Windows 7 update and error code: 80070003

NoelDP · 17 Nov 2012

Code:

2012-11-17 06:02:18, Info                  CSI    000013a9 [SR] Repairing 1 components
2012-11-17 06:02:18, Info                  CSI    000013aa [SR] Beginning Verify and Repair transaction
2012-11-17 06:02:18, Info                  CSI    000013ab Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_9.4.8112.16421_none_064611e72dafc564\pngfilt.dll do not match actual file [l:22{11}]"pngfilt.dll" :
  Found: {l:32 b:x2L6A6H42ZZICwDsnHtO35OAbB1AOH2bl67y+SlB3to=} Expected: {l:32 b:IygYH8liz+7E8kq2DxCRqkC8EoubSExsGIi87WxgDso=}
2012-11-17 06:02:18, Info                  CSI    000013ac [SR] Cannot repair member file [l:22{11}]"pngfilt.dll" of Microsoft-Windows-IE-PortableNetworkGraphics, Version = 9.4.8112.16421, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-17 06:02:18, Info                  CSI    000013ad Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_9.4.8112.16421_none_064611e72dafc564\pngfilt.dll do not match actual file [l:22{11}]"pngfilt.dll" :
  Found: {l:32 b:x2L6A6H42ZZICwDsnHtO35OAbB1AOH2bl67y+SlB3to=} Expected: {l:32 b:IygYH8liz+7E8kq2DxCRqkC8EoubSExsGIi87WxgDso=}
2012-11-17 06:02:18, Info                  CSI    000013ae [SR] Cannot repair member file [l:22{11}]"pngfilt.dll" of Microsoft-Windows-IE-PortableNetworkGraphics, Version = 9.4.8112.16421, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-17 06:02:18, Info                  CSI    000013af [SR] This component was referenced by [l:228{114}]"Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~9.4.8112.16421.Internet-Explorer-amd64"
2012-11-17 06:02:18, Info                  CSI    000013b0 Hashes for file member \??\C:\Windows\SysWOW64\pngfilt.dll do not match actual file [l:22{11}]"pngfilt.dll" :
  Found: {l:32 b:x2L6A6H42ZZICwDsnHtO35OAbB1AOH2bl67y+SlB3to=} Expected: {l:32 b:IygYH8liz+7E8kq2DxCRqkC8EoubSExsGIi87WxgDso=}
2012-11-17 06:02:18, Info                  CSI    000013b1 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_9.4.8112.16421_none_064611e72dafc564\pngfilt.dll do not match actual file [l:22{11}]"pngfilt.dll" :
  Found: {l:32 b:x2L6A6H42ZZICwDsnHtO35OAbB1AOH2bl67y+SlB3to=} Expected: {l:32 b:IygYH8liz+7E8kq2DxCRqkC8EoubSExsGIi87WxgDso=}
2012-11-17 06:02:18, Info                  CSI    000013b2 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:22{11}]"pngfilt.dll"; source file in store is also corrupted
2012-11-17 06:02:18, Info                  CSI    000013b3 Repair results created:
POQ 1108 starts:
 
POQ 1108 ends.
2012-11-17 06:02:18, Info                  CSI    000013b4 [SR] Repair complete

is the critical area of the report - it shows that one file is irreparable.
- we'll get to that in a minute or two :)

I just noticed that your License is an MSDN one - are you a subscriber?? If not then the installation is counterfeit

CodeVisio · 17 Nov 2012

I didn't much understand the content of the report.
How is pngfilt.dll involved in the Windows Update issue?
I've seen the property of that dll, but there is no much information on the resource area. It doesn't seem a microsft dll.
Yes, I was a MSDN subscriber.

EDIT:
ok, from the dll property (right click on the file) there is no resource information.
But if you open it with visual studio as binary file you can see it is a dll/exe file (PE magic).
Looking for some strings inside it I can see the resource information:
- a string "microsoft"
- a string "PNGFILTER"
- a string like "IE plug in"
- probably it is an activex or something like that since it has DllGetClassObj() and DllCanUnloadNow() functions. But DependencyWalker wasn't able to load it and show the exported/imported functions.

Any idea? a virus? a rootkit?

Thanks a lot NoelDP

NoelDP · 17 Nov 2012

No - it's a legitimate file that has gotten corrupted somehow (which is probably why DW barfs on it).

It is the Portable Networks Graphics dll, and is part of the basic Windows OS - which is about as much as I know. :)

I've uploaded a file - codev.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21526
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\codev
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\codev
hit the enter key - if you get a 'Not Found' error try
DIR D:\codev
or
DIR E:\codev

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\codev <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

CodeVisio · 17 Nov 2012

NoelDP,

I've followed your instructions successfully.
- Where did you get the folder with pngfilt.dll inside the zip?
- Under Command Prompt, why there are so many volumes or partitions?
- Just a note for future references. Do not click F8 during bios boot process (after the beep). If you have a bios like mine then an hard disk boot menu will appear allowing you to choose the hard disk you want to use for the OS boot process. Instead, if you have a multi boot sequence, as I have, then you can wait until the boot menu appear and then you simply click F8: The advanced menu with will appear.

