Solved Errors 0x800F0900 and 0x800B0100

[Mentos]

Some updates are failing with error code 800B0100. One of the failing updates is SP1 (KB976932).

I ran the SURT then sfc /scannow, but the error persisted.

Looking at the CheckSUR log, I can see the errors "CBS MUM Corrupt 0x800F0900" and "CBS Catalog Corrupt 0x800B0100".

I've attached the CBS log directory.

Thanks!

 

[NoelDP]

The CheckSUR has exposed the following errors...

Unavailable repair files:
 winsxs\manifests\msil_mscorlib.resources_b77a5c561934e089_6.1.7600.20935_en-us_4fdd65da8f1fc992.manifest
 winsxs\manifests\msil_mscorlib.resources_b77a5c561934e089_6.1.7600.16789_en-us_66afb31075744e72.manifest
 servicing\packages\Package_1_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_1_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_2_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_2_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_3_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_3_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_5_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_5_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.mum
 servicing\packages\Package_1_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_1_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_2_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_2_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_3_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_3_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_5_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat
 servicing\packages\Package_5_for_KB2518867~31bf3856ad364e35~amd64~~6.1.1.0.cat

I'll post a fix for them a little later.

The SFC scan found the following problem....

 Line 4325: 2013-08-18 08:16:27, Info                  CSI    0000031d [SR] Repairing 1 components
 Line 4326: 2013-08-18 08:16:27, Info                  CSI    0000031e [SR] Beginning Verify and Repair transaction
 Line 4329: 2013-08-18 08:16:28, Info                  CSI    00000320 [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post a fix for that later as well

 

[NoelDP]

I've uploaded a file - mtsaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder mtsaa in the same place.
Open this folder - there should be two folders inside it (Manifests, and Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

And the content of the manifests folder (.manifest files) into this folder:

C:\Windows\Temp\CheckSur\Winsxs\Manifests

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

 

[NoelDP]

I've uploaded a file - mtsab.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\mtsab
hit the enter key - if you get a 'Not Found' error try
DIR D:\mtsab
or
DIR E:\mtsab

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\mtsab <drive>:\windows\winsxs /y /i /s /v /h

(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

 

[Mentos]

Ok, thanks. I'll post back when I've completed the steps.

 

[Mentos]

Attached are the logfiles after performing the requested steps, as well as the results from running MGADiag.

Edit: the files I copied into \servicing\Packages are labeled x86, and CheckSUR appears to be looking for amd64. Hopefully it's just that easy from this point

 

[NoelDP]

You're right - my apologies!
I'll get it right in a minute.

The SFC replacement doesn't seem to have worked, either
Please run the following commands, and we'll see what went wrong....

DIR C:\mtsaa /S
DIR C:\Windows\winsxs\mtsaa

post the results.


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.


(must eat before I hunt for the new file set! )

 

[NoelDP]

I've uploaded a file - mtsac.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder mtsac in the same place.
Open this folder - there should be one folders inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

 

[Mentos]

The SFC replacement doesn't seem to have worked, either
Please run the following commands, and we'll see what went wrong....

DIR C:\mtsaa /S
DIR C:\Windows\winsxs\mtsaa

Just to double-check, should I have copied the contents of the mtsab directory such that the amd64_microsoft-windows-autochk_... directory is alongside the other similarly-named directories in \winsxs\? That's what I did initially, but your post makes it sound like I should have copied the inner mtsab folder itself - not the contents - into \winsxs\

In other words, I currently have C:\Windows\winsxs\amd64_microsoft-windows-autochk_[...etc...]22996\autochk.exe, but should it really be C:\Windows\winsxs\mtsab\amd64_microsoft-windows-autochk_[...etc...]22996\autochk.exe?

I'm re-running CheckSUR with the amd64 versions of the package files - I'll post some logs when it completes.

Edit: CheckSUR logs attached - looking good

Edit2: CBS.log uploaded to dropbox (over size limit). Seems to show errors for autochk.exe still. I ran sfc /scannow with the replacement autochk.exe in both the locations I mentioned earlier in the post, just to cover the bases.

