/3/10:10:59:34.772 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83738: 2013-03-10 10:59:35, Error                 CSI    00000027 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #732066# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83753: 2013-03-10 11:09:37, Error                 CSI    00000029 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83754: 2013-03-10 11:09:37, Error                 CSI    0000002a@2013/3/10:11:09:37.428 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83756: 2013-03-10 11:09:37, Error                 CSI    0000002b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #813399# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")

Analysis to follow

NoelDP · Mar 11, 2013

The problem appears to relate to a malformed Registry Key.

It may (or may not) be reparable by use of the CheckSUR tool -

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

I *think* all the errors relate to the same problem - the Identity value data at
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_8bc63dac42e4eabaca3593ddd2f5d84d_b03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb

Let's see if CheckSUR agrees with me before I attempt to do anything

SkrumpyJax · Mar 11, 2013

SkrumpyJax said:
This PC is constantly de-regestering itself, have tried alternate freshly generated keys from MSDN account, re-installed to a different HDD.

Indeed it is a key from an MSDN account, this machine was built for working from home with a Bizspark key.
I thought that as the companies Bizspark account had since expired that the key may have been the issue.
If it causes issues I can put the original key back on.

NoelDP · Mar 11, 2013

Nope - it shouldn't be a problem, although since we started the thread (and since the abortive CHKDSK), the MGADiag error has changed (for the better) to indicating that the grace period has expired, which in turn means that the installation may require telephone activation.

A look at the CHKDSK log may be a good idea - it obviously achieved something fairly major (I haven't delved that far back in the CBS log yet, except to see that the registry error was present as far back as December)

You'll find the log as a Wininit even in the Application section of the Windows logs in Event Viewer - you may want to copy/paste the log to a reply.

SkrumpyJax · Mar 11, 2013

Code:

CHKDSK is verifying files (stage 1 of 5)...
  156928 file records processed.                                          File verification completed.
  264 large file records processed.                                      0 bad file records processed.                                        2 EA records processed.                                              124 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
Deleted invalid filename PFD22~1.CAT (134871) in directory 1330.
The DOS file name attribute in file 0x20ed7 is incorrect.
50 00 01 00 46 00 44 00 32 00 32 00 7e 00 31 00  P...F.D.2.2.~.1.
2e 00 43 00 41 00 54 00 68 00 74 00 6d 00 1a d2  ..C.A.T.h.t.m...
c3 73 ff ff 00 80 1c 00 00 a0 54 00 00 00 00 00  .s........T.....
There is no DOS file name attribute in file 0x20ed7.
Correcting minor file name errors in file 134871.
Unable to locate the file name attribute of index entry package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat
of index $I30 with parent 0x532 in file 0x20ed7.
Deleting index entry package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat in index $I30 of file 1330.
Unable to locate the file name attribute of index entry PAFD22~1.CAT
of index $I30 with parent 0x532 in file 0x20ed7.
Deleting index entry PAFD22~1.CAT in index $I30 of file 1330.
  197620 index entries processed.                                         Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
  1 unindexed files scanned.                                         Recovering orphaned file package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat (134871) into directory file 1330.
  0 unindexed files recovered.                                       CHKDSK is verifying security descriptors (stage 3 of 5)...
  156928 file SDs/SIDs processed.                                         Cleaning up 29 unused index entries from index $SII of file 0x9.
Cleaning up 29 unused index entries from index $SDH of file 0x9.
Cleaning up 29 unused security descriptors.
Security descriptor verification completed.
  20347 data files processed.                                            CHKDSK is verifying Usn Journal...
  36924896 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  156912 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  108355230 free clusters processed.                                         Free space verification is complete.
Windows has made corrections to the file system.

 488383487 KB total disk space.
  54596268 KB in 130377 files.
     88836 KB in 20348 indexes.
         0 KB in bad sectors.
    277463 KB in use by the system.
     65536 KB occupied by the log file.
 433420920 KB available on disk.

      4096 bytes in each allocation unit.
 122095871 total allocation units on disk.
 108355230 allocation units available on disk.

Internal Info:
00 65 02 00 d0 4c 02 00 99 4e 04 00 00 00 00 00  .e...L...N......
e7 0e 00 00 7c 00 00 00 00 00 00 00 00 00 00 00  ....|...........
90 8c 24 00 50 01 23 00 b8 18 23 00 00 00 23 00  ..$.P.#...#...#.

Windows has finished checking your disk.

NoelDP · Mar 11, 2013

That was quick!!

