Windows 7 update error 80246008 - since 08/13/2015

[scottie916]

NoeIDP...

Sorry to have such an "uncorrupted" laptop (LOL)...

As long as you are willing to keep with it, I will continue to follow your directions.

============================
So....

What about the CFRMD item that is only visible in the Comodo System Utilities?
Should I [ Stop ] [ Unregister ] [ Remove ]???
Reboot??

AND....

What about uninstalling the Comodo Systems Utility?
Should I uninstall using the Windows Add/Remove programs??
Reboot???

Neither of these items have been done, yet.

 

[NoelDP]

Yes - please uninstall all things COmodo, using the Control Panel entries first unfortunately it looks as if we'll then have to go in and delete the remaining entries in the registry manually

 

[scottie916]

NoeIDP,

Before I uninstall Comodo System Utilities, I wanted to pass along the following items found in its "Autorun Manager" >> Services...

This is a LONG reply message to you..... (sorry)

CLPSLauncher - Comodo - v4.0 - STOPPED
PCCUJobMgr - Symantec - v109.0.0.107 - Automatic/STARTED
Norton PC Checkup Application Launcher - Symantec - v1.0.0.41 - STOPPED
PDEngine - Raxco - v14.0.865.0 - Automatic/STARTED
CSUService - Comodo - v1,0,0,1 - Automatic/STARTED
PDAgent - Raxco - v14.0.865.0 - Automatic/STARTED

And I have a "TON" of STOPPED (Manual/Stopped) Microsoft Services - I send these in the event there could be 1 or more "off" that should be on to make BITS work?!?

If you can review some/all of these and let me know, since the Comodo System Utilities is the "only" thing I have that will allow me to try and start / stop / uninstall / remove services:

ose
chvsvc
sftlist
sftvsa
osppsvc
wlidsvc
WMPNetworkSvc
ehRecvr
ehSched
clr_optimization_v2.0.50727_64
idsvc
FontCache3.0.0.0
aspnet_state
clr_optimization_v4.0.30319_64
NetMsmqActivator
NetPipeActivator
NetTcpActivator
NetTcpPortSharing
clr_optimization_v2.0.50727_32
clr_optimization_v4.0.30319_64
ALG
COMSysApp
Fax
IEEtwCollectorService
RpcLocator
Netlogon
ProtectedStorage
VaultSvc
msiserver
Wsearch
SNMPTRAP
sppsvc
AppIDSvc
AxInstSV
BDESVC
BITS (of course)
bthserv
CertPropSvc
defragsvc
dot3svc
hidserv
hkmsvc
IPBusEnum
KtmRm
lltdsvc
Mcx2Svc
MSiSCSI
napagent
pla
PNRPAutoReg
QWAVE
RasAuto
RasMan
RemoteAccess
RemoteRegistry
ScardSvr
SCPolicySvc
seclogon
SensrSvc
SessionEnv
SharedAccess
sppuinotify
SSDPSRV
SstpSvc
stisvc
TabletInputSvc
TapiSrv
TBS
THREADORDER
upnphost
W32Time
WbioSrv
wcnsrv
WcsPlugInService
WdiSystemHost
WebClient
Wecsvc
wercplsupport
WerSvc
WinDefend
WinRM
WPCSrv
WPDBusEnum
wudfsvc
WwanSvc
swprv
UI0Detect
vds
WatAdminSvc
wbengine
PerfHost

And here are DRIVERS that are started at boot time vs. OnDemand -- plus a "TON" of things listed but are not being loaded at boot time:

