Solved Windows 7 Update fails to even find updates (error:

[Dragonride]

Tried all these, attachments as requested.

 

[NoelDP]

Some interesting errors in the System log...

The following boot-start or system-start driver(s) failed to load: 
SBRE
. 
The SQL Server VSS Writer service terminated unexpectedly.  It has done this 1 time(s).
. 
A media delivery engine with ID '0' was not initialized due to error '0x800700b7' when adding the URL 'http://+:10243/WMPNSSv4/4040352340/'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.
. 
The XAMPP Service service failed to start due to the following error: 
The system cannot find the file specified.
. 
The WebcamMax, WDM Video Capture service failed to start due to the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
. 
Encrypted volume check: Volume information on \\?\Volume{d9751ffa-476c-11df-bd9e-806e6f6e6963} cannot be read.
. 
The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#7&2C5E86A3&0&058F63636476&0#.

The Apps log shows the following errors...

The description for Event ID 0 from source SignInAssistant cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event: 
InitializeSvcAPI failed with hr = 0x8004888d
. 
Activation - 
Health check failure: 
hr =0x8004FE21, HealthStatus: 0x000000000003EFFF
. 
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process. 
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {c39b3885-4573-4f97-9975-ab72ce092c01}

There are a number of other errors which arise from 'Access Denied type messages
I think the two most important are the ones at the top of the System list...
back in a few minutes with some ideas on them.

 

[NoelDP]

Please run the following commands in an Elevated Command Prompt, and post the results....

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\LEGACY_SBRE /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\SQLWriter
REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\VSS\Diag\System Writer"
VSSADMIN LIST WRITERS

(the last one may take a minute or two - be patient!)

Post the results.

Here are some instructions to make lifeeasier

1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.

2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.

3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

 

[Dragonride]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\LEGACY_SBRE /S
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\SQLWriter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SQLWriter
Type REG_DWORD 0x10
Start REG_DWORD 0x2
ErrorControl REG_DWORD 0x1
ImagePath REG_EXPAND_SZ "C:\Program Files\Microsoft SQL Server\90\Shar
ed\sqlwriter.exe"
DisplayName REG_SZ SQL Server VSS Writer
ObjectName REG_SZ LocalSystem
Description REG_SZ Provides the interface to backup/restore Microsoft
SQL server through the Windows VSS infrastructure.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SQLWriter\Security

C:\Windows\system32>REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\VSS\Diag\S
ystem Writer"


C:\Windows\system32>VSSADMIN LIST WRITERS
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Waiting for responses.
These may be delayed if a shadow copy is being prepared.

Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error

Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error

Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error

Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {d0b40ca8-83a9-47a6-a9b5-11c84059a757}
State: [1] Stable
Last error: No error

Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {211a6bf4-a816-4cc9-bd40-e67884b8bc32}
State: [1] Stable
Last error: No error

Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {7b247369-8b47-4187-8902-6d83d28f5e61}
State: [1] Stable
Last error: No error

Writer name: 'MSSearch Service Writer'
Writer Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Instance Id: {8af12067-f9d9-483a-8911-4f9544697ecf}
State: [1] Stable
Last error: No error

Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {78659817-cc2f-4441-835f-cb6149abef11}
State: [1] Stable
Last error: No error

Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {e83dda79-5786-4d35-a921-0051b72ddc21}
State: [1] Stable
Last error: No error

Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {34ee78a1-18ce-44ba-8ba0-caab1bdccfd6}
State: [1] Stable
Last error: No error


C:\Windows\system32>

C:\Windows\system32>

 

[NoelDP]

Well at least we seem to have identified one of the problems

I'll post a fix for the SBRE problem a little later - I need to test a few things first.

 

[NoelDP]

Have you had Ad-Aware installed at any time??
this error can apparently be caused by AA being uninstalled - and can be fixed by a simple command in an Elevated Command Prompt...

SC DELETE SBRE

If that's not the case here (or you get a 'service not installed' error), then read on...

I've uploaded a file - sbrefix.zip - to my SkyDrive at Noel's SkyDrive

Pleasedownload and save it to your desktop.

Right-clickon the saved file and select Extract all...

