"Windows Updates Cleanup" failing after reboot

mkv4ever · 12 Jan 2014

Hello, it is the first time that I can't fix a windows error myself (by googling I mean), so I followed the guide here Windows Update Posting Instructions
1) SURT run, no problem reported
2) SFC all clear (no problem reported)
3) No error code that I can report
I attached the logs in CBS but I had to move some CBSPersist cab files for size reasons.
The only error message I have is when I restart windows after using Windows Updates Cleanup: it says "cleaning.." and then "revert changes" or something like that, my windows is localized in italian and I don't remember the exact string.
It doesn't seems to have pending updates.
Thanks for listening, if you need more logs let me know.

NoelDP · 13 Jan 2014

This appears to be the cause of your problems...

Code:

2014-01-12 21:58:51, Info                  CBS    Obtained poqexec from Cbs key. C:\Windows\System32\poqexec.exe /display_progress \SystemRoot\WinSxS\pending.xml
2014-01-12 21:58:51, Info                  CBS    Startup: Processing non-critical driver operations queue, Count 7.
2014-01-12 21:58:51, Info                  CBS    Doqe: Locking driver updates, Count 7
2014-01-12 21:58:51, Info                  CSI    00000005 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:2482ce18d90fcf01010000004004d004} pathid: {l:16 b:2482ce18d90fcf01020000004004d004} path: [l:180{90}]"\SystemRoot\WinSxS\amd64_usbport.inf_31bf3856ad364e35_6.1.7601.17586_none_1b9eb6021a6421dc" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    00000006 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:45a6d518d90fcf01030000004004d004} pathid: {l:16 b:45a6d518d90fcf01040000004004d004} path: [l:172{86}]"\SystemRoot\WinSxS\amd64_usb.inf_31bf3856ad364e35_6.1.7601.17586_none_28d4bd852548d3f5" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    00000007 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:45a6d518d90fcf01050000004004d004} pathid: {l:16 b:45a6d518d90fcf01060000004004d004} path: [l:172{86}]"\SystemRoot\WinSxS\amd64_bth.inf_31bf3856ad364e35_6.1.7601.17607_none_d0789c5ad225ef11" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    00000008 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:a507d818d90fcf01070000004004d004} pathid: {l:16 b:a507d818d90fcf01080000004004d004} path: [l:202{101}]"\SystemRoot\WinSxS\amd64_tsgenericusbdriver.inf_31bf3856ad364e35_7.1.7601.16398_none_8990d94eb5ecd1da" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    00000009 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:0569da18d90fcf01090000004004d004} pathid: {l:16 b:0569da18d90fcf010a0000004004d004} path: [l:194{97}]"\SystemRoot\WinSxS\amd64_tsusbhubfilter.inf_31bf3856ad364e35_7.1.7601.16398_none_68892afee5e71e34" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    0000000a Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:66cadc18d90fcf010b0000004004d004} pathid: {l:16 b:66cadc18d90fcf010c0000004004d004} path: [l:180{90}]"\SystemRoot\WinSxS\amd64_termkbd.inf_31bf3856ad364e35_7.1.7601.16398_none_d84338d64915d591" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CSI    0000000b Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:c62bdf18d90fcf010d0000004004d004} pathid: {l:16 b:c62bdf18d90fcf010e0000004004d004} path: [l:180{90}]"\SystemRoot\WinSxS\amd64_termmou.inf_31bf3856ad364e35_7.1.7601.16398_none_77087dc3892e28b3" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)

