Solved DISM: error 87 - what context ?

[pallmall]

The only one that will run is DISM /online /cleanup-image /scanhealth

/checkhealth and /restorehealth result in the same context error.
I tried some other spellings and spaces, but there's something else that I am unaware of.

All the online "context" I have searched for is the same as what I have attempted here.

Is there another version that wants to see "...... /cleanup-wim /checkhealth" perhaps ?

DELL Latitude
C: = Reserved
D: = Win7

 

[torchwood]

Hi

DISM is the successor to KB947821, it only works for certain versions of W7
(System Update Readiness Tool aka SURT)

You will need to download it from the MS catalogue... note please ensure you pull the correct set-up x64/x86 dated Oct 2014


results can be found here - C:\Windows\Logs\CBS\CheckSUR.log

 

[pallmall]

Yes. Very good. I was reading the KB article about DISM and SURT differences, and that Win7 usually runs off of the SUR-Tool. I have the two log files in my CBS folder that were just run yesterday, and are identical as follows:

=================================Checking System Update Readiness.Binary Version 6.1.7601.244992024-04-27 22:15Checking Windows Servicing PackagesChecking Package Manifests and CatalogsChecking Package WatchlistChecking Component WatchlistChecking PackagesChecking Component StoreSummary:Seconds executed: 533 No errors detected

****

I searched my Win7 updates that were mostly installed at the retirement of W7 in 2020, and did not find a KB947821 update file listing...and I would guess it's a hidden file somewhere, or it checks while I am on the web to make this summary of "No errors detected" in just under 9 minutes.

The other cabinet files are recent SFC scannow or DISM /scanhealth that ran to completion (with some errors that could not be repaired). See below



I'm still trying to learn what "persist" means, otherwise something to do about video screens or drivers has been my best Latin research guess.

Anyway, my W7 appears to be running OK, but SFC will report a corruption somewhere none the less.

I recently turned off my IE in features, and uninstalled EDGE after hitting something on the web that froze my screen, and then suspended iexplore.exe over and over again in processes. I wanted to repair any damages from the web attack, when I ran into this DISM roadblock.

I'll try the KB download that should run a scan - and maybe a repair - if it can identify the corruption(s).

I have to switch to admin to view the CBS text file, and I shall return ...

 

[torchwood]

Hi

That KB runs as a one-off, used as and when required, so never appears in the installed update folders

MS decided many moons ago that certain folders needed to be kept during Disk Clean-up - windows update operations, they achieved this by labelling them Persistant
note
some people have removed them manually with no ill effects, as they do take up a fair bit of space

sfc and surt look at different operations within the OS, easiest way of looking at it
sfc is the engine
surt is the petrol

 

[pallmall]

...I'm back with some CBS data that I think describes a few issues with my Win7 install. This first part is from the latest log that was generated by SFC scannow. It references about 99% of the entire file:

Requesting upload of all unsent reports.
SQM: Failed to start upload with file pattern: C:\Windo..... [HRESULT = 0x80004005 - E_FAIL]
CBS Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]
... 26 more entries 0x800f0805...

Package "Package_for_KB5001027~31bf3856ad364e35~amd64~~6.1.1.3" requires Servicing Stack v6.1.7601.24554 but current Servicing Stack is v6.1.7601.24544. [HRESULT = 0x800f0823 -CBS_E_NEW_SERVICING_STACK_REQUIRED]

Failed to initialize internal package [HRESULT = 0x800f0823 - CBS_E_NEW_SERVICING_STACK_REQUIRED]

Read out cached package applicability for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.23797.1.3, ApplicableState: 80, CurrentState:0 Session: 31103885_3506441902 initialized by client WindowsUpdateAgent.
Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]

Read out cached package applicability for package: Package_for_KB4016754~31bf3856ad364e35~amd64~~6.1.1.0, ApplicableState: 112, CurrentState:0
Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]

Read out cached package applicability for package: Package_for_KB2515325~31bf3856ad364e35~amd64~~6.1.1.0, ApplicableState: 80, CurrentState:0
Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]

......package_for_KB2809215
......Package_for_KB3020370
....Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24180.1.8
...Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24149.1.4
...Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24136.1.4
.....Package_for_KB3121255......ect...
...0x800f0805...0x800f0823...errors....

...POQ 143 ends.

There are several more of these error failures, and multiple lists of "skip and ignore" while scannow went thru the updates. The actual unrepaired corruptions "autochk & display" are stated several times throughout the file listing.

This Last POQ describes again what was NOT repaired, and sometimes describes why. (some of the entries including "found" and "expected" hash#'s were removed for simplicity) :


CSI 0000034f [SR] Verify complete
Repairing 2 components
Beginning Verify and Repair transaction

#1) Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35 _6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe do not match actual file [l:22{11}]"autochk.exe"

Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, hash mismatch

#2) Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-display.resources _31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.mui do not match actual file [l:30{15}]"Display.dll.mui"

Cannot repair member file [l:30{15}]"Display.dll.mui" of Microsoft-Windows-Display.Resources, hash mismatch

******** component #1 *********
Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35 _6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe do not match actual file [l:22{11}]"autochk.exe"

Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS....., hash mismatch

This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35 ~amd64~6.1.7601.17514.WindowsFoundationDelivery"

