installation - IIS 7 fails to install on Windows 7, despite attempts at Windows Fix It tool, removal/reinstallation of .NET 3.5, etc

I'm not exactly the first person to run into issues getting IIS 7 to install on a Windows 7 machine, but so far, nothing has really managed to fix the problem. When I try to install IIS 7, I get this message:

An error has occurred. Not all of the features were successfully changed.

This also occurs if I try to do a full installation, instead of a basic installation, of .NET Framework 3.5.

I've tried several other things to fix the IIS 7 issue:

• Uninstalling .NET 3.5, rebooting, reinstalling .NET 3.5 (basic installation), then installing IIS 7.




• Uninstalling .NET 3.5, rebooting, not reinstalling it, but just going ahead and installing IIS 7.




• Running the Windows Fix It tool. (It detected there was something wrong with installing IIS 7, but it ran into its own error of some sort while trying to fix it.)




• After the Windows Fix It tool managed to fix some other things successfully, grabbing a bunch of Windows updates, rebooting, then installing IIS 7.




• Making sure HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Start is set to 3, instead of 4.




• Etc.

From when I had the same issue on the same computer several months ago and eventually just moved on, this is logged several times at the top of iis7.log:

[06/23/2014 20:47:57] [ ***** IIS 7.0 Component Based Setup ***** ]
[06/23/2014 20:47:57] "C:\Windows\System32\inetsrv\iissetup.exe" /launch C:\Windows\System32\inetsrv\appcmd.exe reset config -section:system.applicationHost/applicationPools
[06/23/2014 20:47:57] Launching command C:\Windows\System32\inetsrv\appcmd.exe, with params C:\Windows\System32\inetsrv\appcmd.exe reset config     -section:system.applicationHost/applicationPools
[06/23/2014 20:47:58] LaunchCommand Succeeded
[06/23/2014 20:47:58] Success!

After several of those, and before several more, this was logged:

[06/23/2014 20:47:59] [ ***** IIS 7.0 Component Based Setup ***** ]
[06/23/2014 20:47:59] "C:\Windows\System32\inetsrv\iissetup.exe" /install SharedLibraries
[06/23/2014 20:48:00] Successfully added IIS_IUSRS ACE to DACL at %ProgramData%\Microsoft\Windows\WER\ReportQueue.
[06/23/2014 20:48:00] Created NetFrameworkConfigurationKey key containter
[06/23/2014 20:48:00] Created NetFrameworkConfigurationKey user key
[06/23/2014 20:48:00] Set ACLs on NetFrameworkConfigurationKey
[06/23/2014 20:48:00] Created iisWasKey key container
[06/23/2014 20:48:00] Created iisWasKey user key
[06/23/2014 20:48:00] Created iisConfigurationKey key container
[06/23/2014 20:48:00] Created iisConfigurationKey user key
[06/23/2014 20:48:00] Set ACLs on iisConfigurationKey
[06/23/2014 20:48:00] iisConfigurationKey already exists
[06/23/2014 20:48:00] Created AesProvider
[06/23/2014 20:48:00] Created IISWASOnlyAesProvider
[06/23/2014 20:48:00] Install of component SharedLibraries succeeded!
[06/23/2014 20:48:00] Success!
[06/23/2014 20:48:00] [ End of IIS 7.0 Component Based Setup ]

And the logs would evolve a little bit here and there, but one thing that was repeated some from last night's attempt was this:

[02/17/2015 21:12:29] [ ***** IIS 7.0 Component Based Setup ***** ]
[02/17/2015 21:12:29] "C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iissetup.exe" /launch_uninstall C:\Windows\System32\inetsrv\appcmd.exe clear config -section:system.webServer/security/applicationDependencies
[02/17/2015 21:12:29] < WARNING! > Failed to detect if config redirection is enabled. result=0x80070032.Assuming config is not redirected and continuing.
[02/17/2015 21:12:29] Launching command C:\Windows\System32\inetsrv\appcmd.exe, with params C:\Windows\System32\inetsrv\appcmd.exe clear config -section:system.webServer/security/applicationDependencies
[02/17/2015 21:12:29] Ignoring acceptable LaunchCommand failure 0x80070002
[02/17/2015 21:12:29] Success!
[02/17/2015 21:12:29] [ End of IIS 7.0 Component Based Setup ]

And finally we end with a few things like this (possibly from me trying to clean some things out for a few minutes at the very end last night):

[02/17/2015 21:12:30] [ ***** IIS 7.0 Component Based Setup ***** ]
[02/17/2015 21:12:30] "C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iissetup.exe" /uninstall SharedLibraries
[02/17/2015 21:12:30] < WARNING! > Failed to detect if config redirection is enabled. result=0x80070032.Assuming config is not redirected and continuing.
[02/17/2015 21:12:30] Uninstall of component SharedLibraries succeeded!
[02/17/2015 21:12:30] Success!
[02/17/2015 21:12:30] [ End of IIS 7.0 Component Based Setup ]

I did check on the 0x80070002 error, but researching that just led further down the rabbit hole. What else is liable to be holding IIS (and full .NET 3.5) back from being able to install? Thanks!

EDIT

This is a link to the CBS logs, as recommened in the comments:

https://onedrive.live.com/redir?resid=5D4A777E3F287EA8!109&authkey=!ABZ6iUqUubMhaA4&ithint=file%2czip

Answer

Credit really goes to magicandre1981.

Essentially this was due to the ZeroAccess rootkit, and using ESETSirefefCleaner and RogueKiller - at least RogueKiller - was pretty much able to either eliminate it or at least get it out of the way enough to install IIS.

---

I don't remember all the steps very clearly. At one point, magicandre1981 suggested posting the logs out of the CBS folder, and he was able to spot a file not found exception. He suggested using sfc /scannow.

Every time I ran it though, it kept failing at somewhere around 65%. CHKDSK basically didn't help at all. Running sfc /scannow in Safe Mode, and maybe a couple of other things as well, didn't do much good either.

Later though, I tried using sfc /verifyonly, and it said stuff was corrupted. Looking in the CBS log afterward, there were four Error log lines grouped right there together, the first one saying things like (F) STATUS_FILE_IS_A_DIRECTORY and "\SystemRoot\WinSxS\amd64_security-malware-windows-defender-events_31bf3856ad36‌​4e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll".

Looking it up on the Internet, it looked like apparently ZeroAccess is known to warp things around that dll so that its path will reference the directory \Windows\system32\config, not the dll. There were people talking about this at http://www.sevenforums.com/system-security/290614-sfc-warning.html, and it seemed to be helpful, but the main suggestion didn't work completely in my particular case.

I did use ESETSirefefCleaner though, and the dll problem seemed to persist. I tried several times and played with it for a little bit, but even if it helped the problem some, it didn't take it away entirely. Apparently other people though have been able to fix the dll's problem entirely with that program, so I guess it really depends on each person's situation.

A longer suggestion I saw somewhere involved running something like five or six different programs to get rid of this thing, including ESETSirefefCleaner and RogueKiller, but also Combofix. But going from other sources, apparently Combofix is pretty dangerous to use, and for other reasons as well, I just decided to run RogueKiller and see what happened. Sure enough, after using ESET and RogueKiller, sfc /verifyonly and sfc /scannow were both able to complete just fine and without detecting any problems, the dll looked normal, and IIS was able to be installed.