This computer is not running genuine Windows

themexican · 20 Nov 2014

OK, here are another set of logs. Hopefully the view is not as sad as it was before.

NoelDP · 20 Nov 2014

The System log looks a lot better now! - but the VSS service, and consequently System Restore, are still having problems

Here's the detail from one of the VSS errors...

Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. The Registry Writer failed to respond to a query from VSS. Check to see that the Event Service and Volume Shadow Copy Service are operating properly, and please check the Application event log for any other events.

Operation:

Gathering Writer Data

Executing Asynchronous Operation

Context:

Execution Context: Requestor

Current State: GatherWriterMetadata

I need to do some research on that and get back to you.

NoelDP · 20 Nov 2014

Open an Elevated Command Prompt, and run the following commands:

Code:

vssadmin list writers >>"%userprofile%\desktop\vssdata.txt"
vssadmin list shadowstorage >>"%userprofile%\desktop\vssdata.txt"
vssadmin list shadows >>"%userprofile%\desktop\vssdata.txt"
vssadmin list providers >>"%userprofile%\desktop\vssdata.txt"
exit 
.

this will eventually close the window and create a file on your desktop 'vssdata.txt' - please upload that to your reply.

themexican · 20 Nov 2014

Here it is!

NoelDP · 21 Nov 2014

That was a little unexpected!
The 'writers' list is completely empty

- did you get an error message running the first command?
I'll have to do more research and see if I can come up with something..

themexican · 22 Nov 2014

No, nothing appeared.

I really appreciate your help. Everything that i find is to increase the shadow copy size and to reregister VSS.

Thanks!

NoelDP · 22 Nov 2014

Please open an Elevated Command Prompt, and run the following commands...

Code:

REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
 
.

Post the results.

themexican · 23 Nov 2014

Here it is!

Code:

C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\
{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B2
3F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-00000
0000000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805
fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000
-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
    Active    REG_DWORD    0x1
    EventClassID    REG_SZ    {FAF53CC4-BD73-4E36-83F1-2B23F46E513E}
    EventClassName    REG_SZ    VssEvent
    OwnerSID    REG_SZ    S-1-5-18
    TypeLib    REG_EXPAND_SZ    %systemroot%\system32\EVENTCLS.DLL
    AllowInprocActivation    REG_DWORD    0xffffffff
    FireInParallel    REG_DWORD    0x0
    EventClassPartitionID    REG_SZ    {00000000-0000-0000-0000-000000000000}
    EventClassApplicationID    REG_SZ    {00000000-0000-0000-0000-000000000000}


C:\Windows\system32>

Let me know if there is anything else you need.

NoelDP · 24 Nov 2014

As far as I can see, that's all normal.... which leaves me wondering where to look next

Let's try re-registering the dll.

Open an Elevated Command Prompt, and run the following command

REGSVR32 EVENTCLS.DLL

You may get a 'success' popup - if not, what is the exact error message?

themexican · 24 Nov 2014

When i tried the command i got this message (attached):

The module "eventcls.dll" was loaded but the call to DllRegisterServer failed with error code 0x80070715.
For more information about this problem, search online using the error code as a search term.
[OK]

I found a tool (here) but i am hesitant to install anything that i "fixes" registry.