Windows Update broken. Multiple fixes didn't work.

[Redmage913]

Greetings,

I've got a doozy of a Toshiba here. Originally, it had the beginnings of a failed hard drive, so we cloned it over. After that, we ran BleachBit, AdwCleaner, and JRT as a basic cleanup, not finding anything significant. HitmanPro also found nothing of note. Finishing up, we started to run Windows update to find the error message "Windows Update cannot currently check for updates, because the service is not running. You may need to restart the computer." Of course, restarting didn't help

Here's a list of things we've tried to get this thing fixed:

Fixit 50123
Restarting wuauserv, bits
Windows Update Readiness tool
Windows Repair All-In-One - ran the full gamut of fixes
Fixit to "Automatically diagnose and fix common problems with Windows Update"
CHKDSK /f - made corrections, nothing major.
SFC /scannow - found errors, unable to correct them

Usually, we perform a repair install after this to more definitively reset components. However, with this machine, it gets about halfway through the Expanding files section to get the error message that it "cannot configure Windows to run on this hardware".

I tried going into %systemroot%\Panther to find the setuperr.log, but the file doesn't exist. Maybe that file is only created for vanilla installations, not upgrades.

I'm starting to run out of options here. The machine isn't having infection issues, updates won't run, and I can't repair the system.

Any suggestions?
Thanks,
Red

PS (edit): I also forgot to mention I tried Clean Boot as well.

 

[NoelDP]

we need the complete logs, please - the SFC scan had not completed when you copied the data for upload.


Please follow the Windows Update Posting Instructions and post the requested data
If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)

 

[Redmage913]

Someone's an idiot, and I think it's me... I forgot you can't upload the file while running another SFC scan...

 

[NoelDP]

The SFC scan shows the following problems...

 Line 11912: 2014-10-25 12:06:12, Info                  CSI    00000336 [SR] Repairing 4 components
 Line 11913: 2014-10-25 12:06:12, Info                  CSI    00000337 [SR] Beginning Verify and Repair transaction
 Line 11918: 2014-10-25 12:06:12, Info                  CSI    0000033a [SR] Cannot verify component files for 65f8f7473eb93648f764827fb19c2b02, Version = 6.1.7601.17527, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
 Line 11921: 2014-10-25 12:06:12, Info                  CSI    0000033c [SR] Cannot repair member file [l:26{13}]"Dxpserver.exe" of Microsoft-Windows-DXP-DeviceExperience, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 11925: 2014-10-25 12:06:12, Info                  CSI    0000033e [SR] Cannot repair member file [l:18{9}]"mfc90.dll" of Microsoft.VC90.MFC, Version = 9.0.30729.4148, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:1fc8b3b9a1e18e3b}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 11928: 2014-10-25 12:06:12, Info                  CSI    00000340 [SR] Cannot repair member file [l:24{12}]"setup_wm.exe" of Microsoft-Windows-MediaPlayer-Setup, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

One of those errors is best dealt with using the CheckSUR tool - but I don't see any CheckSUR.log file?

If there's one there, please post it - otherwise,

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply

 

[Redmage913]

Apparently there was a little bit of miscommunication with my techs - there is no log. I will run this overnight (leaving work ATM) and will post it in the morning.

 

[Redmage913]

Okay, so this is fun... I got a small window labeled "Windows Update Standalone Installer" with the message "Installer encountered an error: 0xc8000247". Checked for a log, but it didn't record one.

 

[NoelDP]

OK - That's not too surprising at this point.
It may be due to a broken driver... or a corrupted CATROOT2 folder.


This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -

Installing the Intel Rapid Storage Drivers
try downloading and installing them from here - https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=2101&DwnldID=22194

(you want the iata_enu.exe download)

once installed (if they install OK) try the CheckSUR tool again.
If they don't install, what exact error message do you get?

 

[Redmage913]

The Update Readiness Tool is now running after reinstalling the Rapid Storage drivers. I will post the log as soon as it completes. *fingers crossed*

Was it the cloning process that potentially broke the AHCI drivers?

 

[Redmage913]

Update: Ran SFC /scannow again; still has uncorrectable errors. Windows Update now opens with Code 80072F8F (incorrect date/time). The Windows Time service is set to Manual and was not running; I tried starting the service with no change. I also noticed that I cannot use NTP to automatically set date/time for all the available servers. With the service running, I get an unexpected error for all servers but time-b.nist.gov, which gave the error but synchronized the time anyways. Trying to update again, It found seven updates!

So for now the update issue is fixed. Should Windows Time be set to manual or automatic, and do you want the latest CBS Persist/CBS.log files?

PS: I've noticed I have to manually start Windows Time even when it's set to automatic. After starting the service, Windows Update works.

 

[NoelDP]

1) yes, I'd like the latest logs
2) Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[Redmage913]

Here are the updated log files, I had to compress the CBS_Persistent log quite a bit so hopefully it's still usable once it's decompressed. I'll get the FarBar logs in the next message once I get time to run the software and get the logs.
View attachment 338682

View attachment 338686

 

[Redmage913]

FarBar output:

Farbar Service Scanner Version: 21-07-2014
Ran by Sherry (administrator) on 29-10-2014 at 12:59:02
Running from "C:\Users\Sherry\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[NoelDP]

I finally had time to look at the logs...
and they failed to decompress for me
If the file is to large to upload here, don't attempt to mess with it, just upload it to a fileshare site (preferably DropBox or OneDrive) and post a link.

The FarBar scan is fine.