Solved WU error 80070002, sfc /scannow blocked?

[LucidBlue]

Hello,


My Windows Update service has been defunct for some time now, and I've finally decided to create an account to try and see if I can be helped. I've creeped on this forum for about a year now trying to solve this issue without any luck and decided it was time to make my own thread. Here we go...



When attempting to use Windows Update to search for updates I get the error code: "80070002"

Attempts to run: "windows6.1-KB976932-X64.exe" or
"7601.17514.101119-1850_Update_Sp_Wave1-GRMSP1.1_DVD.iso"
(both being Service Pack 1 for Windows 7 x64) result in "ERROR_FILE_NOT_FOUND(0x80070002)" messages.

sfc /scannow
While using an elevated command prompt, attempts to run "sfc /scannow" or "sfc /verifyonly" result in an identical error message: "Windows Resource Protection could not perform the requested operation."

However, when searching the CBS.log file, I can't find any errors with an "SR" tag on them (I read somewhere that this tag was specific to SFC issues). I even tried the following line in the command prompt to make a text file of the relevant errors...

< findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" >

But the command resulted in an empty sfcdetails.txt file being created on my desktop.

Trying to run the "sfc /scannow" or "sfc /verifyonly" in safemode or safemode with a command prompt resulted in the same error message as above.
Trying to run the "sfc /scannow" or "sfc /verifyonly" in "repair mode" boot results in an error message saying something about how the command couldn't be completed due to a repair being active and a restart needing to occur first (presumably being in repair mode was preventing the sfc /scannow command from running?

I've also completed a chkdsk /r which came back with no bad sectors.

SURT
Also ran the System Update Readiness Tool for Windows 7 for x64-based systems (Windows6.1-KB947821-v34-x64.msu). Logs do seem to have identified some issues, but I don't have a clue about what to do next.


Please find the CBS file attached to this thread.


Please advise.



Thanks,
Tyler

 

[LucidBlue]

Also, I saw that this information was useful in another thread, so in the event that it is needed and/or useful, here are the C:\Windows\winsxs\Pending.xml files from my system.

 

[torchwood]

Hi Tyler,
can you copy/paste the results of this tool,
http://go.microsoft.com/fwlink/?LinkID=52012

If it comes back clean, it will be quicker and easier for me to provide you with a W7 SP1 link.

Roy

note windows defender is NOT a complete AV.

 

[LucidBlue]

Hi Roy,

Here is the results of the tool which you requested:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-G3QVP-98J77-33RH3
Windows Product Key Hash: c0MTgh4aPLPRHO/f3TqzrGVlSkI=
Windows Product ID: 00359-OEM-8703163-77992
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {05EE17AD-E2E3-4085-AC9D-6F1E124CBFA5}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_gdr.130318-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Plus 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{05EE17AD-E2E3-4085-AC9D-6F1E124CBFA5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-33RH3</PKey><PID>00359-OEM-8703163-77992</PID><PIDType>3</PIDType><SID>S-1-5-21-615000231-3226460634-1397731336</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7640</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.9</Version><SMBIOSVersion major="2" minor="5"/><Date>20110402000000.000000+000</Date></BIOS><HWID>D1B93607018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>MSI   </OEMID><OEMTableID>OEMSLIC </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0011-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Plus 2007</Name><Ver>12</Ver><Val>17188A6D453BF71</Val><Hash>hA4mMcmkU9ZhkW67ZYY3XALCXOk=</Hash><Pid>89446-952-0947096-65511</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7600.16385

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-031-677992-02-1033-7600.0000-2562014
Installation ID: 013950163906662845615203196201517033056221030455074960
Processor Certificate URL: [url=http://go.microsoft.com/fwlink/?LinkID=88338]SpcService Web Service[/url]
Machine Certificate URL: [url=http://go.microsoft.com/fwlink/?LinkID=88339]RacService Web Service[/url]
Use License URL: [url=http://go.microsoft.com/fwlink/?LinkID=88341]UseLicenseService Web Service[/url]
Product Key Certificate URL: [url=http://go.microsoft.com/fwlink/?LinkID=88340]PkcService Web Service[/url]
Partial Product Key: 33RH3
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 3/26/2017 9:03:55 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: PAAAAAIABAABAAEAAAADAAAABAABAAEAln2W2rLzdxYQM1Ty/I06hxDEDHRiPbgbezeAFPBatEeHjY4u

