Windows 7 Pro x86, constantly de-regestering itself

NoelDP · 11 Mar 2013

The problem appears to relate to a malformed Registry Key.

It may (or may not) be reparable by use of the CheckSUR tool -

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

I *think* all the errors relate to the same problem - the Identity value data at
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_8bc63dac42e4eabaca3593ddd2f5d84d_b03f5f7f11 d50a3a_6.1.7601.22110_none_3e4935d327505fbb

Let's see if CheckSUR agrees with me before I attempt to do anything :)

SkrumpyJax · 11 Mar 2013

SkrumpyJax said:

This PC is constantly de-regestering itself, have tried alternate freshly generated keys from MSDN account, re-installed to a different HDD.

Indeed it is a key from an MSDN account, this machine was built for working from home with a Bizspark key.
I thought that as the companies Bizspark account had since expired that the key may have been the issue.
If it causes issues I can put the original key back on.

NoelDP · 11 Mar 2013

Nope - it shouldn't be a problem, although since we started the thread (and since the abortive CHKDSK), the MGADiag error has changed (for the better) to indicating that the grace period has expired, which in turn means that the installation may require telephone activation.

A look at the CHKDSK log may be a good idea - it obviously achieved something fairly major (I haven't delved that far back in the CBS log yet, except to see that the registry error was present as far back as December)

You'll find the log as a Wininit even in the Application section of the Windows logs in Event Viewer - you may want to copy/paste the log to a reply.

SkrumpyJax · 11 Mar 2013

Code:

CHKDSK is verifying files (stage 1 of 5)...
  156928 file records processed.                                          File verification completed.
  264 large file records processed.                                      0 bad file records processed.                                        2 EA records processed.                                              124 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
Deleted invalid filename PFD22~1.CAT (134871) in directory 1330.
The DOS file name attribute in file 0x20ed7 is incorrect.
50 00 01 00 46 00 44 00 32 00 32 00 7e 00 31 00  P...F.D.2.2.~.1.
2e 00 43 00 41 00 54 00 68 00 74 00 6d 00 1a d2  ..C.A.T.h.t.m...
c3 73 ff ff 00 80 1c 00 00 a0 54 00 00 00 00 00  .s........T.....
There is no DOS file name attribute in file 0x20ed7.
Correcting minor file name errors in file 134871.
Unable to locate the file name attribute of index entry package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat
of index $I30 with parent 0x532 in file 0x20ed7.
Deleting index entry package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat in index $I30 of file 1330.
Unable to locate the file name attribute of index entry PAFD22~1.CAT
of index $I30 with parent 0x532 in file 0x20ed7.
Deleting index entry PAFD22~1.CAT in index $I30 of file 1330.
  197620 index entries processed.                                         Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
  1 unindexed files scanned.                                         Recovering orphaned file package_43_for_kb2750841~31bf3856ad364e35~x86~~6.1.1.3.cat (134871) into directory file 1330.
  0 unindexed files recovered.                                       CHKDSK is verifying security descriptors (stage 3 of 5)...
  156928 file SDs/SIDs processed.                                         Cleaning up 29 unused index entries from index $SII of file 0x9.
Cleaning up 29 unused index entries from index $SDH of file 0x9.
Cleaning up 29 unused security descriptors.
Security descriptor verification completed.
  20347 data files processed.                                            CHKDSK is verifying Usn Journal...
  36924896 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  156912 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  108355230 free clusters processed.                                         Free space verification is complete.
Windows has made corrections to the file system.

 488383487 KB total disk space.
  54596268 KB in 130377 files.
     88836 KB in 20348 indexes.
         0 KB in bad sectors.
    277463 KB in use by the system.
     65536 KB occupied by the log file.
 433420920 KB available on disk.

      4096 bytes in each allocation unit.
 122095871 total allocation units on disk.
 108355230 allocation units available on disk.

Internal Info:
00 65 02 00 d0 4c 02 00 99 4e 04 00 00 00 00 00  .e...L...N......
e7 0e 00 00 7c 00 00 00 00 00 00 00 00 00 00 00  ....|...........
90 8c 24 00 50 01 23 00 b8 18 23 00 00 00 23 00  ..$.P.#...#...#.

Windows has finished checking your disk.

NoelDP · 11 Mar 2013

That was quick!!

The critical things to note are in the Summary

Code:

Summary:
Seconds executed: 448
 Found 110 errors
 Fixed 102 errors
  CSI Could Not Open file Total count: 1
  CSI Manifest and S256H Do Not Match Total count: 1
  CSI Corrupt Component Keyform Total count: 4
  CSI Corrupt Identity Total count: 4
  Fixed: CSI Corrupt Identity.  Total count: 3
  CSI Located Replacement: Invalid (S256H) Total count: 5
  CSI Replacement File: CreateFile Failed Total count: 9
  CSI Missing Winning Component Key Total count: 1
Unavailable repair files:
 winsxs\manifests\x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5.manifest
 winsxs\manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest

I think it would be useful (at least for me!) to run the tool again - it may even find it can repair a few more things.
Please post both the CheckSUR.log and CheckSUR.Persist.log files this time.