Saveit to the default location

Thisshould create a file sbrefix.reg



right-clickon the file, and select Merge

Acceptthe warnings, - you should then get a 'Success' message.

Closeall windows, and reboot.

Now test the system a bit, and post the new System.evtx file

I have to admit that I'm not sure how the SBRE 'driver' ties in with Windows updates, but it needs fixing anyhow

 

[Dragonride]

Yes, I have Ad Aware installed, or I certainly used to have it!
The first option was successful, no need to download file (I assume).

 

[NoelDP]

If AdAware is still installed, it may be a good idea to test it now - in case we need to do something else

The SBRE error is now 'missing' from the latest boot

There are a few other service errors - involving the following services...

WebcamMax, WDM Video Capture service failed to start.
 

 
XAMPP Service service failed to start
 

 
SQL Server VSS Writer service terminated unexpectedly

also the following driver failed...

The driver \Driver\WUDFRd failed to load for the device 
WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#7&2C5E86A3&0&058F63636476&0#.

... and there are a number of failures with Windows Media Player.

A media delivery engine with ID '0' was not initialized due to error 
'0x800700b7' when adding the URL 'http://+:10243/WMPNSSv4/4040352340/'. Restart 
your computer, and then restart the WMPNetworkSvc service. If the problem 
persists, reinstall Windows Media Player if possible.
 

 
 
.

 
A new media server was not initialized because the Windows Media Delivery 
Engine did not initialize due to error '0x800700b7'. Restart your computer, and 
then restart the WMPNetworkSvc service. If the problem persists, reinstall 
Windows Media Player if possible.

As far as the WMP errors are concerned, have a look here...
Four errors from Windows Media Player Network Sharing Service on every - Microsoft Community



Let's have a look at the failing services...

run the following commands and post the results.

SC QUERYEX XAMPP
SC QUERYEX WebCamMax

The System Writer problem is a tricky one - I need to do some thinking about that!

 

[Dragonride]

Okay, the Adaware I'm not too fussed about as it was probably removed to prevent clashing with my new AV, BitDefender Total Internet Security which is firewall, av and loads more.
Xampp I still have on my machine, but I more often use AAMPS as it's far more user friendly.

WebCamMax was probably something I tried and didn't like the results so uninstalled it.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sc queryex xampp

SERVICE_NAME: xampp
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc queryex WebCamMax
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\system32>

 

[NoelDP]

I'm not a fan of security suites - I reckon that you're better off with a mix-and-match solution - but if it works for you, that's the main thing

Obviously there's something in the registry attempting to start the WebCamMax service - which doesn't exist. The question is: where? See if MSCONFIG gives any clues (or gives it a different name!).

Interesting that XAMPP seems to be saying that no attempt has been made to start it - let's see what happens is we do attempt it.

Open an Elevated Command Prompt and run the following commands

NET START XAMPP
SC QUERYEX XAMPP
SC QC XAMPP
SC SDSHOW XAMPP

post the results

 

[Dragonride]

Webcammax, possibly Web cam monitor? ensured that at least is uninstalled.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>net start xampp
System error 2 has occurred.

The system cannot find the file specified.


C:\Windows\system32>sc queryex xampp

SERVICE_NAME: xampp
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc qc xampp
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: xampp
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Xampp\service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : XAMPP Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


C:\Windows\system32>sc sdshow xampp

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\system32>

 

[NoelDP]

The XAMPP service needs the file C:\Xampp\service.exe to be present and correct before it can start - is it there or not? If not, then it would probably be a good ides to either uninstall XAMPP or uninstall/reinstall it to ensure that everything else is OK as well.

Windows can be a little misleading with System 2 errors - because the file may be present, but the service may not have the correct permissions to be able to either access or open it. If you decide to reinstall XAMPP, then I would suggest running the following command after the install and a reboot

ICACLS C:\Xampp\service.exe

and post the results - together with a repeat of the SC commands above - with a new System event log.

The SDSHOW results above look about right - they are pretty much default permissions for a service.


Any joy with the WMP problems?

