Unable to install Windows Update: Update Kernel-mode driver framework

[rweeber]

I am unable to update the Kernel-mode driver framework ver 1.11 for windows 7 for x64-based systems (KB2685811). I get error: 80073712

Also, I am getting BSOD/stop errors in normal mode that say anything from:

-memory_management 0x0000000001a,

- "A device driver attempting to corrupt the system has been caught. The faulty driver currently being on the kernel stack must be replaced with a working version." GDRO.sys-
address fffff88000626a8f9, base at fffff88006269000, datestamp 49b9d125

I'm not sure if they are related.

When I run in safemode I do not get the BSOD. When in normal mode I will get BSOD consistently when running Norton Full System Scan, specifically when the full system scan gets to the Windows/system32 folder.

System specs:
Processor: Intel 2500K Core Duo Unleashed
MOBO: Gigabyte GA-p67A-UD3P
RAM: I have 4x4 Corsair Vengeance, only using 1 stick of 4GB corsair vengeance currently due to troubleshooting.
GPU: NVIDIA EVGA GTX570HD
HDDs:Intel 180GB SSD and Western Digital Caviar Black 1.0 TB (empty)
PSU: corsair 750 watt
Soundcard: MOBO

When I canoo

 

[rweeber]

Sorry for double post

I, again, apologize for double posting. I figure I should include the host of other issues I'm having. Maybe they can all be inter related.

-my DVD/RW drive, when connected to mother board in ANY SATA slot, causes the BIOS screen to freeze forever. I have disconnected the drive at this time while trouble shooting. I have tried known-good SATA cables so I know it's either the DVD/RW drive or perhaps a driver or mobo failure.

-I have run the memory diagnostic tool in windows. No issues were reported.

-I have NOT run memtest86 because I do not have a disk drive connected.

-I have had stop-errors (BSODS) such as PFN_list_corrupt, System_service_Exception, Memory_management, IRQ_not_less_or_Equal
All of these could be a result of bad RAM.

I have purchased new RAM as a means to fix my problems. It seemed to work for 2 weeks, then the stop errors returned.

 

[NoelDP]

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

 

[rweeber]

Thanks Noel

After running the chkdsk of the C: drive, I got this nice little message:
Checking file system on C:
The type of the file system is NTFS.
The Volume is Clean.
Cannot open volume for direct access.
Autochk cannot run due to an error caused by a recently installed package.
Use the system restore feature from the control panel to return to a point prior to the recent software package installation.

I ran the SFC and it says "Windows Resource Protection did not find any integrity violations."

In addition, when I try and open the CBS.log it tries to open it up as a .txt and then says Access Denied!

There is no option to run as administrator. Maybe this is a virus.

 

[NoelDP]

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (

http://skydrive.live.com ) and post a link to it so that I can take a look.

Copy the file - don't open it!

There is no option to run what, as Andministrator?

It is distinctly possible that it's malware-related - or just a lousy driver.

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[rweeber]

Link to CBS.log

<iframe src="https://skydrive.live.com/embed?cid...=734681D3DEAFE50A!133&authkey=AHLuvboZSGly2z4" width="98" height="120" frameborder="0" scrolling="no"></iframe>

 

[NoelDP]

The SFC didn't detect any problems - but there was a huge amount of work being done by the system in the 6 hours prior to runnning it.

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply..

 

[rweeber]

Attached CheckSUR

Here it is.

 

[NoelDP]

Unavailable repair files:
 winsxs\manifests\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_6.1.7601.17803_en-us_7bb6503311dabeed.manifest
 winsxs\manifests\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.17803_none_d482f2fd34846558.manifest
 winsxs\manifests\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_6.1.7601.22004_en-us_7c40c56a2af7ab50.manifest
 winsxs\manifests\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.22004_none_d50d68344da151bb.manifest
 servicing\packages\Package_1_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_1_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_3_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_3_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_for_KB2685811_SP1~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_for_KB2685811_SP1~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.mum
 servicing\packages\Package_1_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_1_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_3_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_3_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_for_KB2685811_SP1~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_for_KB2685811_SP1~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat
 servicing\packages\Package_for_KB2685811~31bf3856ad364e35~amd64~~6.1.1.11.cat

That's CheckSUR's summary of required files - I can't produce a fix tonight, but I'll work on it in the morning... please check back.

 

[rweeber]

No title

OK no problem. Thanks for helping me on this.

 

[tom982]

I don't know about you, but I think getting files from hotfixes is really tough. I'll post here how I managed to get the update, in case someone is researching this.

