0x800736B3 installing KB2937610 on Win7 x64

[sparx96]

Hi,

Recently my Win7 x64 failed to install 2 updates, with errors as follows:

1) Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 and Windows Server 2008 R2 SP1 for x64-based Systems (KB2937610)
Installation date: ‎21/‎08/‎2014 3:55 PM
Installation status: Failed
Error details: Code 800736B3

2) Update for Windows 7 for x64-based Systems (KB2492386)
Installation date: ‎21/‎08/‎2014 6:40 PM
Installation status: Failed
Error details: Code 80070057

I have been repeatedly trying to install these for the past few weeks without success.

I have tried every MS FixIt that I could find, eventually ending up here on these forums - and it seems there is much experience here in solving these issues.

Then I had some hard disk issues related to a power outage.

Over the past few days I have been trying to get these installed again, and noted some other bizarre bahaviour:
- The list of installed updates is completely empty - as if I had never installed any updates. I always install the updates every month...
- The 'Turn windows features on or off' dialog box is also completely empty. Not that I use it (or need to right now) but I would like to have this option again in the future.

I have completed several chkdsk /f of the disk and there are no errors reported now. However I feel that the power outage has corrupted either the registry, the manifests, the manifest cache, or something around one or more of these. Why? 2 reasons:

1) In my CheckSURT.log there are references to amd64_Eindows... Note the E where there should be a w.

2) In the CBS.log (produced from sfc /scannow) it keeps mentioning that the system.dll from Net-FX is missing (or words to that effect "Cannot repair member..."). The package mentioned is the KB2942599 which I have tried reinstalling manually but without success (as my system believes it is already installed, despite the 'Installed updates' list being completely empty...)

I have attached the CBS.zip and CheckSUR.zip as requested. I would include screenshots showing the empty 'Installed updates' and 'Turn win features on/off' but everyone knows what they look like I am certain...

Any help with this will be very much appreciated.

--
Kind Regards
sparx96

 

[NoelDP]

There's the summary from your CheckSUR log...

Summary:
Seconds executed: 559
 Found 42 errors
  CSI Could Not Open file Total count: 1
  CSI Missing Identity Total count: 1
  CSI Replacement File: CreateFile Failed Total count: 16
  CSI Payload File Missing Total count: 1
  CBS Registry Error Total count: 4
  CBS Watchlist Package Missing Total count: 26
  CBS Watchlist Component Missing Total count: 5
  CSI Missing Winning Component Key Total count: 4

Looking at the detail results, many of them appear to be the result of bitflips - often caused by failing hardware (most often RAM).


As you saw, the SFC result shows just the one problem...

 Line 3453: 2014-08-24 18:18:13, Info                  CSI    00000302 [SR] Repairing 1 components
 Line 3454: 2014-08-24 18:18:13, Info                  CSI    00000303 [SR] Beginning Verify and Repair transaction
 Line 3455: 2014-08-24 18:18:13, Info                  CSI    00000304 [SR] Cannot repair member file [l:20{10}]"System.dll" of NetFx-System, Version = 6.1.7601.17966, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

I'll post a fix for the file error later - in the meantime, please do the following...

1) Test your RAM using Memtest86++ by following this tutorial - http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html run at least 3 full passes and let us know what happens.

2) upload your COMPONENTS registry hive...

I need to have a look at your COMPONENTS registry hive

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

 

[sparx96]

Actually that's the one thing I neglected to add in the first post.

ie: that I had installed an extra 4GB RAM about a week ago only to discover 3 days ago that *it* was the root cause of the corruptions I now face.

Very well picked up!

Yes, I have already run memtest86 on that RAM, discovered it was bad (from 6213.4MB to 6213.5MB failed consistently - it was literally just 100-200kB that failed every test), removed and replaced it, and re-run memtest86 successfully with the replacement 4GB. Pity we cannot 'format' RAM and mark them as bad sectors - a waste of otherwise healthy 4GB...

I will upload the components hive soon and post a link then.

Edit: ...and here it is...
https://dl.dropboxusercontent.com/u/39059978/sevenforums/COMPONENTS.7z

Thank you for such great detective work already...

 

[NoelDP]

I've uploaded a file - s96aa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\s96aa
hit the enter key - if you get a 'Not Found' error try
DIR D:\s96aa
or
DIR E:\s96aa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\s96aa <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[sparx96]

Thanks for your help.

sfc /scannow reports no issues.

cbs.log is seemingly full of pending move's - not sure how to interpret those.