DeFragFS
Msfs
NDProxy
Npfs
Ntfs
Null
secdrv
spldr
AODDriver4.3 - AMD - v4.3
CLFS
ACPI
AFD
RasAgileVpn
amd_sata
amd_xata
amdide64
AmdPPM
amdxata
APXACC - AppEx Networks Corp - v3.11.3.1
AsyncMac
atapi
AtiHDAudioService
amdkmdag
amdkmdap
avgtp (<=== lookie here !!!) - AVG Technologies - v18.1,0.2
blbdrive
bowser
cdrom
CFRMD - Microsoft WinDDK - v6.1.7600.16385 (<=== isn't this an issue, too??)
CmBatt
CNG
Compbatt
CompositeBus
DfsC
discache
Disk
DXGKrnl
ElRawDisk - EldoS Corporation - v2, 1, 26, 103
FileInfo
FltMgr
fvevol
HDAudBus
HTTP
hwpolicy
i8042prt
kbdclass
KsecDD
KsecPkg
ksthunk
lltdio
luafv
MBAMProtector - Malware Bytes
monitor
mouclass
mountmgr
MpFilter
mpsdrv
mrxsmb
mrxsmb10
mrxsmb20
msahci
msisadrv
mssmbios
Mup
NDIS
NdisTapi
Ndisuio
NdisWan
NetBIOS
NetBT
NisDrv
nsiproxy
NativeWifiP
Psched
partmgr
pci
pciide
pcw
PDFSFilter - Raxco
PEAUTH
Rasl2tp
RasPppoe
PptpMiniport
RasSstp
RawDisk3 - EldoS Corporation - v3, 1, 33, 130
rdbss
RDPCDD
RDPENCDD
RDPREFMD
rdyboost
rspndr
RTL8167 - Realtek - v7.046.0610.2011 by: WinDDK
IntcAzAudAddService - Realtek - 6.0.1.7404 by:WinDDK
RTWLanE - Realtek - v2007.12.0419.2013 by: WinDDK
srv
srv2
srvnet
swenum
SynTP - Synaptics Inc - v15.2.11.1 03Feb11
Tcpip
tcpipreg
tdcmdpst - Toshiba Inc - v2, 0, 0, 3
tdx
tunnel
TVALZ - Toshiba - v2, 0, 0, 3
TVALZFL - Toshiba - v1, 0, 0, 2
umbus
esbehci
usbhub
usbohci
vdrvroot
VgaSave
volmgr
volmgrx
volsnap
vwifibus
vwififlt
Wanarpv6
Wfd01000
WfpLwf
WmiAcpi

 

[NoelDP]

You ALWAYS have the Services.msc control which will allow you to fine-tune many services - as well as the SC registry commands.


Please get rid of the Comodo stuff, then post a new Services registry export - I'll then be able to craft a patch to remove the unwanted bits.

 

[scottie916]

NoeIDP....


Sorry to say I am to the point now of a FULL rebuild of the laptop.

I attempted to remove:

>> Comodo Internet Security (only visible in CCleaner uninstaller) - no dice "Account already exists" backed itself out of the uninstall

>> Comodo Geek Buddy (only visible in CCleaner uninstaller) - no dice "Error 1386. Account already exists" or something like that - it backed itself out of the uninstall

>> Comodo System Utilities (kept REFUSING to uninstall because CSU.EXE was running) - close the open program and try again - was not visible ANYWHERE but in Task Manager. I ended the process - then uninstalled.

** Rebooted laptop and it essentially REFUSED to reboot. After the Windows logo, it would stop booting at a black screen with the mouse pointer in the center of the screen. I could move it around.

So, I turned off / on several times - same thing.

So, I booted into the Toshiba recovery options and was finally able to restore to around 1:30pm today.

Rebooted and it did not seem like it was going to go any further and after about 20 minutes of patience - it finally let me log in but is essentially STUCK at the "circling the drain" icon Welcome screen.

If I am LUCKY enough to get it anywhere I think I will:

>> dump as much stuff as possible to DVD's
>> try and run Super Anti-Spyware & clean the laptop
>> try and run Malwarebytes & clean the laptop
>> reboot with the recover CD/DVD and just rebuild

I am sorry but I do not see any other options... that Comodo SHIT with its little "Geek Buddy" that forces you to call them and work thru them for system issues is VERY wrong and VERY dangerous...

Think we tempted fate just a few too many times...

Thoughts / ideas if I ever see the desktop again?!

 

[scottie916]

Addendum - Windows 7 update error 80246008 - since 08/13/2015

FINALLY got to my desktop - so you can see based upon the previous post time and this message how long it takes to get anywhere...

It is now 10:05 PM CST.

I get a message on the toolbar:

"Failed to connect to a windows service: Windows could not connect to the System Event Notification Service service. This problem prevents standard users from logging on to the system. As an administrative user, you can <lost rest of message>....."

The MSE says I am "At Risk" This app isn't monitoring your PC because the app's service stopped. You should restart it now. Click Start now to start the service.

>> I clicked [Start now]

>> I have a Java update that is available
>> System seems to NOW be running faster

>> I have 63 processes running right now
>> CPU usage is at 25% across 4 cores
>> Physical Memory usage is @ 1.89 GB out of 4 GB
>> Shows System Restore is currently running????

