Possible "bit-flip" in COMPONENTS hive, with random BSOD

[alexbiasin]

Hi all, I hope you are well.

I'm having random BSOD with multiple types of errors (KMODE_EXCEPTION_NOT_HANDLED ; CLFS.SYS ; MEMORY_MANAGEMENT ; SYSTEM_SERVICE_EXCEPTION ; PAGE_FAULT_IN_NONPAGED_AREA in a couple of days), Windows Update does not work, and have found that I may have a "bit-flip" in COMPONENTS hive.

Here is the line in CBS.log:

2021-02-11 09:58:10, Error                 CSI    00000005 (F) Invalid attribute name found: [l:42{21}]"ProcessorArchitec[B][COLOR="Red"]d[/COLOR][/B]ure"[gle=0x80004005]

Instead of "ProcessorArchitecture" it says "ProcessorArchitecdure".

It seems that's the only bit-flip in the log.

How can I fix this?

Thanks in advance!
Alex

 

[wither 2]

Hello- you should have posted this in the BSOD section and it might get moved there, but follow the instructions here-

Blue Screen of Death (BSOD) Posting Instructions

so that someone can get more details.

 

[alexbiasin]

Hello wither 2, thank you for your response.

I've attached the output of DM Log Collector here, as stated in the instructions.
Can I move this post into BSOD? I don't see how.

Meanwhile, I've managed to edit the file C:\Windows\System32\Config\COMPONENTS with the hex editor HxD, and correct that byte.
The first think to notice is that I am able to run SFC again, but now it says that it was not able to repair all files.

Windows Update is still "searching" after 2 hours...

 

[torchwood]

Hi Alex,

The bitflip has likely caused errors in Windows updates packages, manifest/cab files. hence the 2hour + search.

please run kb947821, SURT, the log will be in the cbs folder. It will identify any domino effects of the bit flip.


Roy

 

[file3456]

I'm wondering if you have a bad HDD or RAM. You can use Hard Drive Sentinel and Memtest86 to find out.

 

[alexbiasin]

Hi torchwood, I'm still waiting for kb947821 (SURT) to finish installing. It's been more than two hours now...
Is it supposed to take that long?

Hello F22 Simpilot, I've tested both components.
Tested my SSD HDD with "Western Digital SSD Dashboard" tool. All good, including all SMART parameters.
Tested RAM with Alienware BIOS RAM Full Test (similar to memtest, took 4 hours if I remember well). No errors.
Also tested my CPU with "Intel Processor Diagnostic Tool 64bit".

 

[alexbiasin]

Finally, after 9 hours, this is the output after executing SURT (C:\Windows\Logs\CBS\CheckSUR.log):

Summary:
Seconds executed: 34941
 Found 17455 errors
 Fixed 15982 errors
  CSI Unexpected Failure Total count: 15
  CBS Watchlist contains unexpected data Total count: 1
  CSI Missing Winning Component Key Total count: 17439
  Fixed: CSI Missing Winning Component Key.  Total count: 15982
(w)     Unable to read Event Log        0x000005DC      System

Now, I've executed Windows Update again and it's writing this in CBS.log:

2021-02-12 19:33:18, Error                 CSI    00007e96@2021/2/12:22:33:18.197 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17932_pl-pl_dfc81d7d6fc4de5c"[gle=0x80004005]
2021-02-12 19:33:22, Error                 CSI    00007e97@2021/2/12:22:33:22.522 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17932_pt-br_e21c08216e4e7240"[gle=0x80004005]
2021-02-12 19:33:27, Error                 CSI    00007e98@2021/2/12:22:33:27.070 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17932_sv-se_c59bd3c649c87aa3"[gle=0x80004005]
2021-02-12 19:33:29, Error                 CSI    00007e99@2021/2/12:22:33:29.578 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17965_nb-no_9b2f08d7898c06ab"[gle=0x80004005]
2021-02-12 19:33:34, Error                 CSI    00007e9a@2021/2/12:22:33:34.292 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17965_nl-nl_996e54158ab81080"[gle=0x80004005]
2021-02-12 19:33:36, Error                 CSI    00007e9b@2021/2/12:22:33:36.744 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17965_pl-pl_dfaaae976fda7e34"[gle=0x80004005]
2021-02-12 19:33:40, Error                 CSI    00007e9c@2021/2/12:22:33:40.534 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17965_pt-br_e1fe993b6e641218"[gle=0x80004005]
2021-02-12 19:33:45, Error                 CSI    00007e9d@2021/2/12:22:33:45.139 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [99]"wow64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7601.17965_sv-se_c57e64e049de1a7b"[gle=0x80004005]
2021-02-12 19:33:48, Error                 CSI    00007e9e@2021/2/12:22:33:48.689 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [101]"wow64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_4492053fb78fa680"[gle=0x80004005]
2021-02-12 19:33:51, Error                 CSI    00007e9f@2021/2/12:22:33:51.197 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [101]"wow64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_42d1507db8bbb055"[gle=0x80004005]
2021-02-12 19:33:56, Error                 CSI    00007ea0@2021/2/12:22:33:56.011 (F) d:\w7rtm\base\wcp\componentstore\csd_transact.cpp(3579): Store corruption detected in function CCSD
irectTransaction::ShouldKeepAliveFromInstallmap expression: (null)
  MissingWinningComponentKey on resource [101]"wow64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_890daaff9dde1e09"[gle=0x80004005]

I will wait until Windows Update finishes searching...