The critical things to note are in the Summary

Code:

Summary:
Seconds executed: 448
 Found 110 errors
 Fixed 102 errors
  CSI Could Not Open file Total count: 1
  CSI Manifest and S256H Do Not Match Total count: 1
  CSI Corrupt Component Keyform Total count: 4
  CSI Corrupt Identity Total count: 4
  Fixed: CSI Corrupt Identity.  Total count: 3
  CSI Located Replacement: Invalid (S256H) Total count: 5
  CSI Replacement File: CreateFile Failed Total count: 9
  CSI Missing Winning Component Key Total count: 1
Unavailable repair files:
 winsxs\manifests\x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5.manifest
 winsxs\manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest

I think it would be useful (at least for me!) to run the tool again - it may even find it can repair a few more things.
Please post both the CheckSUR.log and CheckSUR.Persist.log files this time.

NoelDP · Mar 11, 2013

Going a little deeper into the log, the following errors show...

Code:

Line 167: (f) CSI Corrupt Identity 0xC0150017 8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, [B]PublicKeyToke.=[/B]b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS x86_8bc63dac42e4eabaca3593ddd2f5d84[B]db[/B]03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb Bad identity
 Line 167: (f) CSI Corrupt Identity 0xC0150017 8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS x86_8bc63dac42e4eabaca3593ddd2f5d84[B]db[/B]03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb Bad identity
 Line 168: (f) CSI Could Not Open file 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84[B]db[/B]03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb 
 Line 168: (f) CSI Could Not Open file 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84[B]db[/B]03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb 
 Line 169: (w) CSI Replacement File: CreateFile Failed 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84[B]db[/B]03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb

What doesn't show there is that there's an unprintable Unicode character in the reuired filenames, as a result of an error in the registry key --

I think we'll have to fix that by hand.

SkrumpyJax · Mar 11, 2013

Here's both logs, this PC has been the bane of my life since I built it.

Most of the time it's been user error, but this de-registering is something I've never seen before. Do you think this could be caused by the install media, or a failed update, as I swapped the hdd after it first happened and re-installed.
Maybe it was a different issue altogether.

NoelDP · Mar 11, 2013

I'll give my thought on causes later

The log is a lot easier to read now - and my analysis was basically confirmed.
The remaining errors (with one exception) are all registry entries

Code:

Checking Component Store
(f) CSI Manifest and S256H Do Not Match 0x00000000 winsxs\Manifests\x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5.manifest x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5 
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_disk.inf.resourc%s_31bf3856ad364e35_6.1.7600.16385_en-us_064cf8c54506586b identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_microsoft-windows-setup_31bf3856ad364e356.1.7600.16385_none_621709e2d6cc986a identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_networking-mpssvc_31bf3856ad364e35_6.1.7601.17514_none_0#80f0c5176cbb85 identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_server-help-chm.applocker_help_31bf3856ad364e35_6.1.7600.16385_n/ne_70c476b7028fa28d identity and keyform do not match; keyform is wrong.
(f) CSI Missing Winning Component Key 0x00000000 x86_microsoft-windows-ie-versioninfo_31bf3856ad364e35_9.4.8112.16455_none_1789134b4f552973

(that's after removing the one really bad entry that we already knew about

)

The question is how best to deal with it, since you're on a remote link.

What I really need is a copy of the COMPONENTS registry hive - which luckily is normally unloaded, so accessible at C:\Windows\System32\config\COMPONENTS (no extension)

You'll need to zip it and upload it to a fileshare site (SkyDrive or DropBox are ideal) and post a link - it will almost certainly exceed the forum's file size limits.

It'll take me a while to sort it out (if I can!) - probably until tomorrow evening. Please ensure that updates are prevented/prohibited until after I get back with the new hive!

In the meantime, you should be able to fix the missing manifest file without any resulting problems

I'll post a fix protocol for that in a few minutes.

SkrumpyJax · Mar 11, 2013

I'll have to have a look tomorrow as I need to get my kids home to bed, thanks for the exceedingly good help so far.

NoelDP · Mar 11, 2013

I've uploaded a file - sjxaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder sjxaa in the same place.
Open this folder - there should be one folder inside it (Manifests,)

Copy the content of the manifests folder (.manifest files) into this folder:

C:\Windows\Temp\CheckSur\Winsxs\Manifests

Now run the CheckSUR tool again

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

As far as causes are concerned -
I always tend to suspect RAM problems rather than anything else where registry entries are concerned. I have no real proof either way. Check RAM using MemTest86++ (get someone to run it before they clock off and then report the results when they get back in the morning!)

If the disk had shown any bad sectors, then I would have been tempted to blame that - but the CHKDSK is clear (which is NOT to say that the disk is perfectly fine, as it has many hidden available replacement sectors that the OS never sees or knows about - assuming this is a normal spindle?)
Check in the Event Viewer and make sure that there are no disk-related errors present.

Installation media? - try checking it with ISOBuster (the free version will do a nice job if you don't already have a paid copy). If installing from a network, then presumably it's an ISO file, so check the Hash against the expected values.

Windows 7 Pro x86, constantly de-regestering itself

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

New member

My Computer My Computer

Three-Toed Sloth

My Computer My Computer

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer