Windows Update Issues

[GDW]

Windows update has stopped working error 80070002, all MS fixes also fail:

Summary:
Seconds executed: 1445
Found 99 errors
CSI Manifest and S256H Do Not Match Total count: 1
CSI Missing Deployment Key Total count: 91
CSI Corrupt Deployment Keyform Total count: 1
CSI Mismatched Identity Total count: 1
CSI Corrupt I/P Mark Total count: 1
CSI Located Replacement: Invalid (S256H) Total count: 16
CSI Corrupt Registry Value Total count: 2
CBS Registry Error Total count: 1
CBS Watchlist Package Missing Total count: 1
Unavailable repair files:
winsxs\manifests\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_6.1.7600.16385_none_a6c7190f7292676c.manifest

 

[NoelDP]

Without the detail, what you've posted is all but useless.

Please follow the Windows Update Posting Instructions and post the requested data
If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)

 

[GDW]

Sorry, I had to cut out half of the error log as it was too big, and obviously removed the relevant text.

Long and short is around April the auto-update stopped working with an error code of 80070002. I've tried all the numerous fixes that MS have produced but they run for a around 30 minutes, complete but do not fix the problem.

When I've tried to install hotfixes manually it tells me its not relevant for my PC - I'm running Windows 7 Pro 64bit.

Attached is the log from the SURT tool. I am at a bit of a loss what to do next.

 

[GDW]

Attached is the whole CBS folder.

 

[NoelDP]

Interesting.
There is a single bitflip in the registry which is causing all sorts of mayhem in your CBS.log file.

The error in the CBS log is this one...

2014-06-07 00:54:48, Error                 CSI    00000012 (F) STATUS_OBJECT_NAME_NOT_FOUND #272173# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowAccessDenied), key = {provider=NULL, handle=0}, da = (KEY_READ|DELETE|KEY_WOW64_64KEY), oa = @0xb2e7e0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[217]"\Registry\Machine\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_none_f21e73acf5c7442d\v!6n1.7600.q6385"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 11724672 (0x00b2e780))[gle=0xd0000034]
2014-06-07 00:54:48, Error                 CSI    [EMAIL="00000013@2014/6/6:23:54:48.046"]00000013@2014/6/6:23:54:48.046[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
[gle=0x80004005]

This is independent of the CheckSUR log - but correcting it may either correct some of the errors there, or create more that need correction (or both!)


Let's check what is actually there before we attempt to cure it...

Please open an Elevated Command Prompt and run the following commands

REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
REG QUERY "HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_none_f21e73acf5c7442d"
REG UNLOAD HKLM\COMPONENTS
 
.

Post the results.

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Hopefully, if we fix that one first, things will become a little easier to read!

 

[GDW]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONEN
TS
The operation completed successfully.
C:\Windows\system32>
C:\Windows\system32>REG QUERY "HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.76
01.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..
gement-winproviders_31bf3856ad364e35_none_f21e73acf5c7442d"
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1
_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winprovide
rs_31bf3856ad364e35_none_f21e73acf5c7442d
SomeUnparsedVersionsExist REG_BINARY 00
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1
_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winprovide
rs_31bf3856ad364e35_none_f21e73acf5c7442d\v!6n1.7600.q6385
C:\Windows\system32>REG UNLOAD HKLM\COMPONENTS
The operation completed successfully.
C:\Windows\system32>

 

[NoelDP]

Hmm - a very short listing (mine came to around 15 entries)
The one ending v!6n1.7600.q6385 is the problem - the question is how best to resolve it.

We can go the manual way (easiest for me, but potentially the hardest for you) or I can try and craft the proper patch to fix the bitflip, and hope everything goes according to plan.

Have you worked in Regedit before? How comfortable are you there?

 

[GDW]

Hi Noel,

Thanks for your help before we start.

I'm comfortable using regedit.

 

[GDW]

Hi noel, I do have to go out, but if you can post me the instructions I'll complete and come back to the thread later on. Thanks.

 

[NoelDP]

Oh goody Makes my life a lot easier

Open an Elevated Command Prompt, and run the following commands

REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
Regedit


Regedit will open once the hive has loaded
Navigate to
HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_none_f21e73acf5c7442d

Export it for safety! (and please upload it so I can take a look - you'll have to zip it first)

and expand that branch so you can see the
v!6n1.7600.q6385
subfolder
right-click on it and select 'Rename' - edit it to read
v!6n1.7600.16385

Now close regedit and the CMD window, and reboot then run SFC and CheckSUR again - post the new CBS.log and CheckSUR.log files.

 

[GDW]

Hi Noel, it won't let me open, export or rename the file - messages say it cannot be found/does not exist. When trying to rename it says error renaming key.

 

[NoelDP]

OK - things are going to be fun, then.

Please boot to Safe Mode, and copy the file C:\Windows\System32\config\COMPONENTS (no extension) to your desktop.
Compress the copied file, and upload it to your favourite fileshare site (preferably DropBox or OneDrive)- post a link in your reply. (The compressed file will almost certainly be too big for the forum to allow)

 

[GDW]

https://www.dropbox.com/s/58n1nudcvinpqsp/COMPONENTS.zip

 

[NoelDP]

OK - I've fixed the ones I can find (for the moment, at least!)....


I've uploaded a file - gdwaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the file and select Extract All, and save to the default destination (which should be a folder on the desktop)

Create a new System Restore point

Open an Elevated Command Prompt, and run the following commands.

REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1
COPY %userprofile%\desktop\gdwaa\COMPONENTS C:\Windows\System32\config

If you get an error with either command, STOP THERE - do not reboot! - post for instructions.

Assuming both commands go OK, reboot, and run another CheckSUR scan - post the new CheckSUR.log file.

 

[GDW]

Thanks Noel - done than.

The SFC wasn't successful with the same error I've had before:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.

Windows Resource Protection could not perform the requested operation.
C:\Windows\system32>

Attached is the CBS folder

 

[NoelDP]

SFC still failing at this point is not too surprising -

Here's the latest summary from the CheckSUR log

Summary:
Seconds executed: 945
 Found 99 errors
  CSI Manifest and S256H Do Not Match Total count: 1
  CSI Missing Deployment Key Total count: 91
  CSI Corrupt Deployment Keyform Total count: 1
  CSI Mismatched Identity Total count: 1
  CSI Corrupt I/P Mark Total count: 1
  CSI Located Replacement: Invalid (S256H) Total count: 16
  CSI Corrupt Registry Value Total count: 2
  CBS Registry Error Total count: 1
  CBS Watchlist Package Missing Total count: 1
Unavailable repair files:
 winsxs\manifests\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_6.1.7600.16385_none_a6c7190f7292676c.manifest

- no change from the earlier one.


The CBS log shows a few more bitflips - e.g.

2014-06-08 13:30:45, Error                 CSI    0000000d (F) STATUS_OBJECT_NAME_NOT_FOUND #177503# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = 0, key = {provider=NULL, handle=0}, da = (KEY_READ|DELETE|KEY_WOW64_64KEY), oa = @0xd7d450->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[217]"\Registry\Machine\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_none_f21e73acf5c7442d\v!6n1.7600.16385"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 14145560 (0x00d7d818))[gle=0xd0000034]

I'll fix that from my copy of the file and upload it again when done.

Back soon - I hope!

 

[NoelDP]

I've uploaded a file - gdwab.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the file and select Extract All, and save to the default destination (which should be a folder on the desktop)

Create a new System Restore point

Open an Elevated Command Prompt, and run the following commands.

REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1
COPY %userprofile%\desktop\gdwab\COMPONENTS C:\Windows\System32\config

If you get an error with either command, STOP THERE - do not reboot! - post for instructions.

Assuming both commands go OK, reboot, and run another CheckSUR scan - post the new CheckSUR.log file.

 

[GDW]

Hi Noel,

Please see below:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.

Windows Resource Protection could not perform the requested operation.
C:\Windows\system32>REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1
A duplicate file name exists, or the file
cannot be found.
C:\Windows\system32>

 

[NoelDP]

Change the 'components.old1' to 'components.old2' and try again.

 

[GDW]

Thanks Noel - I did think about doing that but wanted to check with you first.

Attached is the new log.