[SOLVED] [Win10v1607Build14393 x64] Win.Upd. 0x80070246

R

rrauenza

Member
Joined
Apr 28, 2017
Posts
14
Windows update gives me this error:

Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4015217) - Error 0x80070246

When I first started looking at this issue, running dism.exe, I found in the cbs.log / dism.log errors about bad unicode strings -- I figured out which past update package corresponded to it and so removed that update (and no, I didn't write it down! Ugh! Haven't found it in the event log yet).

I now no longer get that error in dism.exe, but am still unable to update.

I now get:

Code: 
C:\Windows\System32\config>dism /online /cleanup-image /restorehealth


Deployment Image Servicing and Management tool
Version: 10.0.14393.0


Image Version: 10.0.14393.0


[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.


C:\Windows\System32\config>dism /online /cleanup-image /StartComponentCleanup


Deployment Image Servicing and Management tool
Version: 10.0.14393.0


Image Version: 10.0.14393.0


[===========                20.0%                          ]


Error: 2


The system cannot find the file specified.


The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

and sometimes

Code: 
C:\Windows\System32\config>dism /online /cleanup-image /StartComponentCleanup


Deployment Image Servicing and Management tool
Version: 10.0.14393.0


Image Version: 10.0.14393.0


[===========                20.0%                          ]
The operation completed successfully.


C:\Windows\System32\config>

SFCFix finds nothing:

Code: 
SFCFix version 3.0.0.0 by niemiro.
Start time: 2017-04-28 09:29:26.555
Microsoft Windows 10 Build 14393 - amd64
Not using a script file.








AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.








Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2017-04-28 09:37:29.382
----------------------EOF-----------------------


Here's my current dism.log:

ZeroBin
 
Looking through the event log, I think the corrupted (the unicode issue I mentioned above) update I uninstalled was kb320663.

I found this event in Windows Logs/ Setup from the time period I removed it:

Initiating changes for package KB3206632. Current state is Installed. Target state is Absent. Client id: Software Explorer.

Removing it seemed to make things better (no longer get the unicode error in dism/cbs), but I still can't update.
 
Hi and welcome to Sysnative. Sorry for the delay. Do you still need assistance? So we are meeting expectations I also wanted to let you know that I will be on vacation until May 10th. There are other helpers that may pick up the this thread but if they don't you can expect a response on the 10th or 11th at the latest.

Please let me know however if you still need assistance and I'll check back in at that time.

Thank you.
 
Please start with the following.

SFC Scan
1. Right-click on the Start button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
 sfc /scannow

3. Once it finishes, copy and paste the following into the command-prompt window and press Enter.
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

4. Once this has completed please go to your Desktop and you will find CBS.txt => Right-click on this file and choose Send To...Compressed (zipped folder). Please upload this zipped file CBS.zip to this thread

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.
 
Code: 
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
C:\WINDOWS\system32>

Logs: View attachment CBS.zip
 
Current failing update is "2017-05 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4019472) - Error 0x80070246" because I think it was superseded -- shall I do it instead since its the latest?
 
Could this line be the issue?

Code: 
2017-05-12 22:35:31, Error                 CSI    00000007@2017/5/13:05:35:31.824 (F) onecore\base\lstring\lblob.cpp(2145): Error STATUS_ILLEGAL_CHARACTER originated in function RtlTranscodeLBlobs expression: __rv.UcsCharacter != (0xffffffff)
[gle=0x80004005]

How do we map that into what is corrupted?
 
Yes that is exactly why. We can fix just that one corruption but usually where there is one corruption there is more so I would like to take a look at your entire hive. Please do the following.

Retrieve Components Hive
 1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.
 
This one could be a little tricky. The corruption may be in the Software hive. Let's see for sure. Please do the following.

Step#1 - Capture Process Monitor Trace
 1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Attempt the manual install of the update just like you did previously.
3. Stop Process Monitor as soon as the update fails. You can simply do this by clicking the magnifying glass on the toolbar as shown below.
11908d1430506241-windows-updates-fail-repeatedly-stop-jpg


4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and attach the LogFile.PML file as well as your CBS.log.
 
