Author Topic: Windows 7 Ult 64 bit trapped by BSD and can not get out. (Read 192229 times)

FreeCat · « **Reply #225 on:** March 29, 2018, 08:46:11 am »

OK, boggin,
I ran SURT.
It just --- sort of --- installs.
And the CBS log looks like this (3-27 is the first one):
=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2018-03-27 15:42

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f) CSI Payload File Missing 0x00000000 MSDTC.LOG amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229

Summary:
Seconds executed: 1003
Found 1 errors
CSI Payload File Missing Total count: 1

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2018-03-29 10:42

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 1091
No errors detected
===
However, Windows update still gives the message:

Error(s) found:
Code 80070422

I tried SFC /Scannow, and I got the message "Windows Resource Protection could not start the repair service."

What should I try next?

Boggin · « **Reply #226 on:** March 29, 2018, 09:12:18 am »

Let's try again - didn't realize you had posted two Checksur logs.

Can you boot up with your install disk and navigate to the Install screen and click on Repair your computer and select Command Prompt.

At the prompt enter bcdedit |find "osdevice" and using that partition letter instead of the X I have exampled, enter -

sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows

For clarity, that's a Pipe symbol before find and note the space before each /

FreeCat · « **Reply #227 on:** March 29, 2018, 08:07:12 pm »

OK, Boggin. I ran the repair exactly as you specified. It said that it would take a while; it did.
At the end, the final message was "System has no integrity problems."

OK, so what is next, Boggin. And, thanks for you help.

Boggin · « **Reply #228 on:** March 30, 2018, 02:58:38 am »

See if a sfc /scannow will now run in normal mode and if it does without reporting it is unable to repair some files, try your updates again.

If they still fail, then post the error code.

If the sfc /scannow still fails to run then go into Event Viewer to see what that reports.

FreeCat · « **Reply #229 on:** March 30, 2018, 07:21:24 am »

Well, Windows comes up (pretty fast) but there is a black desktop; the mouse moves around but can not get task bar or task manager with Ctrl-alt-Del.

I shut if off and tried again and had the option for safe mode, etc. I choose normal again and same thing happened: black desktop and mouse.

What do you suggest, Boggin?

Boggin · « **Reply #230 on:** March 30, 2018, 08:54:28 am »

Can you boot it up into the advanced boot options to see if Last Known Good Configuration will get you back in normally ?

FreeCat · « **Reply #231 on:** March 30, 2018, 10:25:03 am »

Hi - I guess I do not know how to get to advanced options. Only choice was normal, safe with networking or command prompt. I am in safe mode now. Well, not really safe mode.

Safe mode has same thing. Black screen and mouse.

OK, I am trying F8 now. OK, normal desktop.

I will try repair scan now on H DD windows.

Same message "Windows resource Protection could not start the repair service."

What to look for in Event Viewer?

FreeCat · « **Reply #232 on:** March 30, 2018, 12:07:00 pm »

EV ATTACHED HERE.

Boggin · « **Reply #233 on:** March 30, 2018, 01:33:59 pm »

When you tap F8 as you switch on, look down the list of options where you will see Last Known Good Configuration and select that to see if you get a normal boot after the reboot.

Which Event ID immediately followed the failed sfc /scannow

FreeCat · « **Reply #234 on:** March 30, 2018, 02:37:40 pm »

OK - I ran SFC again and posted the time and started the EV right after.
ATTACHED

Boggin · « **Reply #235 on:** March 30, 2018, 02:39:58 pm »

Are you back in normal mode now ?

Can you click on Administrative Events in Event Viewer or on Event Viewer (Local) for the errors - those are just info.