 

[torchwood]

Hi.

Whoa man, it fixed 15000 errors, your system must have been experiencing a lot of grief, still about 1500 to fix..


Your best bet copy your personal files to an external device, then do a repair install.



Roy

 

[alexbiasin]

Hi torchwood, yes, too many errors.

Mmm, repair install... I'm browsing all possible ISO images from HeiDoc and I wonder (since it won't work with my original Alienware M15X Windows 7 Home Premium DVD) which image to choose now that I have SP1 installed.

 

[wither 2]

Almost all the bug check codes for your problem are the same. The most frequent problem relates to memory. How much free space do you have on your C: drive.

Would you run ms32info.exe; save the file as a .nfo and then post it here?

 

[torchwood]

hi Alex,
depends on your product key, Retail or OEM believe Alienware is a fork of Dell.
If its a Retail key the base home premium retail is the 1 to go for... you will not need to reinput the key.

Repair Install

Roy

 

[alexbiasin]

Hi wither 2,
After hours of searching, Windows Update reported error 8024402C.
C: drive has 13GB free.
I've attached msinfo nfo

 

[alexbiasin]

Hi torchwood.
When trying to download from https://www.microsoft.com/es-mx/software-download/windows7 it says that "The product key you entered appears to be for software pre-installed by the device manufacturer."
The label below my notebook says "Windows 7 Home Prem OA".
I have not found the ISO in the Dell site either.
If I try to download from HeiDoc app from the first tab, it says "The file is currently unavailable, and can be provided again in small capacity NEXT MONTH".

 

[wither 2]

Thanks for the file. I haven't looked at it yet.

However, I think the minimal free space on your C: drive is the cause of the problem. One of the errors you got concerned memory management and then, you got repeated csfl.sys file call outs in the .dmp files, which is also related to memory. It could be it's not enough space for virtual memory especially if the the disk has a high level of fragmentation. It's may also be a low amount for temporary files which are generated by various software that you might use and when browsing the internet.

I suggest going to Accessories, System Tools and running Disk Cleanup on your C: drive. When it says how much space it can recover, make sure the boxes for Temporary Files and Recycle Bin are checked. Let it run and then reboot. You might also consider saving infrequently used files to another drive.

Edit: I deleted an additional edit because when I tried to read the .nfo, it seems my system specs were being read.

 

[alexbiasin]

Hi wither 2, I executed cleanup on C: but only recover around 500MB.
I moved some directories with drivers in it from C: to E:
I don't think I have much more to move, since C: size is only 65GB.
How much is enough?

Meanwhile, while I was waiting for a Win7SP1 ISO to download, I followed this steps (Windows Update: recursos adicionales - Windows Deployment | Microsoft Docs) and then executed SURT again. After that, Windows Update worked again. I must reboot and try again...

 

[wither 2]

I tried to read your .nfo and the could only open it with WordPad and NotePad but the information isn't displayed the way I ordinarily see it. Since it's also in Spanish (I can't read Spanish and the translators would only translate part of it to English), I half to read carefully.

Is your C: drive an SSD? If so, have you ever run the Trim function on it to remove garbage (resets the NAND)?

If free space is really the issue, you could always use another drive for virtual memory (you have 16 GB). Of course, it might slow things down slightly.

 

[alexbiasin]

Hi wither 2,
Yes, mi C: is an SSD. I ran TRIM 3 days ago.
I have 8GB of virtual RAM in C: . I've just set 12GB on E: partition, and leave no virtual RAM on C: to save space.

I'm still wondering which Windows 7 Home Premium SP1 ISO image to use to perform repair install...

 

[wither 2]

I was reading my last post and my spelling was really bad.

I was basing the 16 GB of virtual memory on this-

<Elemento><![CDATA[Memoria virtual total]]></Elemento>
<Valor><![CDATA[16,0 GB]]></Valor>
</Data>
<Data>
<Elemento><![CDATA[Memoria virtual disponible]]></Elemento>
<Valor><![CDATA[9,50 GB]]></Valor>
</Data>
<Data>
<Elemento><![CDATA[Espacio de archivo de paginación]]></Elemento>
<Valor><![CDATA[7,99 GB]]></Valor>

Not quite sure why it's shown that way.

I guess we'll have to wait and see if what you did helps.

 

[alexbiasin]

Hi wither 2,
Now, C: drive has 26GB free, since I also disabled hibernation.

I'm also uploading the new NFO.

 

[wither 2]

Thanks for the new .nfo. It is more like what I expected. Looking at the event viewer, you getting repeated WindowsWCPStore corruption errors which I wouldn't think would contribute to your problem but you might try getting rid of it this way- Fix Windows Update errors via DISM or System Update Readiness tool - Windows Server | Microsoft Docs