That DAMN Symantec Service Framework is running as a process (ccSvcHst.exe *32)
That DAMN CSUService - PID # 1060 - is RUNNING

I will keep Task Manager open so maybe we can go thru it and start eliminating services manually along with the manual edits to the registry.

I will share my home # as I think this is going to require an over-the-phone consult now: 8163312632

 

[scottie916]

NoeIDP...


Created a couple of DVD's of files to save.

>> Super AntiSpyware found nothing.
>> Malwarebytes found nothing.

Laptop is responding VERY much better (though I have NOT rebooted again)

Still plan removing HDD and finishing copy the items to another HDD in the event we decide to just wipe it and start over.

I tried to uninstall via Windows Program uninstaller.
>> says it did it - but I still see the CSU service/process
>> still see the folder w/files + CSUService (application) under C:\Program Files\COMODO\COMODO System Utilities
>> CANNOT delete the folder because the CSUServices (application) is still running "somewhere"

Please find attached the Services from RegEdit you requested.
>> New Services hive has been uploaded.

 

[NoelDP]

OK - let's try for it...
Open an Elevated Command Prompt in Safe Mode
Run the following commands:

reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\COMODO Internet Security /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application\GeekBuddyRSP /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CLPSLauncher /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\HMD /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CSUService /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CFMRD /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\avgtp /f 
 
.

save the results in a Notepad file, then reboot to normal mode and post the file - together with a new Services export.

 

[scottie916]

NoeIDP...

Before I do this set of steps, I have a question....

What do you mean by the following?

1) am I supposed to do each of these as separate commands?

2) am I supposed to cut/paste into a .bat file and include a > prn to output the results to a txt file?

3) or do I screen copy the outputs to a txt file? (if so... how do I do it from a DOS command window)??


Code:
---------
reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\COMODO Internet Security /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application\GeekBuddyRSP /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CLPSLauncher /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\HMD /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CSUService /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\CFMRD /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\avgtp /f

save the results in a Notepad file, then reboot to normal mode and post the file -
together with a new Services export.

======================

FYI... all malware scans found nothing. I have "finally" copied files from the laptop HDD to my desktop HDD via an external case - it took like 2 days of copying 200+ GB of data & files, etc...

 

[NoelDP]

You can copy/paste the whole lot in at once...
Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[scottie916]

NoeIDP,


Thanks for the explanation... So, here we go....

====== RUN RESULTS ======

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\C
OMODO Internet Security /f
ERROR: Invalid syntax.
Type "REG DELETE /?" for usage.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\eventlog\A
pplication\GeekBuddyRSP /f
The operation completed successfully.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\CLPSLaunch
er /f
The operation completed successfully.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\HMD /f
The operation completed successfully.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\CSUService
/f
ERROR: The system was unable to find the specified registry key or value.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\CFMRD /f
ERROR: The system was unable to find the specified registry key or value.

C:\windows\system32>reg delete HKLM\SYSTEM\CurrentControlSet\Services\avgtp /f
The operation completed successfully.

C:\windows\system32>

======= QUESTION ========

Since the process DID NOT delete the registry key(s) related to the "Comodo Internet Security", is it POSSIBLE to:

a) navigate to the "key" in regedit (running as administrator in SAFE MODE)
b) click / hi-light the "key" "Comodo Internet Security"
c) DELETE the key
d) will it AUTO-DELETE the subordinate "keys" under "Comodo Internet Security"
>>>> CavWp
>>>> CfpConfg
>>>> CIS
>>>> CisTray
>>>> CmdAgent
>>>> CmdUpd

*NOTE* the folder: C:\program files\COMODO\COMODO System Utilities STILL EXISTS (before reboot)
*NOTE* the folder: C:\Program Files\COMODO\COMODO Internet Security DOES NOT EXIST

*NOTE* the folder: C:\program files\COMODO\COMODO System Utilities STILL EXISTS (after reboot)

Laptop seemed to boot MUCH faster, but MSE was still "turned off" at reboot. Had to "Start the Service" manually via a message in the lower-right corner of the tool bar.

