[SOLVED] Unable to update windows 0x800705aa

[Maxstar]

Okay, then please check the size of the loaded hives as well to see if one of the hives (SYSTEM / SOFTWARE) is bloated for some reason!

 

[rjrram]

Not sure what size would constitute bloated

Ru v1.2 - Registry size usage reporter
Copyright (C) 2013-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

18,203 HKLM\BCD00000000
5,967,347 HKLM\DRIVERS
10 HKLM\SAM
85,630,705 HKLM\SOFTWARE
67,194,996 HKLM\SYSTEM
Values: 999449
Keys: 566075
Size: 158,811,273 bytes

 

[Maxstar]

No, this looks good as well as the previous DIR command for the %windir%\System32\Config folder. So maybe it is an issue with an illigal_charachter into the registry. So please run ComponentsScanner again with Process Monitor Running.

Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Run ComponentsScanner again
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the capture icon (CTRL +E) on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer | Send Large Files Fast - Up To 2GB Free and provide the link.
6. Upload also the latest CBS log for the time stamps.

 

[rjrram]

ComponentsScanner.txt

 

[rjrram]

ComponentsScanner.txt

 

[Maxstar]

This file contains ProcMon.exe instead of the trace file (*.pml).

 

[rjrram]

Sorry. Here it is. Logfile.PML

 

[Maxstar]

12/5/2024 10:34:23 PM    ComponentsScanner.exe    RegLoadKey    HKLM\i2ieyvku    INSUFFICIENT RESOURCES    Hive Path: C:\Users\<name>\AppData\Local\Temp\tmpF940.tmp

Please run the following command in an elevated prompt to see what happens:

reg query HKLM\i2ieyvku

 

[rjrram]

C:\WINDOWS\system32>reg query HKLM\i2ieyvku
ERROR: The system was unable to find the specified registry key or value.

 

[Maxstar]

12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 12,877,824, Length: 20,480, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    SSPService.exe    CreateFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened
12/5/2024 10:34:23 PM    SSPService.exe    QueryFileInternalInformationFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    IndexNumber: 0xbe00000006dab7
12/5/2024 10:34:23 PM    SSPService.exe    QueryBasicInformationFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    CreationTime: 11/21/2024 5:35:54 PM, LastAccessTime: 11/21/2024 5:35:54 PM, LastWriteTime: 11/21/2024 5:35:54 PM, ChangeTime: 11/21/2024 5:35:54 PM, FileAttributes: A
12/5/2024 10:34:23 PM    SSPService.exe    QueryStandardInformationFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    AllocationSize: 184, EndOfFile: 182, NumberOfLinks: 1, DeletePending: False, Directory: False
12/5/2024 10:34:23 PM    SSPService.exe    ReadFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    Offset: 0, Length: 182
12/5/2024 10:34:23 PM    SSPService.exe    ReadFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    Offset: 0, Length: 182, I/O Flags: Non-cached, Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    SSPService.exe    ReadFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    Offset: 0, Length: 182, Priority: Normal
12/5/2024 10:34:23 PM    SSPService.exe    QueryBasicInformationFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    CreationTime: 11/21/2024 5:35:54 PM, LastAccessTime: 12/5/2024 10:34:23 PM, LastWriteTime: 11/21/2024 5:35:54 PM, ChangeTime: 11/21/2024 5:35:54 PM, FileAttributes: A
12/5/2024 10:34:23 PM    SSPService.exe    QueryStandardInformationFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    AllocationSize: 184, EndOfFile: 182, NumberOfLinks: 1, DeletePending: False, Directory: False
12/5/2024 10:34:23 PM    SSPService.exe    ReadFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS    Offset: 0, Length: 182
12/5/2024 10:34:23 PM    SSPService.exe    CloseFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS
12/5/2024 10:34:23 PM    SSPService.exe    CloseFile    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\README    SUCCESS
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 7,456,256, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 1,434,624, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 7,472,640, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 1,434,624, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 1,745,920, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 1,745,920, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 35,946,496, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 35,913,728, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    ComponentsScanner.exe    ReadFile    C:\Users\<name>\Desktop\ComponentsScanner.exe    SUCCESS    Offset: 14,110,720, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12/5/2024 10:34:23 PM    SSPService.exe    CreateFile    C:\Users\<name>i\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences    SUCCESS    Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Requiring Oplock, Attributes: N, ShareMode: Read, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM
12/5/2024 10:34:23 PM    ComponentsScanner.exe    RegQueryKeySecurity    HKLM    SUCCESS
12/5/2024 10:34:23 PM    SSPService.exe    FileSystemControl    C:\Users\<name>\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences        Control: FSCTL_REQUEST_OPLOCK
12/5/2024 10:34:23 PM    Flow.exe    QueryNameInformationFile    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll    SUCCESS    Name: \Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
12/5/2024 10:34:23 PM    ComponentsScanner.exe    RegLoadKey    HKLM\i2ieyvku    INSUFFICIENT RESOURCES    Hive Path: C:\Users\<name>\AppData\Local\Temp\tmpF940.tmp

