Windows Update Errors 80073712 800F0900 80070002 - Giant cbs log

[Breezy9401]

Hello!

I've been having some trouble with windows updates recently. I'm failing several updates and getting errors. SFC /scannow doesn't seem to be able to fix anything. It claims it has fixed the max number of files and to rerun scannow, but I have done it about 15-20 times and still it is ongoing and with no visible improvements.

Additionally dxdiag will not run at all. Not sure if that is related...

Here is the screenshot from Windows Update:


I would include my cbs log file but it is 224 Mb in size after zipping it down. 2.7Gb before zipping....

I have run SURT and fixit to no avail.
I hope you can help.

 

[NoelDP]

PLease post the CheckSUR.log file - we can at least try and fix the errors it should have found. (C:\Windows\Logs\CBS\Checksur.log)

 

[Breezy9401]

Noel,

Absolutely. Here it is.

View attachment CheckSUR.log

Thank you for your assistance.

 

[NoelDP]

You have a fair amount of corruption there!

Summary:
Seconds executed: 246
 Found 503 errors
  CSI Manifest Failed Catalog Check Total count: 123
  CSI Missing Identity Total count: 116
  CSI Payload File Missing Total count: 4
  CSI Payload File Corrupt Total count: 65
  CBS MUM Corrupt Total count: 58
  CBS Catalog Corrupt Total count: 137

I need to have a look at your COMPONENTS registry hive

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

 

[Breezy9401]

Quite a bit of corruption indeed.

Here is the components file: https://www.dropbox.com/s/4vklms4rhj1av2y/COMPONENTS.zip?dl=0

 

[NoelDP]

That hive is rather larger than usual! (Do you have Language Packs installed??)

A quick scan for corruption shows nothing too terrible.

The problem I have is that if I start trying to fix this manually, the likelihood is that it's going to pop up even more errors as we get these ones fixed - and it's better to try and work out what caused the corruption first to ensure that it doesn't happen again!

I was expecting to see obvious corruption there, but I can't, so it's unlikely to be a RAM problem.

I think I'd better have a look at the Event logs and see what's there...

Open Event Viewer

click on theWindows logs entry in the left pane to expand it.

Now click on theApplication entry - wait while it loads.

Click on 'File'in the menu bar and select Save...

Save the file asAppevt.evtx

Repeat for theSystem log

then zip both,and upload them.

 

[Breezy9401]

When I went to open event viewer I got:

I hit unload the snap-in and continue running and got error that said:

FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}

An attempt was made to load a program with an incorrect format. (Exception from HRESULT: 0x8007000B)

Exception type:
System.BadImageFormatException

Exception Stack Trace:
at Microsoft.WindowsEventCollection.Private.ECNativeMethods.EcIsConfigRequired(Boolean& val)
at Microsoft.Windows.ManagementUI.CombinedControls.SubscriptionProcessingHandler.SubscriptionProcessing.InitializeSubscriptionService(Boolean askUser)
at Microsoft.Windows.ManagementUI.CombinedControls.SubscriptionProcessingHandler.IsServiceRunning(Boolean askUser)
at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.SetActionsForNode()
at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.AddChildrenToViewerRootNode()
at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.CreateChildNodes()
at Microsoft.EventViewer.SnapIn.MMCRootNode.ExpandNode()
at Microsoft.EventViewer.SnapIn.MMCRootNode.OnExpand(AsyncStatus status)
at Microsoft.ManagementConsole.NodeSyncManager.ProcessRequest(NodeRequestInfo info, IRequestStatus requestStatus)
at Microsoft.ManagementConsole.SnapIn.ProcessRequest(Request request)
at Microsoft.ManagementConsole.Internal.SnapInClient.Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request)
at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request)
at Microsoft.ManagementConsole.Executive.RequestStatus.BeginRequest(IMessageClient messageClient, RequestInfo requestInfo)
at Microsoft.ManagementConsole.Executive.SnapInRequestOperation.ProcessRequest()
at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

--------------------------
Hit OK and then Event Viewer came up with:

 

[NoelDP]

I was afraid that would happen - we'll have to go the other way at it then.

Please copy the following files to your desktop, then zip then and upload them.
C:\Windows\System32\winevt\Logs\Application.evtx and ...System.evtx

 

[Breezy9401]

Here they are Noel:
View attachment 362386

 

[NoelDP]

The Application Log is corrupt - I don't think I'm going to be able to decipher the content too much
The System log looks OK - the occasional error but nothing really nasty.


Please boot to Safe Mode, and delete the file
C:\Windows\System32\winevt\Logs\Application.evtx


use the system for an hour or so, and then post a new Application event log.

 

[Breezy9401]

Ok, I had time today to boot in safe mode and give this a try.

When I went to delete the application event log file, I got this:


Is there a way around it or should I try something else? (This is immediately as Windows boots, no other programs running)

 

[NoelDP]

OK- try this instead...

In Safe Mode Windows
Open an Elevated Command Prompt, and run the following commands:

NET STOP Schedule
NET STOP WECSVC
NET STOP Eventlog

(If required, answer Y to the do you want to continue? question)
Then run the following command:

DEL C:\Windows\System32\winevt\Logs\Application.evtx

With luck, That'll work!

 

[Breezy9401]

Ok, that did work!
I also ran NET START Eventlog since it looked like it wasn't going to start making one without it running...

Anyways, here it is:
View attachment Application Event Log.zip

 

[NoelDP]

That one appears to be corrupted also!
I was hoping it was a simple file problem, but it appears to be much more - and I don't think I'm qualified to deal with it.
You may have to be thinking in terms of a repair install- or a clean install.

 

[Breezy9401]

Aye aye captain!
Thanks for all your help anyways.

I'll look into doing a repair install or possibly clean install.