[SOLVED] Win7x64 SP1 - Can't install Updates - Code 8000FFFF - This one is kicking my tail!

"From one of my VMs" ;P

I didn't even ask about whether or not you were maintaining a herd of VMs, because the workload seemed incredible - wow (thank you)!

Here is Procmon Log as well as latest CBS:
Procmon_CBS_3c.zip
 
FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste 7.1.7601.18325 into the Search box and click the Search Registry button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.
 
Here you are.

Code: 
Farbar Recovery Scan Tool (x64) Version: 10-08-2019
Ran by Administrator (12-08-2019 21:10:31)
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal

================== Search Registry: "7.1.7601.18325" ===========

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_eb8789550867031e9b71c5e5b6cd723e_31bf3856ad364e35_none_f0e10e7382186093\v!7.1.7601.18325]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_cae5bf71393e136f\v!7.1.7601.18325]
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_6ec723ed80e0a239\v!7.1.7601.18325]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect\amd64_microsoft-windows-photo-image-codec_31bf3856ad364e35_0.0.0.0_none_1f323f66464683e5]
"Package_1_for_KB2913152~31bf3856ad364e35~amd64~~6.1.2.0.2913152-2_neutral_GDR"="7.1.7601.18325@16"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_0.0.0.0_none_c313a3e28de912af]
"Package_1_for_KB2913152~31bf3856ad364e35~amd64~~6.1.2.0.2913152-2_neutral_GDR"="7.1.7601.18325@16"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_eb8789550867031e9b71c5e5b6cd723e_31bf3856ad364e35_none_f0e10e7382186093\7.1]
"7.1.7601.18325"="0x01"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_eb8789550867031e9b71c5e5b6cd723e_31bf3856ad364e35_none_f0e10e7382186093\7.1]
""="7.1.7601.18325"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_cae5bf71393e136f\7.1]
""="7.1.7601.18325"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_cae5bf71393e136f\7.1]
"7.1.7601.18325"="0x01"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_6ec723ed80e0a239\7.1]
""="7.1.7601.18325"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_none_6ec723ed80e0a239\7.1]
"7.1.7601.18325"="0x01"

====== End of Search ======
 
Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 

Attachments

Thank you, here are the contents of Fixlog.txt:
Code: 
Fix result of Farbar Recovery Scan Tool (x64) Version: 10-08-2019
Ran by Administrator (13-08-2019 12:02:14) Run:2
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator & MSSQL$INTACT (Available Profiles: Admin & Admin & Administrator & MSSQL$INTACT & Classic .NET AppPool & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
cmd: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
StartRegedit:
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_7.1.7601.18325_none_92a7aa302eeeecee]
"identity"=hex:4d,69,63,72,6f,73,6f,66,74,2d,57,69,6e,64,6f,77,73,2d,50,68,6f,\
  74,6f,2d,49,6d,61,67,65,2d,43,6f,64,65,63,2c,20,43,75,6c,74,75,72,65,3d,6e,\
  65,75,74,72,61,6c,2c,20,56,65,72,73,69,6f,6e,3d,37,2e,31,2e,37,36,30,31,2e,\
  31,38,33,32,35,2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,\
  66,33,38,35,36,61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,\
  72,63,68,69,74,65,63,74,75,72,65,3d,78,38,36,2c,20,76,65,72,73,69,6f,6e,53,\
  63,6f,70,65,3d,4e,6f,6e,53,78,53
"S256H"=hex:0c,ec,96,3d,36,57,9d,35,d0,28,fb,f2,9b,f6,cb,13,d2,ea,cf,1b,62,b5,\
  c2,57,93,bc,c8,71,1f,b7,df,b9
"c!eb878955086..5e5b6cd723e_31bf3856ad364e35_7.1.7601.18325_2aa518e7579fa7e0"=hex:
"f!wmphoto.dll"=hex:57,00,4d,00,50,00,68,00,6f,00,74,00,6f,00,2e,00,64,00,6c,\
  00,6c,00

[HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\eb878955086..5e5b6cd723e_31bf3856ad364e35_7.1.7601.18325_2aa518e7579fa7e0]
"appid"=hex:65,62,38,37,38,39,35,35,30,38,36,37,30,33,31,65,39,62,37,31,63,35,\
  65,35,62,36,63,64,37,32,33,65,2c,20,43,75,6c,74,75,72,65,3d,6e,65,75,74,72,\
  61,6c,2c,20,56,65,72,73,69,6f,6e,3d,37,2e,31,2e,37,36,30,31,2e,31,38,33,32,\
  35,2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,66,33,38,35,\
  36,61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,72,63,68,69,\
  74,65,63,74,75,72,65,3d,61,6d,64,36,34,2c,20,76,65,72,73,69,6f,6e,53,63,6f,\
  70,65,3d,4e,6f,6e,53,78,53
"CatalogThumbprint"="bf267546697ff68bb16af5d838cd84c6a312d5cc6961255e35964eced5a2f265"
"p!CBS_package_1_for_kb2913152~31bf3856ad364e35~amd64~~6.1.2.0.2913_0652c14766f69d65"=hex:4d,\
  00,00,00,02,00,00,00,50,61,63,6b,61,67,65,5f,31,5f,66,6f,72,5f,4b,42,32,39,\
  31,33,31,35,32,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,7e,61,6d,\
  64,36,34,7e,7e,36,2e,31,2e,32,2e,30,2e,32,39,31,33,31,35,32,2d,32,5f,6e,65,\
  75,74,72,61,6c,5f,47,44,52,31,37
"i!CBS_package_1_for_kb2913152~31bf3856ad364e35~amd64~~6.1.2.0.2913_0652c14766f69d65"=hex:4d,\
  00,00,00,02,00,00,00,50,61,63,6b,61,67,65,5f,31,5f,66,6f,72,5f,4b,42,32,39,\
  31,33,31,35,32,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,7e,61,6d,\
  64,36,34,7e,7e,36,2e,31,2e,32,2e,30,2e,32,39,31,33,31,35,32,2d,32,5f,6e,65,\
  75,74,72,61,6c,5f,47,44,52,31,37

EndRegedit:

*****************

Restore point was successfully created.

========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========

The operation completed successfully.


========= End of CMD: =========

Registry ====> The operation completed successfully.


==== End of Fixlog 12:02:24 ====
[\CODE]
 
I learned a lot and got to use some new tools, much appreciated.

The particular issue was resolved last week by migrating the services to a new VM. I've just never seen a system in this shape and was hoping we could find the Root Cause.

I could take wild guesses as to what happened all day and possibly never hit the mark. Something irks me about just paving over this and moving on without learning WHAT went wrong, but sometimes you've got to stop banging your head against the bricks, eh? :)

Do you have any more insight into what happened and how to prevent it in the future?


Softwaremaniac - thank you very much for your time and attention on this!
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top