W7 x64 component corruption. Tried everything

CompromisedSituation · Mar 1, 2019

I have the same problem as many other people.
Windows 7 got Russian malware at some point and has some corruption.
Updates never managed to install since last April (maybe battery ran out during installation and it's unrelated to that malware though).
What I already did:

did memory tests
sfc /scannow many times
repaired and uninstalled avast
Dism for windows 7 / KB947821 many times
tweaking.com repair tool.
C++ redistributables updater tool.
sfcfix
Reinstalled MDAC (sort of fails!).

Some steps fixed things at some point (particulartly KB947824 once took like lots of hours).
Any help would be appreciated.
Thanks.

PeterJ · Mar 2, 2019

Hello and welcome,

Follow the instructions below please.

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

Download the attachment SFCFix.zip and save it on your desktop.
Save any work you have open, and close all programs.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Open the file, then copy and paste its content in your next reply.

CompromisedSituation · Mar 2, 2019

Apparently it succeeded:

SFCFix is attached.

I think I should run KB947821 and sfc or sfcfix, shouldn't I?

PeterJ · Mar 2, 2019

I think I should run KB947821 and sfc or sfcfix, shouldn't I?

No. Is Avast still installed and if so, which version ?

I need to have a look at the COMPONENTS hive.

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again. Note: If you find that you need to reboot and are unable to because this is a server then try Option#2 below.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.

Option#2 (only if you are unable to follow the previous instructions)

Please download the Freeware RegBak from here: Acelogix Software - Download products
You will find it at the bottom of the page that the link brings you to.
Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
Click the New Backup button. Accept the defaults and simply click Start.
When it says Finished successfully, click the Close button.
This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, one of which is named COMPONENTS.
Copy the COMPONENTS file to your Desktop. If the COMPONENTS file does not exist, please fetch it instead from C:\Windows\System32\config\COMPONENTS.
Now right-click on the COMPONENTS file that is on your desktop and select Send to > Compressed (zipped) folder.
Then please upload the zip file (COMPONENTS.zip) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Filedropper or One Drive or SendSpace and then just provide the link in your reply.
You can close any open windows you have as well as the RegBak program now.

CompromisedSituation · Mar 2, 2019

AVAST (last version, personal use) is uninstalled. I plan on reinstalling it later.
components.7z

CompromisedSituation · Mar 2, 2019

At some point I used AVAST clean tool and reinstalled it. I also repaired AVAST in Add/Remove Programs. But currently uninstalled.

PeterJ · Mar 2, 2019

Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

Download the Farbar Recovery Scan Tool and save it to your Desktop:
64-bit: Downloading Farbar Recovery Scan Tool
Download the attachment fixlist.txt and save it to your desktop.
Right-click on FRST64.exe and select "Run as administrator".
Press the Fix button.
The tool will now process fixlist.txt.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
Post the log file Fixlog.txt as attachment in your next reply.

CompromisedSituation · Mar 2, 2019

Thank you very much for all this.
Fixlog attached.
(Everything succeeded...)
Everything succeeded.

PeterJ · Mar 2, 2019

Great.

Step 1: SFCFix Scan
Save any work you have open, and close all programs.
Double-click

SFCFix to launch this program, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Open the file, then copy and paste its content in your next reply.

Step 2: SURT scan
Start the System Update Readiness Tool (SURT) again.
On completion, attach the logfile C:\Windows\Logs\CBS\CheckSUR.log in your next reply.

CompromisedSituation · Mar 3, 2019

Thank you.

Step1:
SFCFix version 3.0.1.0 by niemiro.
Start time: 2019-03-03 21:05:09.844
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.

AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 0
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 8
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.1.0 by niemiro has completed.
Currently storing 8 datablocks.
Finish time: 2019-03-03 21:07:04.870
----------------------EOF-----------------------

CompromisedSituation · Mar 3, 2019

Is it done? Should I run Windows Update now?

PeterJ · Mar 3, 2019

Should I run Windows Update now?

Yes, report the result please.

CompromisedSituation · Mar 4, 2019

Windows update failed.
I ran sfcfix again, it did not find anything.
sfc /scannow produced the following log, which has some STATUS_SXS_ASSEMBLY_MISSING
CBS - copia (2).7z

PeterJ · Mar 4, 2019

Follow the instructions below please.

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

Download the attachment SFCFix.zip and save it on your desktop.
Save any work you have open, and close all programs.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Open the file, then copy and paste its content in your next reply.

CompromisedSituation · Mar 6, 2019

I did that. Windows Update still fails.

CompromisedSituation · Mar 6, 2019

SURT tool reports no corruption.
sfc /scannow doesn't mention corruption either.
nor does sfcfix

PeterJ · Mar 6, 2019

Remove Update Manually

Click on the Start button and in the search box, type Command Prompt.
When you see Command Prompt on the list, right-click on it and select Run as administrator.
When command prompt opens, copy and paste the following command into it, then press enter.
wusa /uninstall /KB:4088875
Let me know if it says it was successful or if there are any errors.

CompromisedSituation · Mar 6, 2019

It says that update is not installed on this computer.

PeterJ · Mar 6, 2019

Please do following:

FRST Registry Search

Click your Start button and choose Control Panel.
In the upper right corner ensure the View by: is set to Category.
Select the Programs group.
Click the Turn Windows features on or off link. This will bring up the Server Manager dialog.
Note: This loads your components hive which is what we want. Please keep this dialog open while you perform the remaining steps. You can minimize it if you wish but keep it open.
Right-click on the file FRST64.exe and choose Run as administrator.
Copy and paste KB4088875 into the Search box and click the Search Registry button.
When the scan is complete, a message will display that 'SearchReg.txt' is saved in the same folder FRST was started from. Notepad will open this file also. Close Notepad and attach the file 'SearchReg.txt' to your next reply.
You may close any remaining open windows now.

CompromisedSituation · Mar 6, 2019

File is attached.
Thank you very much for all this.

W7 x64 component corruption. Tried everything

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Attachments

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Member

Moderator, Windows Update Expert, Security Analyst

Attachments

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Member

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Attachments

Member

Attachments

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Moderator, Windows Update Expert, Security Analyst

Member

Attachments