Are you able to remove the Sophos Security Software on this system?

 

[rjrram]

Yes temporarily but we have 850 other systems with this software and no issues with updates.

 

[Maxstar]

I understand that, but to investigate the problem on this system it may help to rule out this software could be an issue.

Let's try something else too! Open and elevated pompt and run the following commands on by one and copy paste the result in your next post.

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
reg load HKLM\DRIVERS C:\WINDOWS\SYSTEM32\CONFIG\DRIVERS

 

[rjrram]

C:\WINDOWS\system32>reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
ERROR: Insufficient system resources exist to complete the requested service.

C:\WINDOWS\system32>reg load HKLM\DRIVERS C:\WINDOWS\SYSTEM32\CONFIG\DRIVERS
The operation completed successfully.

I can definitely disable the AV software. Just let me know what you want me to try with it disabled.

 

[Maxstar]

It seems this is an issue with the COMPONENTS hive only, please try the following!

Copy the COMPONENTS hive to your desktop e.g. and run the following command to load it with a {random} name into the registry and post the result.

reg load HKLM\Hive-Temp %userprofile%\Desktop\COMPONENTS"

You can use the following command to unload the temp hive.

reg unload HKLM\Hive-Temp

 

[rjrram]

C:\WINDOWS\system32>reg load HKLM\Hive-Temp %userprofile%\Desktop\COMPONENTS"
ERROR: Insufficient system resources exist to complete the requested service.

With AV turned off

 

[Maxstar]

Hmm, please try the following. But I think it will show the same result!

Download

ComponentsScanner and save it to your desktop.

• Follow these instructions to scan your (local) copy of the COMPONENTS hive on the desktop to check if it will load into the registry!
• Drag the COMPONENTS hive file over the ComponentsScanner.exe executable and release it.

• ComponentsScanner will launch, when ready or failure post the result.

 

[rjrram]

Loading registry hive from C:\Users\******\Desktop\COMPONENTS
Parsing loaded hive, please wait...
Hive parsed successfully - found 71,427 keys and 239,536 values
Starting corruption scan
Performing regedit load test
Hive failed regedit load test with error "ERROR_NO_SYSTEM_RESOURCES: Insufficient system resources exist to complete the requested service."
Scanning CanonicalData\Catalog for corruptions
Scanning CanonicalData\Deployments for corruptions
Scanning DerivedData\Components for corruptions
Scanning VersionedIndex\...\ComponentFamilies for corruptions
Analysing coruptions
Checking for malformed Deployment keys
Checking CatalogThumbprints & c! marks
Generating report
Archiving previous report C:\Users\*******\Desktop\ComponentsScanner.txt to C:\Users\********\AppData\Local\Sysnative\ComponentsScanner\Reports\ComponentsScanner_12_05_2024_04_34_48.txt


The corruption scan completed after 5.82 seconds. 1 corruptions were detected. 0 warnings were detected.

 

[Maxstar]

The corruption scan completed after 5.82 seconds. 1 corruptions were detected. 0 warnings were detected.

Please provide the following log %localappdata%\Sysnative\ComponentsScanner.log

Post also a new copy of the COMPONENTS hive to look at.

 

[rjrram]

COMPONENTS

 

[Maxstar]

Hi,

It seems this system is running out of available memory at some point, please boot into safe mode and run ComponentsScanner again. Please check also the memory usage!