[SOLVED] Win 7/x64 SFC fails, updates fail, even in-place Upgrade fails (malware cleaned)

[TThompson]

Working on a friend's PC, a Windows 7 Home Premium x64 system with a previously-cleaned malware infection. After the malware was cleaned, the PC would randomly reboot even when sitting idle. After further diagnosis, I found the RAM was bad! Ugh!

The RAM is replaced, passed MemTest86+ clean for 20 hours; hard drive passes SpinRite check and CHKDSK /R with no errors now. From a hardware standpoint I'm pretty confident the system is stable now. It hasn't BSOD crashed since.

I think the previous malware cleanup attempts were done with a few "expert" tools, and now the OS is a bit dodgy. Windows Update and SFC both fail, and even an in-place upgrade fails. :banghead:


Things already done:

• System Update Readiness Checker (see CheckSUR logs in the CBS.zip)
• SFC /SCANNOW fails with "Windows Resource Protection could not perform the requested operation", even when run offline from a Windows 7 boot DVD command prompt.
• Attempted an in-place upgrade which halts with error code 0x80070241, even after copying from DVD to USB hard drive and two different DVD media.

Based on my reading of the CBS.log it appears there are corrupt permissions or keys in the registry at HKLM\Components\DerivedData.

And to add insult to injury... SFCFix throws an unhandled exception error and records almost nothing the log file.

So... I'm ready to turn to the gurus at SysNative.com for help. Thanks!

----- SFCFix log -----

SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-04-21 23:30:46.162
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.








SFCFix version 3.0.0.0 by niemiro has encountered an unhandled exception.
Currently storing 0 datablocks.
Finish time: 2016-04-21 23:32:04.213
----------------------EOF-----------------------

 

[BrianDrab]

Hi and welcome to Sysnative. Sorry for the delay. Looks like the bad RAM has made a mess of the registry. If you still need assistance, please do the following.

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.

 

[TThompson]

Given the extensive "weirdness" this system was suffering, I ended up doing the following:

1. Ran Windows 7 User Migration Tool to gather up all local profiles, a mere 9GB.
2. Cloned the hidden OEM recovery partition to a new SSD.
3. Hit the magic hotkey to reset it back to factory defaults.

After reinstalling just a few apps, everything was back to normal!

Thanks anyway for the offer of assistance. This was probably one situation where "nuke and pave" is safer, simply because of how terribly bad the RAM was. MemTest ran for 30 seconds and indicated many hundreds of errors in that brief time; there's no telling just how many files were corrupted in the combination of malware cleanup plus random bits getting flipped. Ouch.

 

[BrianDrab]

Agreed. Thanks for letting me know.