An other case of Monthly

[Joe7]

An other case of Monthly Rollup install issue

Hi all, I'm having troubles with Security Monthly Quality Rollups: I cant' install the last of march, and if I hide it, winupdate finds the one of previous month. So I hid all them back until April 2018 monthly roll-up.
Now winupdate doesn't complain anymore, seems up to date... but if I restore the last roll up, WU finds it and fails to install. I think the next month I will notice the same behavior when the new monthly rollup will be released.

ZIP attachment contains various logs:
- CBS.log
- WinodwsUpdate.log
- CheckSUR.log
- some others "persist" logs

Zipped logs file exceeds the forum size limit for compressed archives. You can download logs at:
Dropbox - win7logs.zip


Here a piece of CBS.log referring to March Monthly Rollup (KB4489878) install (downloaded by hands, after many tries failed by automatic update):

2019-03-19 00:58:54, Info                  CSI    INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x7823db8
  Stage (1): flags: 8 app: [Microsoft-Windows-IE-LowReg, Version = 11.2.9600.19301, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x7823ff8
  Stage (1): flags: 8 app: [Microsoft-Windows-IE-LowReg, Version = 11.2.9600.19301, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x7824238
  Stage (1): flags: 8 app: [Microsoft-Windows-IE-JSProfilerUI, Version = 11.2.9600.19301, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x7824478
  Stage (1): flags: 8 app: [Microsoft-Windows-IE-JSProfilerUI, Version = 11.2.9600.19301, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x78246b8
  Stage (1): flags: 8 app: [Microsoft-Windows-IE-JavaScriptCollectionAgent, Version = 11.2.9600.19301, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x78248f8
2019-03-19 00:59:05, Error                 CSI    000004b1@2019/3/18:23:59:05.115 (F) d:\w7rtm\base\wcp\componentstore\storelayout.cpp(11568): Store corruption detected in function ComponentStore::CRawStoreLayout::CheckFamilyIndexForDeadWinnerComponent expression: (null)
  MissingWinningComponentKey on resource [85]"amd64_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.19135_none_ca3a5b9728ab07df"[gle=0x80004005]
2019-03-19 00:59:10, Error                 CSI    000004b2 (F) STATUS_SXS_COMPONENT_STORE_CORRUPT #1476705# from CCSDirectTransaction::OperateEnding at index 76 (0x000000000000004c) of 256 (0x0000000000000100) operations, disposition 0[gle=0xd015001a]
2019-03-19 00:59:10, Error                 CSI    000004b3 (F) HRESULT_FROM_WIN32(14098) #1398420# from Windows::ServicingAPI::CCSITransaction::ICSITransaction2_AddComponents(Flags = 4, a = @0x30ecd0, mp = @0x30f4d0, disp = 0)[gle=0x80073712]
2019-03-19 00:59:10, Info                  CBS    Failed to add one or more component [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2019-03-19 00:59:10, Error                 CBS    Failed to complete component closure [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2019-03-19 00:59:10, Info                  CSI    000004b4@2019/3/18:23:59:10.313 CSI Transaction      [USER=223599]0x2A[/USER]40990 destroyed
2019-03-19 00:59:10, Info                  CBS    Perf: Resolve chain complete.
2019-03-19 00:59:10, Info                  CBS    Failed to resolve execution chain. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2019-03-19 00:59:10, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2019-03-19 00:59:10, Info                  CBS    WER: Generating failure report for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9, status: 0x80073712, failure source: Resolve, start state: Absent, target state: Staged, client id: WindowsUpdateAgent
2019-03-19 00:59:10, Info                  CBS    Failed to query DisableWerReporting flag.  Assuming not set... [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2019-03-19 00:59:10, Info                  CBS    Failed to add %windir%\winsxs\pending.xml to WER report because it is missing.  Continuing without it...
2019-03-19 00:59:10, Info                  CBS    Failed to add %windir%\winsxs\pending.xml.bad to WER report because it is missing.  Continuing without it...
2019-03-19 00:59:10, Info                  CBS    Failed to add %windir%\inf\setupapi.dev.log to WER report because it is missing.  Continuing without it...
2019-03-19 00:59:10, Info                  CBS    Reboot mark refs: 0
2019-03-19 00:59:10, Info                  CBS    SQM: Reporting package change for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9, current: Absent, pending: Default, start: Absent, applicable: Installed, target: Staged, limit: Staged, hotpatch status: StillGoing, status: 0x0, failure source: Resolve, reboot required: False, client id: WindowsUpdateAgent, initiated offline: False, execution sequence: 2058, first merged sequence: 2058
2019-03-19 00:59:14, Info                  CBS    SQM: Upload requested for report: PackageChangeBegin_Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9, session id: 142859, sample type: Standard
2019-03-19 00:59:14, Info                  CBS    SQM: Ignoring upload request because the sample type is not enabled: Standard
2019-03-19 00:59:14, Info                  CBS    SQM: Reporting package change completion for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9, current: Absent, original: Absent, target: Staged, status: 0x80073712, failure source: Resolve, failure details: "(null)", client id: WindowsUpdateAgent, initiated offline: False, execution sequence: 2058, first merged sequence: 2058
2019-03-19 00:59:14, Info                  CBS    SQM: resolve time performance datapoint is invalid. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2019-03-19 00:59:14, Info                  CBS    SQM: stage time performance datapoint is invalid. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2019-03-19 00:59:14, Info                  CBS    SQM: execute time performance datapoint is invalid. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2019-03-19 00:59:14, Info                  CBS    SQM: Upload requested for report: PackageChangeEnd_Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9, session id: 142862, sample type: Standard
2019-03-19 00:59:14, Info                  CBS    SQM: Ignoring upload request because the sample type is not enabled: Standard
2019-03-19 00:59:14, Info                  CBS    Enabling LKG boot option
2019-03-19 00:59:14, Info                  CBS    Restored system sleep block state: 0x80000000
2019-03-19 00:59:14, Info                  CBS    Exec: Processing complete.  Session: 30727654_1450795483, Package: Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24385.1.9 [HRESULT = 0x80073712 - ERROR_SXS_COMPONENT_STORE_CORRUPT]
2019-03-19 01:09:14, Info                  CBS    Reboot mark refs incremented to: 1

