Windows 7 Update error 800706BA

ptrthgr8 · 10 Nov 2014

NoelDP said:

The CheckSUR log is in the C:\Windows\Logs\CBS folder - or should be!

It's not there. See attachments.

And I confirmed that I've got the folder options selected to show hidden files, drives, etc.

NoelDP · 11 Nov 2014

OK - try running the CheckSUR tool again and see if it completes properly.
Usually, the only time no CheckSUR.log file is created is because the 'install' crashes before it gets a change to do anything.

ptrthgr8 · 11 Nov 2014

I hadn't actually run the CheckSUR tool before... I wasn't instructed to do so. :) I guess that's why the log wasn't where it should have been. :)

I went here and downloaded the Win7 x64 version of the tool:

Download System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [October 2014] from Official Microsoft Download Center

The tool ran for almost 15 mins on the dot before completing. I then checked the Logs folder and found two new CheckSUR logs. Since one is a persist log I'm guessing that's not a good sign. Both are attached.

~ Greg ~

NoelDP · 11 Nov 2014

Ah - you obviously didn't read the instructions properly, then

... but then for some reason I never directed you at the WU Posting instructions....

(Dunno why you had a CheckSUR directory if you'd never run CheckSUR before!)

CheckSUR is clear - Try Windows Update, installing ONLY the oldest update found.
If it installs OK, try the rest.
If not, post the C:\Windows\windowsupdate.log file

ptrthgr8 · 11 Nov 2014

Of the 5 updates listed, I ran KB2923545 first - it's date was 25 Feb 2014. One update was from June and the other 3 are from October.

I ran the update and it immediately showed 11% of 5.1MB downloading, but then it hung there for 15 mins before failing again with the newer error message (per post #8). Screen shots and update log attached.

Thanks again, Noel!

NoelDP · 11 Nov 2014

here's the error sequence from the attempt...

Code:

2014-11-11 09:48:18:249 1292 2c94 Handler FATAL: CBS called Error with 0x80070426, 
2014-11-11 09:48:18:249 1292 31e4 Handler FATAL: UH: 0x80070426: Async stage operation failed in CUHCbsHandler::StageCbsPackage
2014-11-11 09:48:18:249 1292 31e4 Handler FATAL: Request generation for CBS update complete with hr=0x80070426 and pfResetSandbox=0 
2014-11-11 09:48:18:249 1292 31e4 Handler FATAL: Error source is 106.
2014-11-11 09:48:18:249 1292 31e4 DnldMgr FATAL: DM:CAgentDownloadManager::GenerateAllDownloadRequests: GenerateDownloadRequest failed with 0x80070426.
2014-11-11 09:48:18:249 1292 31e4 DnldMgr Error 0x80070426 occurred while downloading update; notifying dependent calls.
2014-11-11 09:48:18:468 1292 31e4 Agent *********
2014-11-11 09:48:18:468 1292 31e4 Agent **  END  **  Agent: Downloading updates [CallerId = AutomaticUpdatesWuApp]

This implies that there's a service not properly configured...

Please downloadthe Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click onthe saved file and select 'Run as Administrator', and tick all the options,then click on the Scan button - copy and paste the report to your response.

ptrthgr8 · 11 Nov 2014

Here's the output:

Farbar Service Scanner Version: 21-07-2014
Ran by Greg (administrator) on 11-11-2014 at 11:12:07
Running from "C:\Users\Greg\Desktop\Update Issue"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Action Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A} key. The key does not exist.

Windows Update:
============
cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc: "%SystemRoot%\system32\cryptsvc.dll".

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2014-07-09 21:32] - [2014-05-30 00:45] - 0497152 ____A (Microsoft Corporation) FA886682CFC5D36718D3E436AACF10B9

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2014-06-10 21:34] - [2014-04-04 20:47] - 1903552 ____A (Microsoft Corporation) 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E

C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll
[2014-08-01 10:00] - [2014-05-14 10:23] - 2477536 ____A (Microsoft Corporation) 61FF576450CCC80564B850BC3FB6713A

C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll
[2014-10-16 04:56] - [2014-07-06 20:06] - 0187904 ____A (Microsoft Corporation) 19D511CC455C19DE1ADF60E6C39C85B6

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

NoelDP · 11 Nov 2014

That seems to be basically OK, apart from these errors...

Code:

 
Action Center:
 ============
 
 Action Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A} key. The key does not exist.
 
 
 Windows Update:
 ============
 cryptsvc Service is not running. Checking service configuration:
 The start type of cryptsvc service is OK.
 The ImagePath of cryptsvc service is OK.
 The ServiceDll of cryptsvc: "%SystemRoot%\system32\cryptsvc.dll".

I need to work out how best to approach these - back tomorrow.

ptrthgr8 · 11 Nov 2014

Roger that. Thanks, Noel.

ptrthgr8 · 12 Nov 2014

Some new info. I got to my machine this afternoon and I noticed that 9 new updates (7 for Office, 1 for .Net, and 1 Malicious Software removal tool) had been installed successfully and now there are 12 other updates published yesterday that are waiting to be installed. It looks like the update process errored out again, though.

The same 5 updates that were causing issues are still on the list of pending updates, so I deselected them from the list and tried to install only the 12 new updates - but it still fails to complete with the same error code (80070426).

I've attached screenshots of the update screen, update history, and the latest update log in case that provides any new info.

Thanks!