CheckSUR file - CBS MUM Corrupt 0x800F0900

[ClareLox]

Here is response

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Admin>
C:\Users\Admin>DIR C:\Windows\Winsxs\Manifests\amd64_microsoft-windows-d..framew
orks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
Volume in drive C has no label.
Volume Serial Number is CACA-89AF
Directory of C:\Windows\Winsxs\Manifests
15/01/2013 13:32 83,575 amd64_microsoft-windows-d..frameworks-usermo
de_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
1 File(s) 83,575 bytes
0 Dir(s) 422,941,413,376 bytes free
C:\Users\Admin>ICACLS C:\Windows\Winsxs\Manifests\amd64_microsoft-windows-d..fra
meworks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
C:\Windows\Winsxs\Manifests\amd64_microsoft-windows-d..frameworks-usermode_31bf3
856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest NT SERVICE\TrustedInst
allerF)
NT AUTHORITY\SYSTEMR
X)
BUILTIN\Administrators
RX)
BUILTIN\UsersRX)
Successfully processed 1 files; Failed processing 0 files
C:\Users\Admin>ATTRIB C:\Windows\Winsxs\Manifests\amd64_microsoft-windows-d..fra
meworks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
A C:\Windows\Winsxs\Manifests\amd64_microsoft-windows-d..frameworks-u
sermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
C:\Users\Admin>DIR C:\Windows\Winsxs\Backup\amd64_microsoft-windows-d..framework
s-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
Volume in drive C has no label.
Volume Serial Number is CACA-89AF
Directory of C:\Windows\Winsxs\Backup
File Not Found
C:\Users\Admin>ICACLS C:\Windows\Winsxs\Backup\amd64_microsoft-windows-d..framew
orks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
C:\Windows\Winsxs\Backup\amd64_microsoft-windows-d..frameworks-usermode_31bf3856
ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest: The system cannot find t
he file specified.
Successfully processed 0 files; Failed processing 1 files
C:\Users\Admin>ATTRIB C:\Windows\Winsxs\Backup\amd64_microsoft-windows-d..framew
orks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
File not found - C:\Windows\Winsxs\Backup\amd64_microsoft-windows-d..frameworks-
usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260.manifest
C:\Users\Admin>

 

[ClareLox]

The bit where it comes up with smileys shoud read:

NT AUTHORITY\SYSTEM : (RX)
BUILTIN\Administrators : (RX)
BUILTIN\Users : (RX)

 

[NoelDP]

It's OK - I can read Smiley

The manifest file is the correct size, at least - but the wrong date. Windows thinks it's corrupted and is attempting to restore it from a non-existent backup! (the question of why CheckSUR didn't spot it remains)
I think we'll try replacing the file manually, and see what happens.....


I've uploaded a file - claab.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21526
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\claab
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\claab
hit the enter key - if you get a 'Not Found' error try
DIR D:\claab
or
DIR E:\claab

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\claab <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link

 

[ClareLox]

OK - ran it again - the drive is D:\claab ....

Attached is the new CBS.log file .... fingers-crossed!!

 

[NoelDP]

That doesn't seem to have worked
Let's try another route....
Please open a command prompt and run the following command

COPY C:\claab\Manifests\*.* C:\Windows\Temp\CheckSUR\Winsxs\Manifests

(You should see one file copied as a response)

Then run a CheckSUR scan and post the results. (CheckSUR.log)

 

[ClareLox]

Noel - sorry for the delay - I've been away with work .... just checking I'm not doing anything wrong - running checksur - means re-downloading the file from Microsoft and running (System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [November 2012])?
Thanks
Clare

 

[ClareLox]

If so - have managed to run this successfully this time and the CheckSUR logs are attached.

 

[NoelDP]

Wrong!!


Sorry about that - I didn't bother reviewing the thread before posting.

What I should have said was simply to try running another SFC /SCANNOW and posting the new CBS.log file, since the CheckSUR managed to fix the only error it found.

 

[ClareLox]

ok - just run this sfc /scannow - it ran much more quickly but still suggests it found some corrupt files/not fixed.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Admin>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log
C:\Users\Admin>

 

[NoelDP]

Interesting - SFC had to replace the main manifest file for the other affected files - so the detection may be off-whack.
Please run (yet) another SFC /SCANNOW and post the new log

 

[ClareLox]

Here you go - are we winning? New CBS.log attached. Thanks for your continued support!

 

[NoelDP]

I think we're getting there - this set of errors appears to be a common one....