The SCF utility ended with the following string "Windows Resource Protection did not find any integrity violations.".
- I checked the pngfilt.dll under \Windows\SysWOW64, under \Windows\System32, and under \Windows\WinSxS folders and it was OK. I can see the file properties.
- the CBS log file link http://sdrv.ms/Uyu13S file name: CBD_2012_11_18.zip.

This is the MGADiag report:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-772T7-BHY2W-TPCG9
Windows Product Key Hash: PxkfZZFFec/PFFnvmrcbA7B5Aqw=
Windows Product ID: 00426-065-0586351-86878
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {4C29C2FE-BFC3-487A-B8DD-91EB7B5162FA}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{4C29C2FE-BFC3-487A-B8DD-91EB7B5162FA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-TPCG9</PKey><PID>00426-065-0586351-86878</PID><PIDType>5</PIDType><SID>S-1-5-21-1408468914-2965767387-1660694563</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1202 </Version><SMBIOSVersion major="2" minor="5"/><Date>20090326000000.000000+000</Date></BIOS><HWID>92DA3107018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>W. Europe Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: a0cde89c-3304-4157-b61c-c8ad785d1fad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00172-065-058635-00-1033-7601.0000-0922011
Installation ID: 010954721363996443362211753513136674018372660945846745
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: TPCG9
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 11/18/2012 12:05:47 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:23:2012 12:11
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: NAAAAAEABAABAAEAAAABAAAAAwABAAEA6GGwwO7tVPIQM0RvDj/WmDTNGs1YecCEGCYm6Q==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 032609 APIC2058
FACP 032609 FACP2058
HPET 032609 OEMHPET
MCFG 032609 OEMMCFG
OEMB 032609 OEMB2058

Can I try Windows Update now?

Thank you

NoelDP · 17 Nov 2012

As far as partitions go.....
It all depends on how Windows was installed - and that depends on whether your manufacturer had any clue what they were doing or not, and whether your installed the OS yourself or not, using default methods - or not!
The Repair Environment enumerates drives in the order they appear on the hard disk.
A default clean install of Windows will have two partitions - one of which is invisible to Windows normally - the System Reserved partition, and the normal Windows partition (drive C:).
The System Reserved partition will appear in the RE as drive C: - forcing the Windows partition into the D: drive
In most OEM installs, the Recovery partition is in the first place - if there is also a System Reserved partition, then that will normally be in second place, thereby forcing the Windows partition to the E: driv ein RE.
If the system is dual-booting, all bets are off :)

All critical Windows files are nominally stored in two places on the disk - one in the normal working position, and one in the winsxs folder, inside a known folder. replacing the working one is no use, as it's often not actually present at all, and is merely a hard link to the winsxs version.
You have to replace the winsxs version offline (it's pretty heavily protected), and allow the system to work its magic.

Yep, you can try Windows updates again now - the system is now as good as we can get it, so any errors will be within WU itself, and should be identifiable and fixable.

CodeVisio · 18 Nov 2012

It doesn't work

WindowsUpdate gives me the same error as before....

I've checked also Event Viewer log but it doesn't give much information as well...

Any other idea? :)

Thanks

EDIT: I don't have Microsoft Office package installed, I have only Word Viewer 2003 on my PC.
Why does WindowsUpdate show two important Office 2007 updates to be installed If I don't have that package on my PC?

NoelDP · 18 Nov 2012

OK, now we know that it is basically a WU problem we can start with the WU repairs....

Please open an elevated command prompt and run the following commands

DIR C:\Windows /AR /S
How many files and folders are found in the summary? (I don't want the list!)
DIR C:\Windows\System32 /AR /S
How many files and folders?
DIR C:\Windows\SoftwareDistribution /S
How many files and folders?
DIR C:\Windows\System32\Catroot2 /S
How many files and folders?

CodeVisio · 18 Nov 2012

DIR C:\Windows /AR /S
1) How many files and folders are found in the summary?
7530 files
165 folders

DIR C:\Windows\System32 /AR /S
2) How many files and folders?
2 files
0 folders

DIR C:\Windows\SoftwareDistribution /S
3) How many files and folders?
93 files
47 folders

DIR C:\Windows\System32\Catroot2 /S
4) How many files and folders?
11 files
11 folders

NoelDP · 18 Nov 2012

The SoftwareDistribution folder looks to be very small- have you already tried renaming it?

The number of read-only files in the Windows structure outside System32 is rather large - perhaps we should try and pin it down.

Please run the following command in an Elevated Command Prompt - it will create a new file on your desktop called ROFiles.txt

DIR C:\Windows /AR /S >%userprofile%\Desktop\ROFiles.txt

wait for the command prompt to return, then attach the file to your reply

CodeVisio · 18 Nov 2012

The SoftwareDistribution folder looks to be very small- have you already tried renaming it?

No, I've never seen that folder before.

The number of read-only files in the Windows structure outside System32 is rather large - perhaps we should try and pin it down.

This is my development PC, is that involved?

The file is in attach.

Thanks