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: no, invalid Windows marker
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            7640MS        A7640100
  FACP            7640MS        A7640100
  HPET            7640MS        OEMHPET 
  MCFG            7640MS        OEMMCFG 
  SLIC            MSI           OEMSLIC 
  OEMB            7640MS        A7640100
  SSDT            A M I         POWERNOW

-Tyler

 

[LucidBlue]

I'm guessing that since that same error code I've been getting (0x80070002) popped up all over the assessment that you had me run that this means that the report didn't come back "clean"?

Also, small sidenote, you mentioned that Windows Defender is not a complete AV software. Can you point me to a non-biased website discussing what good options I would have for AV coverage? Especially lightweight and free options?

 

[torchwood]

Hi Tyler,
Nothing fundamentally wrong with the report

However, your BIOS seems to be corrupted and the likely cause of the update failures.
It appears that its been changed at some stage, possibly for the Office install.
(even if i supply an W7 SP1 it wont update!!.)

You will need to update your Bios from MSI for that motherboard
I will NOT guarentee this will work because of the changes you have made previously, and it may even totally brick your machine

Proceed at your own risk
after updating your bios, and removing Office, you may find updates appearing.
If not repost the tools new output.


Roy

 

[LucidBlue]

Hi Roy,

A corrupted BIOS might actually make a lot of sense because this system has suffered from, what I thought to be, a separate issue of my computer failing to boot and producing a BSOD every other time that I boot the machine (booting after the computer has been at rest for 1 or more hours tends to result in a failed boot, but booting within a few minutes of a recent shut down tends to result in a successful boot). This has been an issue that I've had for years, and have spent countless hours trying to track down the origin, even taking it into a professional computer repair store which was unable to identify the issue.

Regarding your feedback I had a couple questions:

1. What should I do to better assess the likelihood that attempting to update the BIOS will "brick" my machine? The idea of 'bricking' my machine is terrifying to me and I'd like to take any reasonable precautions available to prevent this.

2. I assume that I should make sure that everything on my HDD is backed up onto other storage devices before attempting the BIOS update?

3. Should I remove Office before or after doing the BIOS update?

4. Are there any other viable options for resolving my issue without risking a BIOS update and, therefore, possibly 'bricking' my system?

Thanks for all your help,
Tyler

 

[torchwood]

Hi Tyler,
I was being generous as your OS is showing as genuine.

There is a Bios hack on your system presumably for the Office install, its coming back as non-genuine, by the way.
I suspect that its causing ALL your problems.

As i have absolutely NO idea what changes were made by it, and hacks are not my area, all i can do is make guesses, hence my previous comment--

Uninstalling Office should not brick your system but updating the bios could.
Most definately back-up your drive

All i can do is wish you luck, if you update it


Roy

 

[LucidBlue]

Hi Roy,

Something is wrong here, because I am certain I never (intentionally) installed a BIOS hack, especially not one for Microsoft Office. My copy of Office was provided to me by my university several years ago; I have the verification key sitting in a box in my closet. I just now went into Office Word and confirmed that my copy of Office is "Activated" (if that is relevant). I'm really at a loss here for why that diagnostic would come back as indicating my system has a non-genuine version of Office...

I don't understand how a BIOS hack could have been installed onto my system... Is there anything else that could cause the diagnostic to indicate that (e.g., power fluctuation, bit-flip, failed BIOS update)? I do remember updating the BIOS with a flash drive several years ago, but I imagine that I would have only installed something from the appropriate source (i.e., the motherboard manufacturer, MSI), so I don't believe that it would have been the result of inaccurate or malicious original code accidentally being used to update my BIOS.

Most importantly, does this (my attestation that I never installed a BIOS hack) change my recommended course of action in any way?