Hashes for file member \??\C:\Windows\System32\autochk.exe do not match actual file [l:22{11}]"autochk.exe" Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"autochk.exe"; source file in store is also corrupted

******** component #2 *********
Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-display.resources_31bf3856ad364e35 _6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.mui do not match actual file [l:30{15}]"Display.dll.mui"

Cannot repair member file [l:30{15}]"Display.dll.mui" of Microsoft-Windows-Display.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS....., hash mismatch

This component was referenced by [l:266{133}]"Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.Windows Foundation Language Pack"

Hashes for file member \??\C:\Windows\System32\en-US\Display.dll.mui do not match actual file [l:30{15}] "Display.dll.mui"

Could not reproject corrupted file [ml:520{260},l:58{29}]"\??\C:\Windows\System32\en-US"\[l:30{15}]"Display.dll.mui"; source file in store is also corrupted

POQ 144 ends.
Repair complete
Committing transaction
Creating NT transaction (seq 2), objectname [6]"(null)"
Created NT transaction (seq 2) result 0x00000000, handle @0x370CSI 00000367@2024/5/1:18:39:38.470
CSI perf trace: CSIPERF:TXCOMMIT;6
Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired
CBS Trusted Installer signaled for shutdown, going to exit.
Ending the TrustedInstaller main loop.
Starting TrustedInstaller finalization.
Ending TrustedInstaller finalization.

I would predict that the two files "autochk.exe & display.dll.mui" are the elements that are preventing SFC to render an "all clear" output. All the other "failed" error codes are presumed to be a lack of - or missing - update files and packages.

I cannot download the KB "SURT" at my residence at 950Mb, as it would likely "time out" from poor reception. I can, however, conduct a proper download at the public library on their fiber optics.

So given these results, do you believe the KB947821 SUR-tool will repair these two files, and perhaps fill-in some or all of the update files that appear to be void ?

BTW: I do have a DISM.exe folder in my Win7, and it has a DISM log folder with a previous file(s) that were run several times since 2020...but I guess it was never updated enough to run /checkhealth and restorehealth on the old "antique" Win7.

 

[torchwood]

Hi

based on those results its going to be a bit more than just running SURT

there are corrupt packages which need to be replaced - unfortunately i dont have them
but i know who does

Please shootover to Sysnative.com
they WILL need you to zip the cbs log file

 

[pallmall]

Thanks Torch,

Give me a spell to go over there at sysnative.

I began this "adventure" while searching for tooling to repair an old Ford pickup - not an old Windows 7!

So anyways, I posted in the general forum about what had happened from the start - set the post as "solved" when I cleared the task manager - which I thought at the time was the only problem.

Having gone thru some of the discussion here in "software", I decided to open up the original post "unresolved" with the new findings that are strongly pointing to a malware/Trojan type virus that has likely found it's way into my Win7 computer.

******* view at my post "IEexplore.exe hang" in the GENERAL discussion **********

Even if there is a Trojan virus found, the anti-virus programs do not fix the damage the malware causes - to the best of my knowledge anyways. The best solution may simply be to format the gangrene out this rig, and rewrite a new Win7 with a retail key and disk purchase, turn off updates, and to just repeat a format/clean reinstall at the first sign of any future infestation - like we used to do with old DOS when the Kalok hard drive seized - which are still backed up to this day !

I guess I have nothing to lose in downloading and running the anti-virus steps spelled out at malwaretips. At least it may inform what the issue is or has been.

- - - Updated - - -

I registered with sysnative, and followed their download steps in preperations to post in their update forum.

This is the SUR-Tool KB947821 that was offered for download :



There is one (1) 947821 executable standalone "SUR", and 25 other self-extracting cabinet applications.

Was I suppose to run all 25 cabinets, and then run the SUR tool ?

Well, Sysnative only mentioned about running the SUR. So I only did what was specified, and did not bother the other 25 cabinet applications.

After running the 947821 standalone, the CBS log continues to fail packages, but does not report the autochk.exe or display.dll.mui corruptions anymore. SUR may have repaired those two files - but - cannot fix the error failures to open or repair update packages.

I'm just guessing that the 25 cabinets need to be run and extracted prior, so that the SUR tool can open and/or identify them as packages ? ?? Maybe like the fuel and engine analogy you were hinting on...Yea...

 

[pallmall]

SFCFix version 3.0.2.1 by niemiro.Start time: 2024-05-05 04:31:45.807Microsoft Windows 7 Service Pack 1 - amd64Using .zip script file at C:\Users\User\Desktop\SFCFix.zip [0]

PowerCopy::Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.muiSuccessfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exeSuccessfully copied file C:\Users\User\AppData\Local\niemiro\Archive\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.mui to C:\Windows\winsxs\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.mui.Successfully copied file C:\Users\User\AppData\Local\niemiro\Archive\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe to C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe.Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.muiSuccessfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f76d5676e7d5a264\Display.dll.muiSuccessfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exeSuccessfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exePowerCopy:: directive completed successfully.Successfully processed all directives.Failed to generate a complete zip file. Upload aborted.SFCFix version 3.0.2.1 by niemiro has completed.Currently storing 2 datablocks.Finish time: 2024-05-05 04:40:47.911Script hash: m7J5g/g1IYfqfp/zlBDedu3Q+bhXgbml+v3B5UbeoAE=----------------------EOF-----------------------



Thanks Torchwood. Sysnative was a success !

ed