Corrupt MSDTC.LOG and Media Samples

[Mighty Joe]

Here are the error messages and screenshot of WU window enclosed...

Log Name: Microsoft-Windows-WindowsUpdateClient/Operational
Source: Microsoft-Windows-WindowsUpdateClient
Date: 1/29/2016 10:13:53 AM
Event ID: 42
Task Category: Automatic Updates
Level: Information
Keywords: Health,State
User: SYSTEM
Computer: Joe-PC
Description:
There has been a change in the health of Windows Update.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
<EventID>42</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>2</Task>
<Opcode>18</Opcode>
<Keywords>0x4000000000000480</Keywords>
<TimeCreated SystemTime="2016-01-29T15:13:53.409100000Z" />
<EventRecordID>70316</EventRecordID>
<Correlation />
<Execution ProcessID="1016" ThreadID="3836" />
<Channel>Microsoft-Windows-WindowsUpdateClient/Operational</Channel>
<Computer>Joe-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="hc_stateid">0</Data>
<Data Name="restartDate">
</Data>
<Data Name="restartTime">
</Data>
</EventData>
</Event>

Log Name: Microsoft-Windows-WindowsUpdateClient/Operational
Source: Microsoft-Windows-WindowsUpdateClient
Date: 1/28/2016 11:03:31 PM
Event ID: 40
Task Category: Windows Update Agent
Level: Information
Keywords: Check for Updates
User: SYSTEM
Computer: Joe-PC
Description:
An update was detected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
<EventID>40</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>17</Opcode>
<Keywords>0x4000000000000002</Keywords>
<TimeCreated SystemTime="2016-01-29T04:03:31.383000000Z" />
<EventRecordID>70306</EventRecordID>
<Correlation />
<Execution ProcessID="1016" ThreadID="5264" />
<Channel>Microsoft-Windows-WindowsUpdateClient/Operational</Channel>
<Computer>Joe-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="updateGuid">{31BD3E4B-6EB5-4249-8595-E6A86F0F1628}</Data>
<Data Name="updateRevisionNumber">200</Data>
</EventData>
</Event>

Log Name: Microsoft-Windows-WindowsUpdateClient/Operational
Source: Microsoft-Windows-WindowsUpdateClient
Date: 1/28/2016 12:46:56 PM
Event ID: 26
Task Category: Windows Update Agent
Level: Information
Keywords: Success,Check for Updates
User: SYSTEM
Computer: Joe-PC
Description:
Windows Update sucessfully found 39 updates.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
<EventID>26</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1</Task>
<Opcode>11</Opcode>
<Keywords>0x4000000000000012</Keywords>
<TimeCreated SystemTime="2016-01-28T17:46:56.729100000Z" />
<EventRecordID>70224</EventRecordID>
<Correlation />
<Execution ProcessID="1016" ThreadID="4680" />
<Channel>Microsoft-Windows-WindowsUpdateClient/Operational</Channel>
<Computer>Joe-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<updateCount xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">39</updateCount>
</UserData>
</Event>

Log Name: Microsoft-Windows-WindowsUpdateClient/Operational
Source: Microsoft-Windows-WindowsUpdateClient
Date: 1/28/2016 11:56:24 AM
Event ID: 25
Task Category: Windows Update Agent
Level: Error
Keywords: Failure,Check for Updates
User: SYSTEM
Computer: Joe-PC
Description:
Windows Update failed to check for updates with error 0x80244019.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
<EventID>25</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1</Task>
<Opcode>11</Opcode>
<Keywords>0x4000000000000022</Keywords>
<TimeCreated SystemTime="2016-01-28T16:56:24.618600000Z" />
<EventRecordID>70162</EventRecordID>
<Correlation />
<Execution ProcessID="1016" ThreadID="4332" />
<Channel>Microsoft-Windows-WindowsUpdateClient/Operational</Channel>
<Computer>Joe-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<errorCode xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">0x80244019</errorCode>
</UserData>
</Event>

 

[Aura]

I have the same options in my Windows Update panel. What options do you think are missing?