FreeCat · « **Reply #236 on:** March 30, 2018, 02:44:08 pm »

Yes, normal mode:

EVENT CODE for that event:

+ System

- Provider

[ Name] VSS

- EventID 8224

[ Qualifiers] 0

Level 4

Task 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2018-03-30T20:29:10.000000000Z

EventRecordID 1144632

Channel Application

Computer M764-140-DQ64G3

Security

- EventData

2D20436F64653A2020434F525356434330303030303737332D2043616C6C3A2020434F525356434330303030303735352D205049443A202030303030353738382D205449443A202030303030343238342D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820

Binary data:

In Words

0000: 6F43202D 203A6564 524F4320 43435653
0008: 30303030 33373730 6143202D 203A6C6C
0010: 524F4320 43435653 30303030 35353730
0018: 4950202D 20203A44 30303030 38383735
0020: 4954202D 20203A44 30303030 34383234
0028: 4D43202D 20203A44 575C3A43 6F646E69
0030: 735C7377 65747379 5C32336D 76737376
0038: 78652E63 20202065 7355202D 203A7265
0040: 656D614E 544E203A 54554120 49524F48
0048: 535C5954 45545359 53202C4D 533A4449
0050: 352D312D 2038312D

In Bytes

0000: 2D 20 43 6F 64 65 3A 20 - Code:
0008: 20 43 4F 52 53 56 43 43 CORSVCC
0010: 30 30 30 30 30 37 37 33 00000773
0018: 2D 20 43 61 6C 6C 3A 20 - Call:
0020: 20 43 4F 52 53 56 43 43 CORSVCC
0028: 30 30 30 30 30 37 35 35 00000755
0030: 2D 20 50 49 44 3A 20 20 - PID:
0038: 30 30 30 30 35 37 38 38 00005788
0040: 2D 20 54 49 44 3A 20 20 - TID:
0048: 30 30 30 30 34 32 38 34 00004284
0050: 2D 20 43 4D 44 3A 20 20 - CMD:
0058: 43 3A 5C 57 69 6E 64 6F C:\Windo
0060: 77 73 5C 73 79 73 74 65 ws\syste
0068: 6D 33 32 5C 76 73 73 76 m32\vssv
0070: 63 2E 65 78 65 20 20 20 c.exe
0078: 2D 20 55 73 65 72 3A 20 - User:
0080: 4E 61 6D 65 3A 20 4E 54 Name: NT
0088: 20 41 55 54 48 4F 52 49 AUTHORI
0090: 54 59 5C 53 59 53 54 45 TY\SYSTE
0098: 4D 2C 20 53 49 44 3A 53 M, SID:S
00a0: 2D 31 2D 35 2D 31 38 20 -1-5-18

Boggin · « **Reply #237 on:** March 30, 2018, 02:48:54 pm »

I was adding to my last post as you were writing yours - that event is only info and not an error.

Can run a chkdsk /f to see what that reports.

I'm not sure if I've already explained how to view its log but in Event Viewer expand Windows Logs - click on Application - Action/Find then type chkdsk or wininit into the Find box and press enter.

Cancel the Find box and read the log in the scrollable pane below.

FreeCat · « **Reply #238 on:** March 30, 2018, 03:09:24 pm »

I am confused.
In the search for wininit and for chkdsk, the only events are in September of 2017.

For example:
Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
3043584 file records processed. File verification completed.
43520 large file records processed. 0 bad file records processed. 2 EA records processed. 278 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
3396284 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)...
3043584 file SDs/SIDs processed. Cleaning up 149 unused index entries from index $SII of file 0x9.
Cleaning up 149 unused index entries from index $SDH of file 0x9.
Cleaning up 149 unused security descriptors.
Security descriptor verification completed.
176351 data files processed. CHKDSK is verifying Usn Journal...
54420504 USN bytes processed. Usn Journal verification completed.
Windows has checked the file system and found no problems.

1953019903 KB total disk space.
1463051716 KB in 2785144 files.
1297792 KB in 176352 indexes.
0 KB in bad sectors.
3228919 KB in use by the system.
65536 KB occupied by the log file.
485441476 KB available on disk.