2014-01-12 21:58:51, Info                  CSI    0000000b Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:c62bdf18d90fcf010d0000004004d004} pathid: {l:16 b:c62bdf18d90fcf010e0000004004d004} path: [l:180{90}]"\SystemRoot\WinSxS\amd64_termmou.inf_31bf3856ad364e35_7.1.7601.16398_none_77087dc3892e28b3" pid: 440 starttime: 130340339167412268 (0x01cf0fd90ffa402c)
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: usbport.inf, Ranking: 2, Device-Install: 1, Key: 1, Identity: usbport.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7601.17586, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: usb.inf, Ranking: 2, Device-Install: 1, Key: 2, Identity: usb.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7601.17586, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: bth.inf, Ranking: 2, Device-Install: 0, Key: 3, Identity: bth.inf, Culture=neutral, Type=driverUpdate, Version=6.1.7601.17607, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: tsgenericusbdriver.inf, Ranking: 1, Device-Install: 0, Key: 4, Identity: tsgenericusbdriver.inf, Culture=neutral, Type=driverUpdate, Version=7.1.7601.16398, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: tsusbhubfilter.inf, Ranking: 1, Device-Install: 0, Key: 5, Identity: tsusbhubfilter.inf, Culture=neutral, Type=driverUpdate, Version=7.1.7601.16398, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: termkbd.inf, Ranking: 1, Device-Install: 0, Key: 6, Identity: termkbd.inf, Culture=neutral, Type=driverUpdate, Version=7.1.7601.16398, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Doqe:   q-uninstall: Inf: termmou.inf, Ranking: 1, Device-Install: 0, Key: 7, Identity: termmou.inf, Culture=neutral, Type=driverUpdate, Version=7.1.7601.16398, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS
2014-01-12 21:58:51, Info                  CBS    Perf: Doqe: Uninstall started.
2014-01-12 21:58:51, Info                  CBS    Doqe: [Forward] Uninstalling driver updates, Count 7
2014-01-12 21:58:51, Info                  CBS    DriverUpdateUninstallUpdates failed [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2014-01-12 21:58:51, Error                 CBS    Doqe: Failed uninstalling driver updates [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2014-01-12 21:58:51, Info                  CBS    Perf: Doqe: Uninstall ended.
2014-01-12 21:58:51, Info                  CBS    Failed uninstalling driver updates [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2014-01-12 21:58:51, Error                 CBS    Startup: Failed while processing non-critical driver operations queue. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

0x80070490 errors are historically very difficult to solve - and I don't have much experience with pending.xml problems

Let's have a look at the current file and see what it says...
Please upload the C:\windows\winsxs\pending.xml file and we'll see what's there.

mkv4ever · 13 Jan 2014

No "pending.xml" file in said path, only a poqexec.log and a reboot.xml.
If it was too easy it wouldn't be challenging XD.

NoelDP · 13 Jan 2014

The poqexec log is as informative as ever - NOT! :)
The reboot.xml is normal (although it scared the heck out of me when I first saw it!)

Let's have a look at the Event logs - they may tell us something...

Please open Event Viewer
In the left pane, navigate to the Windows Logs
right-click on Applications and select 'Save all events as...' save as Apps.evtx
repeat for the System logs - save as Sys.evtx
Compress both files, and attach to your reply.

mkv4ever · 13 Jan 2014

Is it me or from the events it seems my amd driver is polluting the event log?

NoelDP · 14 Jan 2014

The FileZilla Server FTP server service failed to start
The DgiVecp service failed to start
(both because the files were not found)
Crash dump initialization failed!
Encrypted volume check: Volume information on \\?\Volume{e5679338-2025-11e0-bc49-806e6f6e6963} cannot be read.

Event ID 24620 ? BitLocker Startup applies to the Bitlocker problem.

To be honest - I can't see much else wrong there - I see no significant problems with your AMD drivers?

The Apps log is more interesting - it looks like you're having Profile problems as there are a number of instances of the User Profile failing to load.
There are a huge number of 0490 errors from Disk Cleanup - unfortunately, these errors are always very difficult to solve and I have no experience with this context.

Let's check the permissions and a few other things....

Open an Elevated Command Prompt, and run the following commands...

ICACLS C:\Windows
ICACLS C:\Windows\winsxs
ICACLS C:\Windows\System32
ICACLS C:\Windows\Servicing
SC QC TRUSTEDINSTALLER
SC QUERYEX TRUSTEDINSTALLER
SC SDSHOW TRUSTEDINSTALLER
SC SHOWSID TRUSTEDINSTALLER

Post the results

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

mkv4ever · 14 Jan 2014

Here it is:

Code:

Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Administrators:(M)
           BUILTIN\Administrators:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Windows\system32>ICACLS C:\Windows\winsxs
C:\Windows\winsxs NT SERVICE\TrustedInstaller:(OI)(CI)(F)
                  BUILTIN\Administrators:(OI)(CI)(RX)
                  NT AUTHORITY\SYSTEM:(OI)(CI)(RX)
                  BUILTIN\Users:(OI)(CI)(RX)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Windows\system32>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstaller:(F)
                    NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                    NT AUTHORITY\SYSTEM:(M)
                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                    BUILTIN\Administrators:(M)
                    BUILTIN\Administrators:(OI)(CI)(IO)(F)
                    BUILTIN\Users:(RX)
                    BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                    CREATOR OWNER:(OI)(CI)(IO)(F)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Windows\system32>ICACLS C:\Windows\Servicing
C:\Windows\Servicing NT SERVICE\TrustedInstaller:(F)
                     NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
                     NT AUTHORITY\SYSTEM:(RX)
                     NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(GR,GE)
                     BUILTIN\Administrators:(RX)
                     BUILTIN\Administrators:(OI)(CI)(IO)(GR,GE)
                     BUILTIN\Users:(RX)
                     BUILTIN\Users:(OI)(CI)(IO)(GR,GE)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Windows\system32>SC QC TRUSTEDINSTALLER
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: TRUSTEDINSTALLER
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 3   DEMAND_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Windows\servicing\TrustedInstaller.exe
        GRUPPO_ORDINE_CARICAMENTO : ProfSvc_Group
        TAG                       : 0
        NOME_VISUALIZZATO         : Programma di installazione dei moduli di Win
dows
        DIPENDENZE                :
        SERVICE_START_NAME : localSystem