 

[Mighty Joe]

These have gone missing: Microsoft Update: "Give me updates for Microsoft products and check for new optional Microsoft software when I update Windows" and Software notifications: "Show me detailed notifications when new Microsoft software is available." I had them, now they're gone.

This is the way it should be: http://www.sevenforums.com/attachme...indows-update-settings-change-wu_settings.jpg

 

[Aura]

I'll confirm it with my VMs tonight, since I checked on my Windows 7 work laptop, but it's possible that these options have been removed (probably by one of the updates that are for the Windows Update client that we received in the last months).

 

[Mighty Joe]

Aura,

I was Googling and found someone in your forum had almost exactly the same missing key I do and BrianDrab solved the problem. Here is the link. Maybe it will assist you in helping me?

https://www.sysnative.com/forums/windows-update/14167-csi-missing-winning-component-key.html

 

[Aura]

The thing is that the update version from which that key comes from isn't the same, so I cannot use Brian's fix. However, there's a few things I'm trying right now on my end. I might be able to manually construct the key. Just in case, can you upload your COMPONENTS Hive for me please?

Retrieving the COMPONENTS Hive
Follow the instructions below to retrieve your COMPONENTS Hive and send me it.

• Open your Windows Explorer, and navigate to the C:\Windows\System32\Config folder;
• In this folder, find the COMPONENTS file (there's no extension), and copy it to your Desktop;
  Note: If you receive an error message saying that the COMPONENTS file is in use, restart your computer and try again. If the error message persist, let me know.
• Right-click on it, and select Send to... and choose Compressed (zipped) folder;
• Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

 

[Mighty Joe]

Let me know if you have any problems with the link. Btw, I also have a "components.old" and "components.new" in case that's relevant.

components - Google Driv

 

[Aura]

Let's try the following. Follow the instructions below please.

SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.

• Download SFCFix and move the executable on your Desktop;
• Download the attached SFCFixScript.txt and move the file to your Desktop;
  Note: Make sure that the file is named SFCFixScript.txt, do not rename it.
• Save any work you have open, and close every programs;
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it;
  
  
• SFCFix will launch, let it complete;
• Once done, a file will appear on your Desktop, called SFCFix.txt;
• Open the file, then copy and paste its content in your next reply;

SFCFixScript.txt

 

[Mighty Joe]

Here you go...


SFCFix version 2.4.9.0 by niemiro.
Start time: 2016-01-29 20:56:51.202
Microsoft Windows 7 Service Pack 1 - x86
Using .txt script file at C:\Users\Joe\Desktop\SFCFixScript.txt [0]


RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
RegistryScript:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.9.0 by niemiro has completed.
Currently storing 16 datablocks.
Finish time: 2016-01-29 20:56:51.564
Script hash: 808tu4wzUGiBqsbxsEqMIkw3dtg0RvRtNvrK2gvzCk8=
----------------------EOF-----------------------

 

[Aura]

Now, can you run SURT again and post the CheckSUR.log here?

 

[Mighty Joe]

Here you go. Let me know the next step...

Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-01-29 21:50
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
(f) CSI C Mark Deployment Missing 0x00000000 c!0853c74cc4003b16b24e12773ff56c81_31bf3856ad364e35_6.1.7601.19010_none_2d6abb43f679112d x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43
(f) CSI C Mark Deployment Missing 0x00000000 c!2f11068cf1032eba9cde5e324d6384c7_31bf3856ad364e35_6.1.7601.19010_none_8ab4fcaa860e7d39 x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43
(f) CSI C Mark Deployment Missing 0x00000000 c!358e22a3f0c7566fcc315cd7428dea4d_31bf3856ad364e35_6.1.7601.19010_none_7601b498a10cefc4 x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43
(f) CSI C Mark Deployment Missing 0x00000000 c!39531c517a6ef497ba30bad5a0c68a20_31bf3856ad364e35_6.1.7601.19010_none_d1f5d2f2cbcd3dc7 x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43
(f) CSI C Mark Deployment Missing 0x00000000 c!a6fdde7f89523cc2f9a3fa7c3fed4007_31bf3856ad364e35_6.1.7601.19010_none_cf6a63ca50240082 x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43
Summary:
Seconds executed: 1155
Found 5 errors
CSI C Mark Deployment Missing Total count: 5

 

[Aura]

As expected. Alright, we'll just delete the entries we just added, and I'll see if one of my colleague have that key in one of their machine.

SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.

• Download SFCFix and move the executable on your Desktop;
• Download the attached SFCFixScript.txt and move the file to your Desktop;
  Note: Make sure that the file is named SFCFixScript.txt, do not rename it.
• Save any work you have open, and close every programs;
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it;
  
  
• SFCFix will launch, let it complete;
• Once done, a file will appear on your Desktop, called SFCFix.txt;
• Open the file, then copy and paste its content in your next reply;

SFCFixScript.txt

 

[Mighty Joe]

Here you go. Sorry this is causing such a headache. I appreciate you helping me out like this. :smile9:

SFCFix version 2.4.9.0 by niemiro.
Start time: 2016-01-29 22:33:42.591
Microsoft Windows 7 Service Pack 1 - x86
Using .txt script file at C:\Users\Joe\Desktop\SFCFixScript.txt [0]


RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
RegistryScript:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.9.0 by niemiro has completed.
Currently storing 16 datablocks.
Finish time: 2016-01-29 22:33:42.949
Script hash: F3qaHt36DuAi09t+JeCjQqfBfs5t7+A7owzpX5LIi7s=
----------------------EOF-----------------------

 

[Aura]

Alright, follow the instructions below please.

SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.

• Download SFCFix and move the executable on your Desktop;
• Download the attached SFCFixScript.txt and move the file to your Desktop;
  Note: Make sure that the file is named SFCFixScript.txt, do not rename it.
• Save any work you have open, and close every programs;
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it;
  
  
• SFCFix will launch, let it complete;
• Once done, a file will appear on your Desktop, called SFCFix.txt;
• Open the file, then copy and paste its content in your next reply;

SFCFixScript.txt

 

[Mighty Joe]

Here you go...

FCFix version 2.4.9.1 by niemiro.
Start time: 2016-01-30 18:13:16.317
Microsoft Windows 7 Service Pack 1 - x86
Using .txt script file at C:\Users\Joe\Desktop\SFCFixScript.txt [0]


RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments.
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\358e22a3f0c..cd7428dea4d_31bf3856ad364e35_6.1.7601.19010_7601b498a10cefc4.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\358e22a3f0c..cd7428dea4d_31bf3856ad364e35_6.1.7601.19010_7601b498a10cefc4.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.19010_none_736b83e9e14e7f43.
RegistryScript:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.9.1 by niemiro has completed.
Currently storing 18 datablocks.
Finish time: 2016-01-30 18:13:16.723
Script hash: FaJg9688Fw7Tq9DqtxPfL/CfNK2B+kPWxEc2zuZbMFc=
----------------------EOF-----------------------

 

[Aura]

Now, can you run SURT again and copy/paste the content of the CheckSUR.log here after?

 

[Mighty Joe]

Here you go. Looks like we're making progress...

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-01-31 03:31
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 669
No errors detected

 

[Aura]

Awesome :) Let's make sure that SFC returns a clean log as well.

System File Checker (SFC)
Follow the instructions below to run a SFC scan on your system and to provide the CBS log in your next reply;

• On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select
  
  Run as Administrator
• On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
• On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
• Enter the command below and press on Enter;
  

  sfc /scannow

  Note: There's a space between "sfc" and "/scannow";
• Once the scan is complete, enter the command below and press on Enter
  

  copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

• A file called cbs.txt will have appeared on your Desktop. Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Note: Please note that the CBS.log is volatile, which means that if you don't upload it after the SFC scan is completed, it won't have the information from the scan anymore. So archive it and upload it as soon as you can.

 

[Mighty Joe]

cbs.txt - Google Driv

"Windows Resource Protection did not find any integrity violations."

Can I delete the cbspersist cabinet files from a few days ago?

Let me know if there are more tests you want to run to make sure I'm clean. I just want to be completely sure that WU will run consistently going forward.

Thanks.:smile9:

 

[Aura]

Yes, you can :) Is your Windows Update working properly now or not?