Thank you,
Tyler

 

[torchwood]

Hi Tyler,

Been researching, should shed more light on your problem as its quite rare.
Your motherboard comes either OEM or Retail, this is where it gets interesting
If MSI overstocked on the OEM side they moved them to Retail,
BUT then they had to change/flash the Bios to remove the OEM identifiers--
Now if they did this it would show as a Hack, EVEN if the OS was legitimate, as in your case.

What then would happen is that when Windows/Office, checks for updates/patches they fail
(excluding security ones, and identify office as non-genuine).
Now as SP1 was released in 2010, when did you build yours??, it should have installed years ago!

The activation side of things covers more than one stage,
can you install KB971033
REBOOT

rerun the tool, then copy/paste me todays CBS log - zip not rar its allready on your comp

Roy

 

[LucidBlue]

Hello Roy,

Wow, I never would have been able to dig that info up... Thank you!

Regarding your question about when I built my computer, around August of 2010.

I downloaded KB971033 (x64) per your request from: ( https://support.microsoft.com/en-us/help/971033/description-of-the-update-for-windows-activation-technologies ). However, after running the Windows6.1-KB971033-x64.MSU file a window opens saying "Searching for updates on this computer..." and then after about 2 seconds another window pops up saying "This update is not applicable to your computer.". I also tried out the x86 version, just in case, but got the exact same windows. Nonetheless, I did restart my computer, re-ran the (Windows6.1-KB947821-v34-x64.msu) tool and then put the file into a zip as requested.

 

[LucidBlue]

regarding why I've taken so long to do the SP1 update, I know that I've re-formated my computer at least once or twice since first building it, so it's not like I've been using this install since 2010 without SP1. Although, I'm not sure that I've ever successfully installed SP1 on any of the Win7 installs on this system... I always had more pressing issues to address with this build. And I'm very good at putting things off...

 

[torchwood]

Hi Tyler,
what did you do on 25 feb 2015, your comp ended up doing nearly 20,000 fix's
(bios flash ??)
Its been corrupt since then

The CBS logs are showing

corrupt registry entries for a "pulled" update.
missing manifest and deployment files
and its also trying to install only parts of SP1

I am suppling a link for W7 SP1 Home Premium X64
https://software-download.microsoft.com/pr/Win7_HomePrem_SP1_English_x64.iso?t=33953740-7ef0-4734-992d-eaf04df44dbb&e=1490999887&h=500313e0121a4e2d7847fb295c391058
(only valid for 24 hrs)

In your position i would go for a clean install.
NB
DO NOT activate on install, you will have a 30 grace period before you need to, in this time
I WANT you to install all updates Motherboard >> Windows >> BEFORE even starting on Office

Im still not sure if the bios corruption will give you update/genuine problems, it shouldn't if its not activated.
In your case i would not use MSE, you could try Panda/Bitdefender as your AV and run Malwarebytes monthly, all free.

After its TOTALLY updated
run
sfc /scannow
SURT

and post the logs i'd be intrigued to see how your comp is performing.

Roy

 

[LucidBlue]

Hi Roy,

So I took a peek at my download history and it looks like on 25 feb 2015 I downloaded (MicrosoftFixit50123.msi) and then about an hour later I downloaded (Windows6.1-KB947821-v34-x64.msu). Perhaps one of these is related to the observations you made? Could one of these have caused the corruption?

I will prepare myself for a clean install as you suggested, but I will let you know that this might take me up to 2 weeks to prepare for (I need to back up a lot of media files I have and will thus need to go purchase another HDD to safely do this). Just wanted you to be aware that I'll be silent for a while.

When you talk about not activating on install, you're referring to the windows activation right?
Also, regarding your previous advice of updating the BIOS, should I still do this? (if so, it would be best to do this before the formatting, right?)

Thanks again for all your help Roy.

Tyler

 

[torchwood]

Hi Tyler,
No worries about the time delay

KB947821 (SURT = system update readyness tool), is the system checker/fixer and quite possibly was the instigator of those entries, and in reality should have had the opposite effect.
However it can only fix problems using whats on your comp.

You are correct i was talking about windows activation,

If your system/programs are running well, I would leave the Bios as it is.