 

[NoelDP]

The CheckSUR fix worked that time

The base folder structure should be

C:\mtsaa\<long foldername>\<longfilename>

 

[Mentos]

The base folder structure should be

C:\mtsaa\<long foldername>\<longfilename>

For completeness, here's the structure I currently have:

C:\Windows\system32>dir C:\mtsab /S
 Volume in drive C has no label.
 Volume Serial Number is B4DF-125D

 Directory of C:\mtsab

08/19/2013  09:10 AM    <DIR>          .
08/19/2013  09:10 AM    <DIR>          ..
08/18/2013  05:13 PM    <DIR>          amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996
               0 File(s)              0 bytes

 Directory of C:\mtsab\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996

08/18/2013  05:13 PM    <DIR>          .
08/18/2013  05:13 PM    <DIR>          ..
07/14/2009  02:38 AM           777,728 autochk.exe
               1 File(s)        777,728 bytes

     Total Files Listed:
               1 File(s)        777,728 bytes
               5 Dir(s)   3,077,718,016 bytes free

C:\Windows\system32>dir C:\Windows\winsxs\mtsab
 Volume in drive C has no label.
 Volume Serial Number is B4DF-125D

 Directory of C:\Windows\winsxs\mtsab

08/18/2013  09:18 PM    <DIR>          .
08/18/2013  09:18 PM    <DIR>          ..
08/18/2013  09:18 PM    <DIR>          amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996
               0 File(s)              0 bytes
               3 Dir(s)   3,077,718,016 bytes free

I've also tried running SFC with the amd64_[...]autochk[...]\ directory moved up a level (to \winsxs\amd64_[...]autochk[...]\).

I could be missing some simple yet crucial step.

Edit: just to make sure, it should be mtsab, not mtsaa, correct?

 

[NoelDP]

That explains the problem with Autochek then

You appear to have been xcopying the mtsab folder, rather than its content (C:\Windows\Winsxs\mtsab should not exist)
Please review my instructions again and follow them exactly

 

[Mentos]

Uploaded a new CBS.log.

 

[NoelDP]

Still the same error

Maybe it's a registry problem? - maybe it's still a file problem.....

Please run the following commands...

COPY C:\Windows\Winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996 %userprofile%\desktop\mtsnp1
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-autochk_31bf3856ad364e35_none_e006b9b4b9af9929" /S

Post the results.

You'll fined that the first command put a file on your desktop - 'mtsnp1'
Please zip it and attach it to your results as well - then I can check it against the normal file.

 

[Mentos]

Results of commands:

C:\Windows\system32>COPY C:\Windows\Winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996 %userprofil
e%\desktop\mtsnp1
C:\Windows\Winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996\autochk.exe
        1 file(s) copied.

C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFa
milies\amd64_microsoft-windows-autochk_31bf3856ad364e35_none_e006b9b4b9af9929" /S
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592(win7sp1_gdr.110408-1631)\ComponentFam
ilies\amd64_microsoft-windows-autochk_31bf3856ad364e35_none_e006b9b4b9af9929" /S
ERROR: The system was unable to find the specified registry key or value.

HKEY_LOCAL_MACHINE\COMPONENTS\ doesn't appear to exist when looking through regedit.

I also searched for 'autochk' using RegScanner - these are the results:

 

[NoelDP]

The file is very definitely not being properly replaced - all hashes run on it are different to the standard.
Somehow, you appear not to be following the proper procedure for replacement of the file.

Please try again, and this time note the EXACT XCOPY command you are using, and post it in your reply.

 

[Mentos]

The exact command I entered was:

XCOPY C:\mtsab C:\Windows\winsxs /y /i /s /v /h

with the result "1 File(s) copied".

For comparison, I've zipped the autochk.exe files from both the source mtsab folder and the destination folder in winsxs (files are renamed to source_autochk and destination_autochk). Perhaps the autochk.exe in the mtsab folder is the incorrect version?

 

[NoelDP]

The destination_autocheck file is infected with a virus....
https://www.virustotal.com/en/file/...962a122325e7f56681137fd0/analysis/1376947283/


Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a FULL Scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[Mentos]

Ah I see, thanks. Running a scan now, I'll check back when it's done.

 

[NoelDP]

I checked, and MBAM doesn't actually detect it (yet) - but it may find other things, including the control program that keeps reverting it.