 

[Dragonride]

Xampp reinstalled, CMD results:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Xampp\service.exe
C:\Xampp\service.exe BUILTIN\AdministratorsI)(F)
NT AUTHORITY\SYSTEMI)(F)
BUILTIN\UsersI)(RX)
NT AUTHORITY\Authenticated UsersI)(M)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>SC QUERYEX XAMPP

SERVICE_NAME: XAMPP
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QC XAMPP
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: XAMPP
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Xampp\service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : XAMPP Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Windows\system32>SC SDSHOW XAMPP

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\system32>

WMD: I followed the instructions on the link you gave, disabled WMD and Media Centre, rebooted, re-enabled both, working fine now thanks. (Or so I thought, just seen the errors in the sys log!)

 

[NoelDP]

The WebCamMax service is still trying to start - please check MSCONFIG and see if you can find out what's attempting to force it.

It may even be that which is causing your WMP issues.

I'll check and see if I can find out what the SBRE service is supposed to do - we may still need to install the registry patch.
In the meantime, please open Device Manager, and enable Viewing of hidden devices.
Are there any flagged with yellow triangles or red crosses? If so, Remove them, and reboot - then go back in to Device Manager and see if the devices are still present, and whether the 'flags' are still there.

 

[Dragonride]

WebCamMax was down to a failed uninstall of WebCamMax so I re-downloaded and then uninstalled.

There are two yellow triangles marked in the Device Manager, both as under Portable Devices, entitled WPD FileSystem Volume Driver. As far as I can see, both are identical, dated 21/6/2006 version 6.1.7600.16385 Microsoft Windows.

Uninstalled them, re-booted, came back still with yellow triangles in place.

 

[NoelDP]

That would possibly fit with the

The driver \Driver\WUDFRd failed to load for the device 
WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#7&2C5E86A3&0&058F63636476

error. - and maybe the Bitlocker error as well. I've been avoiding mentioning that - as I know nothing about Bitlocker for one, and Bitlocker isn't available in Pro so far as I am aware, for another


Did you check MSCONFIG for WebCamMax? - also the Services.msc console may show something

 

[NoelDP]

Looking at the USB error - it's possible that this is caused by a misconfiguration somewhere.
Others have cured it by setting the Windows User Mode Driver Foundation service to Auto- start rather than manual.


Please run the following commands in an Elevated Command Prompt, and we'll see what the service has to say for itself...

NET START WUDFSVC
SC QC WUDFSVC
SC QUERYEX WUDFSVC
SC SDSHOW WUDFSVC

post the results

 

[Dragonride]

MSC shows nothing that seems to refer to WebCamMax, nor does services.msc through that does show bitlocker is present, but not running, where ever it's arrived from.

Results:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>NET START WUDFSVC
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>SC QC WUDFSVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WUDFSVC
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalSystemNetwo
rkRestricted
LOAD_ORDER_GROUP : PlugPlay
TAG : 0
DISPLAY_NAME : Windows Driver Foundation - User-mode Driver Framew
ork
DEPENDENCIES : PlugPlay
: WudfPf
SERVICE_START_NAME : LocalSystem

C:\Windows\system32>SC QUERYEX WUDFSVC

SERVICE_NAME: WUDFSVC
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 2020
FLAGS :

C:\Windows\system32>SC SDSHOW WUDFSVC

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC
;;;IU)(A;;CCLCSWLORC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)

C:\Windows\system32>

 

[NoelDP]

All the WUDFSVC output is normal.

OK - let's look at all the startup references then - download and save 'SilentRunners' from Silent Runners - Adware? Disinfect, don't reformat! - note that your AV may complain, since it's a VBS script. It is very safe though as all it does is query every possible malware startup point and list the output.


once saved, double-click on the file to run it, and accept the UAC prompt.
You'll get a request up as to whether you want to skip the supplemental scan - select NO as we want all the data we can find.
After a minute or two, you'll get a Success message - with the location of the output file.

Zip the output file, and attach it to your reply.

 

[Dragonride]

Okay, all done, eventually. It took a lot longer than a few minutes, but the full scan is now attached. Thanks again for all your help so far.

PS. I'm now starting to receive errors that my (genuine) Windows 7 is not genuine/activated as various files are missing/corrupt or removed, possibly by malware?