Regarding back-up most around here use Macrium(free) to create a FULL image

MACRIUM REFLECT - Create Bootable Rescue USB Drive - Windows 7 Help Forums


Roy

 

[LucidBlue]

Hi Roy,

So I'd like to confirm that I'm understanding you correctly, because I'm feeling a little confused.

Earlier in this thread you mentioned,

"However, your BIOS seems to be corrupted and the likely cause of the update failures."
(and)
"There is a Bios hack on your system presumably for the Office install, its coming back as non-genuine, by the way. I suspect that its causing ALL your problems. As i have absolutely NO idea what changes were made by it..."

However, now you stated that if my system/programs are running well that I should leave the BIOS as it is?

Has our 'suspect' changed during our diagnostic process to indicate that the BIOS hack is no longer a causal factor in these issues? Are you thinking that running the KB947821 (SURT = system update readyness tool) back in 25 Feb 2015 caused the BIOS corruption/hack?

Thank you for helping me understand.

Also, I was able to find time to go purchase another HDD so I'll be starting the clone/backup tonight.

-Tyler

 

[torchwood]

Hi Tyler,

Complicated it sure is and that leads to confusion

from the tool

BIOS valid for OA 2.0: no, invalid Windows marker
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 7640MS A7640100
FACP 7640MS A7640100
HPET 7640MS OEMHPET
MCFG 7640MS OEMMCFG
SLIC MSI OEMSLIC
OEMB 7640MS A7640100

It all revolves around what i said in post#10

You have a System Builder licence, and they would normally look like this

BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
FPDT ALASKA A M I
ASF! INTEL HCG

Yours is showing

HPET 7640MS OEMHPET
MCFG 7640MS OEMMCFG
SLIC MSI OEMSLIC
OEMB 7640MS A7640100

At first glance it would appear that someone has installed a hack, by introducing a SLIC table to bypass windows activation
The SLIC, OEM and invalid windows marker entries in your case.

Something didnt ring quite true which is why i did some further investigating
Why introduce a SLIC hack when its totally irrelevant for a System builder key??
What i did see is that your Office install was coming back non-genuine, and leapt to the wrong conclusion.

Suspect wise
its not SURT it does not go anywhere near the Bios
That just leaves the retailer, as i said in post# 10, the move from OEM to Retail and the changes they had to make in the Bios, and whether or not your updating of it created further problems.

Regarding system/programs - If there running well leave the Bios alone, the old addage
IF it aint broke Dont fixit
is the line i've gone down, because i dont want to rock the boat anymore than neccessary.

Going back to Office, you stated you got it via your University some editions require Registration to complete the activation process


Roy

 

[LucidBlue]

Hi Roy,

So I've re-installed the operating system using the Win7 sp1 image and prevented Windows activation for now. I've installed all the drivers and Windows updates which I have found. I opted to not mess with trying to install Office at this time since you mentioned that it might be part of the issue in terms of it not being activated properly.

Also took your advice of using Macrium Reflect for the backup (which was very useful, thank you), and using Bitdefender as an active AV instead of MSE. (Plan to download Malwarebytes soon for monthly scans)


I have had some system crashes with this new install, but the crashes only occur during the Windows loading screen on system startup. Some of the crashes I've had have even happened when trying to boot into safe mode which concerns me.

sfc /SCANNOW comes back clean: “Windows Resource Protection did not find any integrity violations.”

SURT (see log)

View attachment 398006

View attachment CheckSUR.4.12.zip


Tyler

 

[LucidBlue]

Hi Roy,

So does this mean that after my Windows activation grace period is up (in 6 days) that I'll lose the ability to use Windows Update like last time? Or does this remain to be seen? I know we talked about my motherboard manufacturer (MSI) changing the BIOS in order to switch overstocked OEM boards to retail boards so that they could be sold retail, and that this likely created my Windows inauthentic issue. Has upgrading to SP1 changed this in any way?

Thanks,
Tyler

 

[LucidBlue]

An update for anyone that this may help...

It appears that my Windows Update is working correctly and downloading new updates despite still having the manipulated BIOS.

Thanks Roy for all your help!
Tyler