CBS-old.log is immediately after the Repair Mode/Xcopy reboot. I ran it twice in succession. Noting the pending moves, I rebooted again, then ran sfc again producing CBS.log. The pending moves persist

Both are in the attached.

Thanks again for your help.

 

[NoelDP]

The pending moves are normal, and can be ignored (there is a way to clear them - but I prefer to leave well alone)
The SFC is clear now, so I'll get to work on the Components hive and see what I can fix in there.

 

[NoelDP]

I've uploaded a file - s96ab.zip - to my OneDrive at Noel's OneDrive (it may take a while - try again every hour or so)
Please download and save it to your desktop.
Right-click on the file and select Extract All, and save to the default destination (which should be a folder on the desktop)

Create a new System Restore point

Open an Elevated Command Prompt, and run the following commands.

REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1
COPY %userprofile%\desktop\s96ab\COMPONENTS C:\Windows\System32\config

If you get an error with either command, STOP THERE - do not reboot! - post for instructions.

Assuming both commands go OK, reboot, and run another CheckSUR scan - post the new CheckSUR.log file.

 

[NoelDP]

I next need a copy of your SOFTWARE hive - which isn't as easy to get at
Please boot to the Repair Environment and copy the file using the command

COPY C:\Windows\System32\config\SOFTWARE <drive>:\s96aa

(where <drive> is the same drive letter you found above for the file replacement)
Then boot back into Windows, zip the file C:\s96aa\SOFTWARE and upload it to a reply.
I'll try and tackle the bitflips there - and a couple of other things, while I'm at it!

 

[sparx96]

Hi Noel.

The rename/copy succeeded for the component hive.

I renamed the existing CBS directory and created a new one just prior to re-running checksur.

Fresh logfiles were created, these are attached (both checksur.log and cbs.log are in the one zip).

CheckSUR summary follows (a little frightening but it appears to have been able to resolve most of them...

Summary:
Seconds executed: 1120
Found 43052 errors
Fixed 43013 errors
CSI Missing Component Key Total count: 5057
Fixed: CSI Missing Component Key. Total count: 5057
CSI Missing Pinned Component Key Total count: 3525
Fixed: CSI Missing Pinned Component Key. Total count: 3525
CSI Corrupt Component Keyform Total count: 1
CSI Missing Identity Total count: 8583
Fixed: CSI Missing Identity. Total count: 8583
CSI Missing C Mark Total count: 14041
Fixed: CSI Missing C Mark. Total count: 14041
CSI F Mark Missing Total count: 15331
Fixed: CSI F Mark Missing. Total count: 15331
CBS Registry Error Total count: 4
CBS Watchlist Package Missing Total count: 26
CBS Watchlist Component Missing Total count: 5
CSI Missing Winning Component Key Total count: 4
Fixed: CSI Missing Winning Component Key. Total count: 1

Many thanks again for your help to date.

 

[sparx96]

Software hive can be found here (circa 14MB hence too large to attach in this forum):

https://dl.dropboxusercontent.com/u/39059978/sevenforums/SOFTWARE.7z

Many thanks for your continuing help.

 

[NoelDP]

Here's the residual error-list from the CheckSUR log...

Checking Package Watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~0.0.0.0 Package_2_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~bg-BG~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~et-EE~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~hr-HR~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~lt-LT~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~lv-LV~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~ro-RO~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~sk-SK~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~sl-SI~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~sr-LATN-CS~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~th-TH~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerFoundation-Base-LanguagePack-Package~31bf3856ad364e35~amd64~uk-UA~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~bg-BG~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~et-EE~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~hr-HR~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~lt-LT~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~lv-LV~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~ro-RO~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~sk-SK~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~sl-SI~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~sr-LATN-CS~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~th-TH~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~uk-UA~0.0.0.0 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 WinEmb-Installers-AppCompat~31bf3856ad364e35~amd64~he-IL~0.0.0.0 Package_for_KB2492386_SP1~31bf3856ad364e5~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
Checking Component Watchlist
(f) CBS Watchlist Component Missing 0x80070002 amd64_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_0.0.0.0_none_8c1eca82f2d07e95 Package_;_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Component Missing 0x80070002 amd64_microsoft-windows-a..tigations.resources_31bf3856ad364e35_0.0.0.0_en-us_99b511b9905e5c0d Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Component Missing 0x80070002 amd64_microsoft-windows-a..tigations.resources_31bf3856ad364e35_0.0.0.0_en-us_99b511b9905e5c0d Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Registry Error 0x00000002 wow64_microsoft-indows-a..ence-mitigations-c5_31bf3856ad364e35_0.0.0.0_none_967374d527314090 Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect Failed to open store sub key
(f) CBS Watchlist Component Missing 0x80070002 x86_microsoft-windows-a..tigations.resources_31bf3856ad364e35_0.0.0.0_en-us_3d967635d800ead7 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Component Missing 0x80070002 x86_microsoft-windows-a..tigations.resources_31bf3856ad364e35_0.0.0.0_en-us_3d967635d800ead7 Package_5_for_KB2492386~31bf3856ad364e35~amd64~~6.1.1.0 Package registry presence failed, possibly an orphaned package on package watchlist
Checking Packages
(f) CBS Registry Error 0x00000002 Package_2_for_KB2492386~31bf3856ad364e35~amd64~~.1.1.0 Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\ Failed to open store sub key
(f) CBS Registry Error 0x80070103 Package_for_KB2492386_SP1~31bf3856ad364e35~amd64~~6.1.1.0  failed to get owner for package.
(f) CBS Registry Error 0x80070002 Package_for_KB2732059~31bf3856ad364e35~amd64~~6.1.5.1  failed to get Visibility