The error seems related to "Store corruption...".

Before that log also tried to apply KB947821 System Update Readiness Tool for 64bit.
I don't have a log for that, but after all tries I found a proceedure I think similar to SURT64:

dism /online /cleanup-image /scanhealth

There are 13 errors about missed files related two old updates:

- KB3035583
- KB3123862

These two seem related to windows 10 free update period july 2015 to july 2016 or something similar.
Maybe that two errors detected by SURT64, haven't nothing to do with the failed rollups install...
Any suggest is really appreciated.
Thanks in advance!



PS.
If you think I can open a new topic for my request. Let me know!!!

 

[Snick]

System Update Readiness Tool creates CheckSUR.log which you provided in your Dropbox upload
Please download the below zip file, extract contents & run it please.

View attachment Uninstall KB3123862 & KB3035583.zip

Reboot after CMD window closes

Please download FRSTx64, place it on your desktop. Copy and paste

KB3035583; KB3123862

into FRST searchbox, and click Search Registry

Upload logs that appear on your desktop

 

[Joe7]

Ok, here we have the logs of FRST64 (link for tool download above doesn't work...) attached.
Hope infos are useful, many thanks for your help!

 

[Snick]

Fixed Link, thanks!

Did you run the batch file in Uninstall KB3123862 & KB3035583.zip?

 

[Joe7]

Yes, well I opened it to see what it does and then actually ran the two commands in a power shell... but I think it is the same as execute bat script.
After that I reboot.
Then run the reg search tool for each KB codes.

 

[Snick]

Please run these again either in powershell or CMD window
Note: no quiet and no restart

wusa /uninstall /KB:3035583

wusa /uninstall /KB:3123862

If both KBs are uninstalled you will now receive a popup stating KB bla bla is not on this computer.

Did this occur?

Question on batch file is because there are over 900 registry entries for both KBs in the FRST run.