4096 bytes in each allocation unit.
488254975 total allocation units on disk.
121360369 allocation units available on disk.

FreeCat · « **Reply #239 on:** March 30, 2018, 03:14:41 pm »

I must have run check disk (since the problems begain last Summer at leat 15 times). Never an error that I recall. Attached is one I just ran without /F (by accident) as I did not want to reboot. But, I will run again with /F and reboot if you want.

Boggin · « **Reply #240 on:** March 30, 2018, 04:16:18 pm »

Well that looks okay.

Did you manage to find your way in Event Viewer to see the errors for when sfc /scannow failed to run ?

FreeCat · « **Reply #241 on:** March 30, 2018, 04:40:40 pm »

Howdy - No, the wininit and chkdsk were from September 2017. All that I found I have posted.

FreeCat · « **Reply #242 on:** March 30, 2018, 04:51:26 pm »

windows update also has same error. ATTACHED
IS IT NOT A LITTLE WEIRD THAT wu SAYD nEVER ON RECENT CHECK AND INSTALLED?
Sorry caps.

Boggin · « **Reply #243 on:** March 31, 2018, 12:13:18 am »

You should get a log when you use a parameter with chkdsk.

Can you try a sfc /scannow again then go straight into Event Viewer to see what error has been produced.

In Event Viewer ensure Event Viewer (Local) is highlighted in the left pane - if it isn't then just click on it.

FreeCat · « **Reply #244 on:** March 31, 2018, 07:46:36 am »

OK, Boggin,I did what you asked, below.
But, I have no idea what to look for in Event Viewer.
Should we ask someone in Bleeping Computer at this point?

Boggin · « **Reply #245 on:** March 31, 2018, 08:31:53 am »

According to that, it hasn't recorded anything for its failure as it would have been listed as an error within the last hour.

Can you go Start - type services.msc and press enter.

Scroll down to Windows Module Installer and click on it then on Start in the left pane and then try the sfc /scannow again.

The default setting for that service is Manual - if isn't and shows as Disabled, right click on it and select Properties then use the dropdown to change it to Manual - Apply - OK

Or you could change it to Auto and click on Start before Apply - OK

Click on File/Exit to close the Services window.

There is an elevated cmd you can use to start the Module Installer but we need to see what its status is.

The cmd is net start trustedinstaller

FreeCat · « **Reply #246 on:** March 31, 2018, 08:57:04 am »

OK, SFC is running "will tkae a long time" - Sorry that I forgot, but where do I look for sfc results or should I just trywindows update again when sfc done. Thanks.

Boggin · « **Reply #247 on:** March 31, 2018, 09:10:10 am »

It depends upon what the sfc /scannow reports.

If it reports no integrity violations then we are no further forward and I would be contemplating a repair install if you still get that update error.

Hopefully it will report that it has repaired all files but if it reports that it was unable to repair some and as the offboot sfc /scannow reported no integrity violations, then I would still be contemplating a repair install.

If it reports that it cannot repair some files then you can copy & paste this cmd which will produce an icon on the desktop which when double clicked will open the CBS log in Notepad.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txt

Right clicking on that - Send to - Compressed .zip will give you a file that you can attach to the reply box.

This is a cut down version of the CBS log which says what it has and couldn't repair.

If it reports that then you're still looking at a repair install.

FreeCat · « **Reply #248 on:** March 31, 2018, 11:40:53 am »

HOWDY - GREAT! BOGGIN!

Sfc worked and updates found and ready to installed.
See attached picture.
But, could not get the sfc log to display - there was an error message - see picture.
So, I am applying the updates and will report when done.

FreeCat · « **Reply #249 on:** March 31, 2018, 01:01:26 pm »

OK, so update still going and looks like it will take quite a while.
I will keep you posted.
When you have time tell me what went wrong about displaying the CBS log. Thanks.

BTW, the King and Queens of Easter Bunnies are wearing crowns. What are their crowns made of?

Happy Easter!