Now to see If I can do anything with it!

 

[NoelDP]

I've uploaded a file - s96ac.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the file and select Extract All, Save the contained SOFTWARE hive to the C:\ folder

Create a new System Restore point


Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\SOFTWARE
hit the enter key - if you get a 'Not Found' error try
DIR D:\SOFTWARE
or
DIR E:\SOFTWARE


The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...


REN <drive>:\Windows\System32\config\SOFTWARE SOFTWARE.OLD
COPY <drive>:\SOFTWARE <drive>:\Windows\System32\config

when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Then run CheckSUR again, and post the new log - with any luck that luck have reduced the error-count this time!

 

[sparx96]

Hi Noel,

We appear to be getting closer to resolving this, thanks to your efforts!

New logs attached - CheckSUR summary:

Seconds executed: 678
Found 37 errors
CSI Corrupt Component Keyform Total count: 1
CBS Registry Error Total count: 3
CBS Watchlist Package Missing Total count: 26
CBS Watchlist Component Missing Total count: 4
CSI Missing Winning Component Key Total count: 3

It is nice to see all numbers < 1000

<edit>
Oops - maybe I spoke too soon. Re-running a sfc /scannow fails:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.


Windows Resource Protection could not perform the requested operation.

New CBS.log with just the results from the sfc run are attached as sfc-log.zip. I ran it manually at 10:59:40am local time and 3 times again in quick succession - all with similar results. The earlier entries (at 10:50:04am) must be from windows auto checks, not sure.
</edit>

 

[NoelDP]

OK with luck I've now fixed the remaining bitflips - which could mean that the number of remaining errors drops to 34 - or it could leap again.

I've uploaded a file - s96ad.zip - to my OneDrive at Noel's OneDrive

Please repeat the procedure in post number 12 using that file - you'll need to delete the SOFTWARE file rather than renaming it this time. (we want to keep the original one which we renamed SOFTWARE.OLD for emergencies - the intermediate one from last time we can afford to lose)

 

[sparx96]

Hi Noel,

You were close to the mark 35 instead of 34 in the summary below.

CheckSUR summary:
Summary:
Seconds executed: 677
Found 35 errors
CSI Corrupt Component Keyform Total count: 1
CBS Registry Error Total count: 3
CBS Watchlist Package Missing Total count: 24
CBS Watchlist Component Missing Total count: 4
CSI Missing Winning Component Key Total count: 3

Fresh logs attached. (As before, I created a new CBS folder prior to the run. I left CheckSUR as plain log since it is so small, but zipped the CBS.log as it is > 3MB otherwise.)

Still cannot run sfc /scannow though - same error as before.

I cannot thank you enough for your efforts to date.

 

[NoelDP]

OK - that's good - the remaining error that I'd hoped to have fixed is a relatively minor one.
Now I have to figure out how to best fix the others!

Busy day today - it may be tomorrow before I can get back to you.

 

[sparx96]

That's no problem Noel, you deserve a day off for the great work you've done to date helping me with this.
--
Cheers
sparx96

 

[NoelDP]

Thanks for the encouragement - I need to have a look at your COMPONENTS hive now...

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

 

[sparx96]

Thank you Noel.

New components.7z available here:

https://dl.dropboxusercontent.com/u/39059978/sevenforums/COMPONENTS.7z

 

[Groucho]

I've been having all sorts of the same issues with KB2937610 throwing up this same error code... after looking around for fixes I found just Hotfix for Windows (KB947821) and this has fixed the problem and the update has finally worked.