 

[Joe7]

Yes it occurs!
Says:

Error during install 0x80070490

"Element" not found

(Italian localized win version:

Errore durante l'installazione: 0x80070490

Impossibile trovare elemento)

 

[Snick]

OK,

Would you please rerun FRST64

Copy and paste bold text

KB3035583; KB3123862

into FRST searchbox and click Search Registry.
FRST will search for both KB registry entries simultaneously
Please upload the log that appear on your desktop

 

[Joe7]

Ok, here we go...
frst64 log as attachment

EDIT:
Sorry, may be a issue with blank space after semicolon ";". Seems FRST64 searched for " KB3123862" (with a beginning space) and it doesn't find anything related in the registry.
Retrying...
Done!
Attachment replaced!

 

[Snick]

FRST scanned for both KBs. Uninstall error code has me concerned as to component hive corruption.

 

[Joe7]

Ok. Thank again for your help.
And what would you think the "cure" should be at this point?

 

[Snick]

No problem with the help. Your issue is not the same as the one Jenn has other than WU is broken. WU can be a real challenge, that's why I enjoy working with its failures. If I can't correct your WU problem, I know a few individuals that can!

Have you run sfc /scannow from CMD or PowerShell since your issue cropped up?
If not, please download SFCFix.exe (by niemiro), save this to yourdesktop and run it. Post log that appears on your desktop please. SFCFix.exe when run without a script file is more comprehensive in correcting issues than sfc /scannow.

 

[Joe7]

So, hope in your, and you friends skills!

Yes I ran sfc /scannow at least two times:

I use to scan the PC, not often cause it is an office machine of a no profit association for public emergency (may be something like "911" in the us) in which I'm a volunteer... Now I've installed on Teamviewer so I can control it remotely...
I scanned with malware byte, adwcleaner and rougekiller, something malware found and removed.
Then I followed a "cleaning boot procedure" found on answres microsoft community, I used it many times by years and seems to work well to speedup the system.
Something like this:
And here you find the complete procedure i followed (in Italian)

It provides also sfc /scannow, with msconfig to cleanup non microsoft services and the main part of automatic apps starting at boot and some other stuff.

I've also uninstalled MSE antivirus suite before let run antimalware tools (deactivate it should be enough, anyway....) and also ran ccleaner which has solved some registry problem that prevented re-installation of it (MSE).

Finally I ran Win Update and noticed the Monthly Rollup updates issues.​

So yes after that procedures, I also tried to re-run "sfc /scannow" again.
However If you suggest I can launch it again.

I'll try sfcf.exe and report logs as soon!
Stay tuned

 

[Joe7]

> sfc /scannow

Avvio in corso dell'analisi del sistema. Attendere. L'operazione richiederà alcuni minuti.

Avvio in corso della fase di verifica dell'analisi del sistema.
100% della verifica completato.

Protezione risorse di Windows: nessuna violazione di integrità trovata.

In english should be the equivalent for:

Windows Resource Protection did not find any integrity violations.

And this resource describes that message as follows:

This means that you do not have any missing or corrupted system files.

PS.
SFCFix.exe doesn't work, seems a problem of sysnative site down...
Any alternative mirror for the last version?
Or also an older version... if it is ok

 

[Joe7]

Ok, the sysnative now online again..
I tried it. Logs in attachment.

 

[Snick]

If you wish you can perform a Repair Install or in the alternative post on Sysnative Win Update Forum. I am, or was in training (medical hiatus) in the Windows Update Academy.

Brian Drab, Niemiro, Tom982, softwaremaniac, zcomputerwiz, Go The Power, or a supervised WU Trainee will be able to fix your issue.

If you go the Sysnative route, it is my wish that you do, I will monitor your fix and take notes!

Pretty much everything you need to know about a Repair Install!

View attachment Repair Install Instructions.docx

Let us know your decision!

Wishing you the best,

Nic

 

[Joe7]

Thank you Snick for your help and your suggestions. If I well understood, a good choice could be a new thread at Sysnative forum.
Repair install, I don't know how exactly works, but that PC contains some tools which users got used to. So I'll try the first option and I will link it here, so others with similar issues can find infos also starting from here.

 

[Joe7]

Here the link to sysnative forum.
Monthly Rollup Updates - Installation issues | Sysnative Forums

 

[Snick]

Link in post #18 broken @Joe7!

 

[Joe7]

Here the new topic