NoelDP · 11 Mar 2013

Going a little deeper into the log, the following errors show...

Code:

Line 167: (f) CSI Corrupt Identity 0xC0150017 8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb Bad identity
 Line 167: (f) CSI Corrupt Identity 0xC0150017 8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb Bad identity
 Line 168: (f) CSI Could Not Open file 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb 
 Line 168: (f) CSI Could Not Open file 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb 
 Line 169: (w) CSI Replacement File: CreateFile Failed 0x0000007B winsxs\Manifests\x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb.manifest x86_8bc63dac42e4eabaca3593ddd2f5d84db03f5f7f11d50a3a_6.1.7601.22110_none_3e4935d327505fbb

What doesn't show there is that there's an unprintable Unicode character in the reuired filenames, as a result of an error in the registry key --

I think we'll have to fix that by hand.

SkrumpyJax · 11 Mar 2013

Here's both logs, this PC has been the bane of my life since I built it. :)
Most of the time it's been user error, but this de-registering is something I've never seen before. Do you think this could be caused by the install media, or a failed update, as I swapped the hdd after it first happened and re-installed.
Maybe it was a different issue altogether.

NoelDP · 11 Mar 2013

I'll give my thought on causes later :)

The log is a lot easier to read now - and my analysis was basically confirmed.
The remaining errors (with one exception) are all registry entries

Code:

Checking Component Store
(f) CSI Manifest and S256H Do Not Match 0x00000000 winsxs\Manifests\x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5.manifest x86_mdm5674a.inf_31bf3856ad364e35_6.1.7600.16385_none_e6de8df1e7b331d5 
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_disk.inf.resourc%s_31bf3856ad364e35_6.1.7600.16385_en-us_064cf8c54506586b identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_microsoft-windows-setup_31bf3856ad364e356.1.7600.16385_none_621709e2d6cc986a identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_networking-mpssvc_31bf3856ad364e35_6.1.7601.17514_none_0#80f0c5176cbb85 identity and keyform do not match; keyform is wrong.
(f) CSI Corrupt Component Keyform 0x00000000 identity x86_server-help-chm.applocker_help_31bf3856ad364e35_6.1.7600.16385_n/ne_70c476b7028fa28d identity and keyform do not match; keyform is wrong.
(f) CSI Missing Winning Component Key 0x00000000 x86_microsoft-windows-ie-versioninfo_31bf3856ad364e35_9.4.8112.16455_none_1789134b4f552973

(that's after removing the one really bad entry that we already knew about :) )

The question is how best to deal with it, since you're on a remote link.

What I really need is a copy of the COMPONENTS registry hive - which luckily is normally unloaded, so accessible at C:\Windows\System32\config\COMPONENTS (no extension)

You'll need to zip it and upload it to a fileshare site (SkyDrive or DropBox are ideal) and post a link - it will almost certainly exceed the forum's file size limits.

It'll take me a while to sort it out (if I can!) - probably until tomorrow evening. Please ensure that updates are prevented/prohibited until after I get back with the new hive!

In the meantime, you should be able to fix the missing manifest file without any resulting problems

I'll post a fix protocol for that in a few minutes.

SkrumpyJax · 11 Mar 2013

I'll have to have a look tomorrow as I need to get my kids home to bed, thanks for the exceedingly good help so far.

NoelDP · 11 Mar 2013

I've uploaded a file - sjxaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder sjxaa in the same place.
Open this folder - there should be one folder inside it (Manifests,)

Copy the content of the manifests folder (.manifest files) into this folder:

C:\Windows\Temp\CheckSur\Winsxs\Manifests

Now run the CheckSUR tool again

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

As far as causes are concerned -
I always tend to suspect RAM problems rather than anything else where registry entries are concerned. I have no real proof either way. Check RAM using MemTest86++ (get someone to run it before they clock off and then report the results when they get back in the morning!)

If the disk had shown any bad sectors, then I would have been tempted to blame that - but the CHKDSK is clear (which is NOT to say that the disk is perfectly fine, as it has many hidden available replacement sectors that the OS never sees or knows about - assuming this is a normal spindle?)
Check in the Event Viewer and make sure that there are no disk-related errors present.

Installation media? - try checking it with ISOBuster (the free version will do a nice job if you don't already have a paid copy). If installing from a network, then presumably it's an ISO file, so check the Hash against the expected values.