First of all, I tried searching for a MS link (the file would be called Windows6.1-KB2685811-x64.msu) but I couldn't find an official download and I try to steer clear of any third party hosted version. Hotfixes are usually named differently to standard updates, so I found a list of MS Hotfixes that said that the hotfix file is called kmdf-1.11-Win-6.1.msu. Googling this leads me to this MS article:

Installation Components for Framework-based Drivers (Windows Drivers)

Which then lead me to this:

WDK 8 Redistributable Components

Which I downloaded and extracted (neither expand.exe or KB_Extractor.exe worked for this - I had to use 7zip). This gave me a few horrible files:

C:\Users\Tom\Downloads\WUTEMP\wdfcoinstaller>dir /b
License.rtf
redist.txt.x64
redist.txt.x86
wdfcoinstaller.msi
_kmdf_1.11_Win_6.0.msu_00000
_kmdf_1.11_Win_6.0.msu_00001
_kmdf_1.11_Win_6.1.msu_00000
_kmdf_1.11_Win_6.1.msu_00001
_umdf_1.11_Win_6.0.msu_00000
_umdf_1.11_Win_6.0.msu_00001
_umdf_1.11_Win_6.1.msu_00000
_umdf_1.11_Win_6.1.msu_00001
_WdfCoInstaller01007.dll_00000
_WdfCoInstaller01007.dll_00001
_WdfCoInstaller01009.dll_00000
_WdfCoInstaller01009.dll_00001
_WdfCoInstaller01011.dll_00000
_WdfCoInstaller01011.dll_00001
_winusbcoinstaller.dll_00000
_winusbcoinstaller.dll_00001
_winusbcoinstaller2.dll_00000
_winusbcoinstaller2.dll_00001
_WinUSB_1.9.msu_00000
_WinUSB_1.9.msu_00001
_WUDFUpdate_01007.dll_00000
_WUDFUpdate_01007.dll_00001
_WUDFUpdate_01009.dll_00000
_WUDFUpdate_01009.dll_00001
_WUDFUpdate_01011.dll_00000
_WUDFUpdate_01011.dll_00001

C:\Users\Tom\Downloads\WUTEMP\wdfcoinstaller>

I made an educated guess, based on the filename, that it was one of the first four. As this is Winodws 7, it can't be a 6.0 component so it's either file 3 or 4. The rest was trial and error Sure enough, when I extracted the file _kmdf_1.11_Win_6.1.msu_00001, I found the file Windows6.1-KB2685811-x64 I don't want to hijack your thread, so I'll just attach the files here for you

Tom

 

[NoelDP]

Hey - hijack away! Saved me having to hunt the files down, at least (For whatever reason, I don't have it either... on any of my Vista or Win7 installs)
Still - for practive, I went to the Update Catalog (Microsoft Update Catalog ) and downloaded both 32-bit and 64-bit...

One question that I'd like answered before we proceed, though.

@rweeber - The driver that seems to be calling the framework, from your description, appears to be GDRO.sys
I can find no details on this driver anywhere on Google, which often means that such a file is associated with malware.
Have you run a decent anti-malware scanner over the system? such as MalwareBytes? (www.malwarebytes.org - free version)

 

[tom982]

Hey - hijack away! Saved me having to hunt the files down, at least (For whatever reason, I don't have it either... on any of my Vista or Win7 installs)
Still - for practive, I went to the Update Catalog (Microsoft Update Catalog ) and downloaded both 32-bit and 64-bit...

One question that I'd like answered before we proceed, though.

@rweeber - The driver that seems to be calling the framework, from your description, appears to be GDRO.sys
I can find no details on this driver anywhere on Google, which often means that such a file is associated with malware.
Have you run a decent anti-malware scanner over the system? such as MalwareBytes? (www.malwarebytes.org - free version)

Thank you, thank you, thank you! I never knew about that website, but it's helped me source updates from two threads already That makes life sooo much easier!

 

[NoelDP]

Thank you, thank you, thank you! I never knew about that website, but it's helped me source updates from two threads already That makes life sooo much easier!

Happy to be of service

 

[tom982]

Thank you, thank you, thank you! I never knew about that website, but it's helped me source updates from two threads already That makes life sooo much easier!

Happy to be of service

It's very odd though, it hosts a different version of KB2647753 than the download centre Fortunately, it was the one I wanted though.

 

[rweeber]

@noel, I ran the malwarebytes application you suggested. It found 1 file associated with my coretemp application but that is it. That GDRO.sys is definately something I am concerned about. But everytime I try and search for it nothing comes up. If you remember in my introductory posts, I mentioned that when I ran my nortan application, I would get a stop-error/BSOD when it reached the windows/system32 folder.

@Tom- So that file you extracted, is that for me to use or something you wanted to point out? Sorry I'm a little confused about what you were talking about in your thread, I was not following a long very well!

Thanks for all the help

 

[tom982]

I'm holding off with the file replacement until we sort out this driver issue, just ignore what I said I'll post instructions for you as soon as we clear this up.

Upload GDRO.sys to http://www.virustotal.com and send us the link please.

Tom

 

[rweeber]

Would that I could

I would like to upload that GDRO.sys file, but I cannot find it. I'm wondering where Noel found it.

 

[rweeber]

Guys I figured it out. I fat fingered the GDRO.sys file, it was supposed to be GDRV.sys. A quick google search of GDRV.sys brought me here - gdrv.sys = BSOD in windows 7

Apparently when I use the Easy Tune 6 CD that came with the motherboard, this GDRV.sys file is loaded and it's really out of date. I went to Gigabyte's website and downloaded the new Easy Tune 6 files and the GDRV.sys file is no longer included.

I'm really busy for the rest of the evening, but i'll get back to this problem tomorrow and see if I can install that windows update finally.

 

[NoelDP]

It 'should be' in C:\Windows\system32\drivers

Please open a Command Prompt window, and run the following commands....

C:\Windows\GDRO.sys /S
C:\Windows\GDRO.sys /AH /S

post the results.