Multiple issues after update (sfc /scannow and CheckSUR logs included)

Hi everyone,

I'm currently using Windows 7 Home Edition, 64bit. Back on 3/14 Windows installed some updates, and since then my computer has been acting strange. The updates that installed successfully were as follows:

KB915597 (Defender Update For Windows Explorer)
KB2553501 (Sec Update for Microsoft Silverlight)
KB890830 (Windows Malicious Software Removal Tool x64)

The following two updates failed to install:

KB2809289 (Cumulative Security Update for IE 9 for Windows 7 for x64)
KB2791765 (Updates for Windows 7 for x64-based Systems)

After the issues started I performed a System Restore to back before the updates, and it fixed all the issues. However, I then left for the weekend and forgot to turn off automatic-update. Windows then proceeded to continue to try (and fail) to install the two updates listed above. When I returned, the restore point that I originally used was gone, and the existing restore points did not solve my issues. Here is a listing of some of the (seemingly random) issues I experience:

1. When booting, I get an error saying that sidebar.exe cannot load due to missing urlmon.dll
2. When attempting to play any .WMV file I receive an error that "Server execution failed"
3. All folders open in a new Window when double-clicked
4. Clicking a link in IE opens a new tab instead of just opening the link
5. Searching for updates using the Windows Update tool fails due to error 802400E: Windows update encountered an unknown error
6. Attempting to add a .WMV to Windows DVD Maker throws an error that "<file>.WMV is not a supported type, and it cannot be imported."
7. Further attempts to install the following Windows Updates continue to fail and must be rolled back:
a. KB2809289 (Cumulative Security Update for IE 9 for Windows 7 for x64)
b. KB2670838 (Platform Update for windows 7 x64-Ediition)

While none of these are major errors, they appear to me to be indicative of a larger problem. I have taken the following actions, all with no results:

1. Ran a virus scan using avast! (no issues found)
2. Ran a system scan using Malwarebytes (no issues found)
3. Ran a System Repair using chkdsk /r
4. Ran a System Check using sfc /scannow, both online and offline (both ways say it could not fix some of the problems)
5. Ran a CheckSUR (could not fix all problems)

I also decided to try uninstalling all of the Windows Updates that had been successfully installed in March. Doing so did not fix any of the issues I am having, but it did result in cleaner logs for both sfc /scannow and CheckSUR.

I feel like I've run out of options at this point, and I was hoping someone might be able to provide some assistance or guidance. I'd really prefer not to have to perform a clean install (obviously), so anything would be helpful.

Thank you everyone for any help you can provide.

Sincerely,
EWG

Attachments:
1. SFC_1 (from original run of sfc /scannow)
2. CheckSUR_1 (from original run of CheckSUR)
3. SFC_2 (from second run of sfc /scannow, after uninstalling recent Windows Updates)
4. CheckSUR_2 (from second run of CheckSUR, after uninstalling recent Windows Updates)

Hello and welcome EWG mate you seem to have done all the right things but you cold try some other scans try these


http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Oh download ADW from bleeping computer

Thanks for the advice ICit. I'd actually already run the Malwarebytes scan, so I felt no need to do that again. I did download and run both the ADWCleaner and TDSKiller programs, but neither of them found any issues with my PC.

I've had (and dealt with) viruses and adware in the past, and while I don't know for certain, this just doesn't feel like anything malicious. It seems to me like something must have gotten messed up in the registry or the internal Windows settings with the install/fail/uninstall of the recent Windows Updates that is causing my weird issues

Hum well I am surprised that the ADW didn't pick something up if it was lurking in the registry.


Have you had a check back through the event viewer for any "loud" errors?

A run with the CCleaner registry checker might be worth try mind you back up if you are going to let it fix the stuff it comes up with.

Might sound daft but date and time are correct? - just thinking why those two will not update because I am guessing you would have the Update Readiness tool on board by now?

The CHeckSUR reports these problems....

The SFC results are not present in the logs you posted - please post the entire CBS folder (zipped!) so we can tack back.

I've uploaded a file - ewgaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder ewgaa in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages


Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

Hi Noel,

Thanks for the assistance. I followed your instructions and CheckSUR appears to have been able to fix all the issues it found. However, all of the problems I mention in my original e-mail still continue to exist. I've attached a zipped copy of my CBS folder, containing both the CheckSUR and SFC logs.

Thanks,
EWG

Your SFC scan found no problems - but buried in the CBS logs I found a number of references to problems with the 'Localized property bag' which appears to relate specifically to .NET installations.

I suggest that you read the following article - .NET Framework Cleanup Tool User's Guide - Aaron Stebner's WebLog - Site Home - MSDN Blogs - and attempt a cleanup of your .NET installations.

I'm at work right now, but when I get home this evening I'll check out that thread and give it a shot.

Thanks!

So I downloaded and ran the .NET Framework Cleanup Tool, the logs of which I've attached in a folder.

I then reinstalled the .NET Framework 4 Client Profile, which was the only instance of .NET that I found in my Add/Delete programs listed.

I then ran SFC /scannow, and I have attached the CBS folder again with the logs.

Unfortunately, all of the random issues still exist

Interesting - a lot of Access Denied errors in the cleanup log.
I suspect this means that permissions are wrong somewhere along the line.
lets start with the obvious one....


Open Windows Explorer (Computer)
Navigate to the C:\Windows folder
Find the System32 sub-folder and right-click on it
select Properties

Clear the 'blob' from the 'Read-only (Only applies to files in folder)' box by clicking on it until it's plain white.
Click on Apply.

Make sure that the radio button for 'Apply changes to this folder, subfolders and files' is set, and click OK.

Accept the Administrator prompt. After a couple of seconds, you'll be told there is an error - click on the 'Ignore all' button.

Wait for it to finish - it could take a couple of minutes.

OK out, and exit Windows Explorer.

Reboot twice

Done!

How does the system behave now?
What does WU have to say for itself?

Please run another SFC /SCANNOW and post the CBS.log

All the issues still exist. The "blob" is still there in the System32 folders properties, but I assume that is because it couldn't apply the permissions to some of the sub-folders/files (hence the "ignore all" for the errors).

Log attached.

The blob exists by default - because folders can't have read-only attributes - so you can ignore that.
That CBS.log is effectively error-free, as far as I can tell.

Please post the C:\Windows\Windowsupdate.log file and I'll try to make some sense out of it

Down into the weeds

Thanks again for taking the time to assist. Heading to work now so I'll check back in tonight.

One more thing: While attempting to check for new Windows Updates does result in the 8024000E error, there are still a list of updates that Windows wants to install that I have been avoiding. I've attached two screenshots with the list of Important and Optional updates that are sitting out there.

You can ignore the optional updates - one is irrelevant, one is problematic, and one is a PITA.
(I'll leave you to work out which is which :devil

The vast majority of the other updates are for .NET 4.0 - headed by KB2468871

Please attempt to install ONLY KB2468871, and post the error message you get.

Installed KB2468871 without reporting any problems.

I've attached an updated copy of the Windows log file.

Rebooted (even though it didn't require it), and all of my issues still exist.

That's a step forward for mankind!
Now please do another manual check for updates, then install only the oldest .NET update found