C:\Windows\system32>SC QUERYEX TRUSTEDINSTALLER

NOME_SERVIZIO: TRUSTEDINSTALLER
        TIPO                    : 10  WIN32_OWN_PROCESS
        STATO                   : 1  STOPPED
        CODICE_USCITA_WIN32     : 0  (0x0)
        CODICE_USCITA_SERVIZIO  : 0  (0x0)
        PUNTO_CONTROLLO         : 0x0
        SUGGERIMENTO_ATTESA     : 0x0
        PID                     : 0
        FLAG                    :

C:\Windows\system32>SC SDSHOW TRUSTEDINSTALLER

D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRRC;;;BA)(A;;CCLCSW
LOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;SAFA;WDWO;;;BA)

C:\Windows\system32>SC SHOWSID TRUSTEDINSTALLER

NOME: TRUSTEDINSTALLER
SID SERVIZIO: S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

C:\Windows\system32>

NoelDP · 14 Jan 2014

That all looks normal - I was worried that the TrustedInstaller service wasn't starting properly, but it seems to be OK.
The Permissions are all OK.

The most worrying thing is that the User Profile is failing to load - which would imply some corruption in the registry in the HKCU key.

Let's get rid of the minor annoyances...
The Dgivecp service is created by a Samsung printer driver - it's a virtual parallel port.
We can stop it loading completely without causing problems...

Open an Elevated Command Prompt, and run the following command

SC CONFIG dgivecp start= disable

Note the space after "start=" is REQUIRED.

The Filezilla problem may a little more complex - you should use any options within the program itself to disable the service from there. If there are no options, then check in the Services.msc service listing and see if it's listed there - disable it if it listed (or change it to 'Manual Start')

Did you find the Bitlocker article useful at all?

I don't think that the User Profile problem is closely related to the Disk Cleanup problem - but one way to find out is to create a new Admin user account and work from that for a while, and see if things are better. You can move settings and files across using WET (except for the Bitlocker drive).

mkv4ever · 14 Jan 2014

I disabled Filezilla, even though it should not be enabled at all, as for Bitlocker, I have no encrypted volume but I think I have a strange external HDD somewhere that I used on Windows XP SP3, and there I have the strangest information boxes claiming permission every time I try moving files and all, so I think that is the one (it could have been a bugged update regarding ntfs on Wxp, but we will never know)

As for profile corruption, I think I know what the cause of this is: Symantec Software Virtualization
Long story short, it is similar to Sandboxie but allows to install applications in "layers", each layer can be enabled and disabled and, when disabled, all changes to the system should be reverted: now I installed Filezilla Server on a layer, and it seems its service got captured but the modification the the services list wasn't, so here the reason for the error (service not found, right?).
Maybe some changes weren't captured by SWV in the past, so my profile got a bit corrupted, but everything works: updates, system recovery, backup, etc.

The only problem I caused in the past is regarding Indexing (if this is the correct translation of the term): I went the Control Panel, saw Indexing Options (or whatever is called) and just to try I tried to create a new index, the operation failed and there I started having my CPU spinning at the start of the computer but nothing more (I wasn't able to fix said problem even looking everywhere on microsoft site, and the only one that ever reported the same exact problem never reported his/her updates)

So here is my question: is it possible that to be the cause?

Anyway, is it possible to have a list of removable updates so that I can remove them one by one?
Maybe this way I will know what the failing update is.
Thanks a lot for all the time you are spending on this.

NoelDP · 14 Jan 2014

Why am I not surprised to find Symantec software involved somewhere in this? :)

I have known Search (and Indexing) cause some strange symptoms in the past - they could be the problem here, but I don't think so. It's more likely that they are another symptom of the underlying problem.

If you go to the list of Installed Updates, you can uninstall them in reverse order to the installs - I think every uninstallable update is listed there.