 Line 49995: 2013-01-24 22:11:22, Info                  CSI    00000359 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:32{16}]"WUDFPlatform.dll"; source file in store is also corrupted
 Line 50000: 2013-01-24 22:11:22, Info                  CSI    0000035c [SR] Could not reproject corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:20{10}]"WUDFRd.sys"; source file in store is also corrupted
 Line 50005: 2013-01-24 22:11:22, Info                  CSI    0000035f [SR] Could not reproject corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:20{10}]"WUDFPf.sys"; source file in store is also corrupted
 Line 50010: 2013-01-24 22:11:22, Info                  CSI    00000362 [SR] Could not reproject corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:80{40}]"MsftWdf_User_01_11_00_Inbox_Critical.Wdf"; source file in store is also corrupted
 Line 50015: 2013-01-24 22:11:22, Info                  CSI    00000365 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"WUDFSvc.dll"; source file in store is also corrupted
 Line 50020: 2013-01-24 22:11:22, Info                  CSI    00000368 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"WUDFHost.exe"; source file in store is also corrupted
 Line 50025: 2013-01-24 22:11:22, Info                  CSI    0000036b [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:38{19}]"WUDFCoinstaller.dll"; source file in store is also corrupted
 Line 50030: 2013-01-24 22:11:22, Info                  CSI    0000036e [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"WUDFx.dll"; source file in store is also corrupted
 Line 50041: 2013-01-24 22:11:22, Info                  CSI    00000370 [SR] Repair complete
 Line 50042: 2013-01-24 22:11:22, Info                  CSI    00000371 [SR] Committing transaction

I think I know how to fix it now - it'll have to wait until tomorrow, though.

In the meantime, to confirm the problem, please upload the following files.
C:\Windows\System32\WUDFPlatform.dll
C:\Windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260\WUDFPlatform.dll
C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17803_none_fb416b4f0bdbe260\WUDFPlatform.dll

(the last one may not exist)

 

[ClareLox]

As you anticipated, the last one doesn't exist - please see attached the other two...
.I struggled to upload initially - said it was invalid file so I copied into two zip files.
The first attachment is the one from System32 directory. The second one from winsxs.

 

[NoelDP]

The files are definitely damaged - they should be signed, and aren't, and appear to be full of nothing but null characters.
We'll replace all the affected files but I suspect the SFC will still fail, in which case a little more surgery will be required.

Back in a bit with the fix protocol - caffeine required!

 

[NoelDP]

I've uploaded a file - claaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\claaa
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\claaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\claaa
or
DIR E:\claaa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\claaa <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

 

[ClareLox]

Noel - sorry, I can't find the zip file claaa.zip on your sky drive.

 

[NoelDP]

Ooops! - I seem to have done everything but upload it

It should be there now.

 

[ClareLox]

Here is the CBS.log

 

[ClareLox]

MGADiag report

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {18E6BC81-C847-4986-8BD1-8CB1C839D341}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{18E6BC81-C847-4986-8BD1-8CB1C839D341}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-246350861-721387141-2884081271</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion g6 Notebook PC</Model></SYSTEM><BIOS><Manufacturer>Insyde</Manufacturer><Version>F.09</Version><SMBIOSVersion major="2" minor="7"/><Date>20120531000000.000000+000</Date></BIOS><HWID>675B3307018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800010-02-2057-7601.0000-1532012
Installation ID: 000733709440307131739450375446604634422816377361995694
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 3Q6C9
License Status: Licensed
Remaining Windows rearm count: 0
Trusted time: 25/01/2013 23:54:20
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:14:2013 15:33
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEA6GFWrV7UMlVw9eoF7rigZBaSLnM=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM 1841
FACP HPQOEM SLIC-MPC
HPET HPQOEM 1841
BOOT HPQOEM 1841
MCFG HPQOEM 1841
WDAT HPQOEM 1841
UEFI HPQOEM 1841
ASF! HPQOEM 1841
SLIC HPQOEM SLIC-MPC
SSDT HPQOEM 1841
ASPT HPQOEM 1841
FPDT HPQOEM 1841
SSDT HPQOEM 1841
SSDT HPQOEM 1841

 

[NoelDP]

OK - to my surprise, the files came back OK, but the manifest fails....

 Line 56751: 2013-01-25 23:39:45, Info                  CSI    000002eb [SR] Cannot verify component files for Microsoft-Windows-DriverFrameworks-UserMode.Resources, Version = 6.1.7601.17803, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
 Line 56756: 2013-01-25 23:39:45, Info                  CSI    000002ee [SR] Recovered manifest from backup for Microsoft-Windows-DriverFrameworks-UserMode.Resources, Version = 6.1.7601.17803, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
 Line 56763: 2013-01-25 23:39:45, Info                  CSI    000002f0 [SR] Repair complete

I'm not certain whether is was properly replaced or not - please run another SFC /SCANNOW and reboot, then post the new CBS log.
Your MGADiag is OK - once you've posted the new CBS log, please test Windows Update to see what happens.

(bed-time here now )

See you tomorrow!