I'll post the results below, but while it's compressing here's some amateur pre-analysis --

From the CBS log, the file offset (and timestamp ) of the Error is

Code: 
$ strings -a -t d  CBS.log  | grep ,\ Error
[...skipping entries from earlier today...]
20351362 2017-05-13 11:23:45, Error                 CSI    00000007@2017/5/13:18:23:45.800 (F) onecore\base\lstring\lblob.cpp(2145): Error STATUS_ILLEGAL_CHARACTER originated in function RtlTranscodeLBlobs expression: __rv.UcsCharacter != (0xffffffff)
20352934 2017-05-13 11:23:57, Error                 CSI    00000008 (F) HRESULT_FROM_WIN32(582) #285743# from Windows::ServicingAPI::CCSITransactionAnalysis_ICSIInventory::EnumDeploymentReferences(flags = 00000003, tlcid = @0x24e1fc4ea70, pszSubscription = (null), pszCodebase = (null))
20356022 2017-05-13 11:23:57, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x80070246 - ERROR_ILLEGAL_CHARACTER]

I tried to find where the WriteFile events matched up with the offset of the error message (20,351,362) ... but wasn't successful. I'm not also convinced the timestamps line up with the CBS.log -- procmon might lag in logging the events?

Here's the dropbox link: Dropbox - procmon1.zip
 
So the CBS.log was pointing us to the key...
Code: 
2017-05-13 11:23:57, Info                  CBS    Failed to call EnumDeploymentReferences on deployment: amd64_6a7fdca02aa95329cc0519e91562e625_6595b64144ccf1df_5.82.14393.447_none_51c836f770dc2c58 [HRESULT = 0x80070246 - ERROR_ILLEGAL_CHARACTER]

But it took me awhile to find it. The Procmon.log pointed to the exact value for us. It was the i! mark.
Capture.jpg

Looking at the i! mark I see the following corruption. That is supposed to be a 6 with a Hex value of 36 and not FE.
Capture.JPG

The following should fix you up.

Step#1 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.
  1. Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
  2. Download the file below, SFCScript.txt, and save this to your Desktop.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCScript.txt.
  5. Drag the file SFCScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please
 

Attachments

Code: 
Welcome to SFCFix by niemiro and sysnative.com.


Checking for updates . . .
No new update is available at this time.


Processing directive 1 of 1 (AutoAnalysis::)
Checking store directories . . . ^C
C:\Users\Rich\Desktop\windows update failure stuff\1>


C:\Users\Rich\Desktop\windows update failure stuff\1>


C:\Users\Rich\Desktop\windows update failure stuff\1>..\SFCFix "SFCScript (1).txt"
Welcome to SFCFix by niemiro and sysnative.com.


Checking for updates . . .
No new update is available at this time.


Processing directive 1 of 1 (RegistryScript::)
Successfully processed all directives.


C:\Users\Rich\Desktop\windows update failure stuff\1>

Code: 
SFCFix version 67.70.105.70 by niemiro.
Start time: 2017-05-14 08:34:32.537
Microsoft Windows 10 Build 14393 - amd64
Using .txt script file at SFCScript (1).txt [0]








RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\6a7fdca02aa..9e91562e625_6595b64144ccf1df_5.82.14393.447_51c836f770dc2c58.


Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\6a7fdca02aa..9e91562e625_6595b64144ccf1df_5.82.14393.447_51c836f770dc2c58.


Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\6a7fdca02aa..9e91562e625_6595b64144ccf1df_5.82.14393.447_51c836f770dc2c58.
RegistryScript:: directive completed successfully.








Successfully processed all directives.
SFCFix version 67.70.105.70 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2017-05-14 08:34:33.132
Script hash: umYb3ELHrO8P4xzdJym82g+1ZHXKZ43JPy07YgrMfcY=
----------------------EOF-----------------------

Looking back at the data from before, I see it now in the CSV file version as well:

Code: 
Logfile.CSV:"11:23:45.8817135 AM","TiWorker.exe","19804","RegQueryValue","HKLM\COMPONENTS\CanonicalData\Deployments\6a7fdca02aa..9e91562e625_6595b64144ccf1df_5.82.14393.447_51c836f770dc2c58\p!CBS_package_2335_for_kb3201845~31bf3856ad364e35~amd64~~10.0.1.2._6ced25ef2af14cd9","SUCCESS","Type: REG_BINARY, Length: 89, Data: 50 00 00 00 01 00 00 00 50 61 63 6B 61 67 65 5F"

...is that really supposed to be a string? Could I theoretically write a program that converts that hex to a unicode string and then validates that its malformed unicode?
 
...is that really supposed to be a string? Could I theoretically write a program that converts that hex to a unicode string and then validates that its malformed unicode?
Click to expand...
I honestly don't know as I'm not a developer.

See if Windows Update is fixed now.
 
You must log in or register to reply here.
Back
Top