========== Services Hive Export ============

The unzipped version is: 1,928 KB (1.92 MB)
The zipped version is: 384 KB (attached)

========== ERROR messages from reg delete =========

HKLM\SYSTEM\CurrentControlSet\Services\CSUService (there IS NOT a key for this)
^^^ I am searching the whole registry for: CSUService
*** FOUND: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CSUService
*** Folder: C:\Program Files\COMODO\COMODO System Utilties (DOES EXIST)

HKLM\SYSTEM\CurrentControlSet\Services\CFMRD (there IS NOT a key for this)
^^^ I am searching the whole registry for: CFMRD
*** DID NOT FIND THIS string

*** LASTLY... BITS is still listed as: Status=blank / Startup Type=Automatic (Delayed)

 

[NoelDP]

Thanks for the detailed response!

One of the failures is my fault - lack of quotes.

Please open an Elevated Command Prompt and run the following command:

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\eventlog\COMODO Internet Security" /f

post the results, and an export of the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root key (as a hive again) from the registry

 

[scottie916]

NoeIDP,

Results from the last registry del.....

Seven Support - Reply #16

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>reg delete "HKLM\SYSTEM\CurrentControlSet\Services\eventlog\COMODO
Permanently delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\eventlog\COMODO (Yes/No)? Internet Security" /f
Permanently delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\eventlog\COMODO (Yes/No)? yes
ERROR: The system was unable to find the specified registry key or value.

C:\windows\system32>reg delete "HKLM\SYSTEM\CurrentControlSet\Services\eventlog\
Comodo Internet Security" /f
The operation completed successfully.

C:\windows\system32>


I did this in NORMAL/REGULAR mode as it was not specified.

** REBOOTED laptop - seemed to reboot quickly (considering) but took a while to get me to the Win 7 login screen. Even after logging in, things were slow to actually happen.

** Do not recall seeing the message about "MSE" not being able to be started this time.

** Checked BITS and the status is still "blank" and the startup Type is still Automatic (Delayed)...
========================

** I searched the Registry for Comodo and still come up with a "key" for the CCE. Not sure if
we intended to get ride of this also...

hkey_local_machine\system\CurrentControlSet\software\Comodo\CCE\

** There is also one of those "random string" keys found for the Comodo CIS:
hkey_classes\root\installer\products\88D1D109D8045E8408DDCC1354DB4865

** These is also a "ComodoGroup" key(s) found:
hkey_current_user\Software\CCE
hkey_current_user\Software\KillSwitch

** There is also a "3c8b665_0" key found:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
\PropertyStore\3c8b665_0

also in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
\PropertyStore\804f0ed9_0

also in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
\PropertyStore\9878599b_0

also in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
\PropertyStore\bd0f6067_0

also in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig
\PropertyStore\da26021b_0

** There is also a "key" found in:
HKEY_CURRENT_USER\Software\Microsoft\Security Center\Trusted Apps\COMODO Antivirus AntiVirus

======================================

I have also uploaded the enum\root* hive. It is 220 KB unzipped, or 49 KB zipped.

 

[scottie916]

NoeIDP,


Oh no! It has been a week since my last post and I have not heard back from you.

Have you had an opportunity to look into the issue(s) still plaguing my Win 7 laptop not being able to perform the MS updates?

Do you feel I should just copy all of my files "My Documents" and/or under my user to another PC and just reinstall the whole Win 7 software from the Toshiba recovery DVDs?

*** I sure wish there was a SAFE way overwrite the Win 7 install and keep ALL of my files, user account, programs... But I do not think the Toshiba recovery tools will do a re-install "safely"...

-Scott

 

[NoelDP]

Sorry about that! - Life getting in the way

I'll try and delve into this tonight.

 

[scottie916]

Windows 7 - BITS stalled

NoeIDP....

Well, I kind of resolved it on my own "somewhat"....

I uninstalled Raxco Perfect Disk v12.5 ( I think that was the version )

AND

I uninstalled the Microsoft Train Simulator ( 2013 )

After rebooting, I manually started the BITS service and was able to start downloading all of the various updates long forgotten...

BUT... I have a new wrinkle....

My Toshiba Laptop HDD is causing Windows 7 to boot really slow. I look into the "events log" and find several services that will not start **AND** an event message that the HDD has a BAD BLOCK.

As the owner of Gibson Research's Spin Rite v6.0 https://www.grc.com/sr/spinrite.htm, I tried to run it on the drive but it failed within the first 0.05% of the drive scanning / refreshing process.

The laptop eventually boots up and runs just "fine" - but I am sure I just need to replace the HDD and re-install the factory install from the DVDs I created when I first opened the laptop.

Just wanted you to know..
-Scott