[SOLVED] Windows 10 Home KB5026361 fails with 0x8007010B error

[tadc]

still no joy, update failed with the same 0x8007010b error. CBS log attached.

 

[Gary R]

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download the attachment SFCFix.zip and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt
• Open the file, then copy and paste its content in your next reply.

Next ...

• Click Search button and type Command Prompt
• From the results, right click on the Command Prompt icon, and select Run as administrator
• A Command Window will open.
• Copy paste the command below into it, then press Enter
• Dism /Online /Cleanup-Image /RestoreHealth
• Once DISM has finished running ...
  • Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
• If the file is too large, upload it to a file sharing service, and post me the link.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Next ....

• Open Windows Explorer and browse to the ... C:\Windows\WinSxS\Pending.xml ... file.
• Right click on it, and select ... Send to > Compressed (zipped) folder
• A message will appear stating, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
  • Answer Y to create a folder Pending.zip on your Desktop.
• Please attach it to your next post.
  • If the file is too large, please upload it to a file sharing service and provide the link to it in your next reply.
  • Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

 

[tadc]

SFCFix version 3.0.2.1 by niemiro.
Start time: 2023-06-07 07:12:44.016
Microsoft Windows 10 Build 19044 - amd64
Using .zip script file at C:\Users\Thadd\Desktop\SFCFix (4).zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\WinSxS\Backup

Successfully created directory tree \\?\C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f.
Successfully created directory tree \\?\C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\r.
Successfully created directory tree \\?\C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\f.

Successfully copied file C:\Users\Thadd\AppData\Local\niemiro\Archive\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\ole32.dll to C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\ole32.dll.
Successfully copied file C:\Users\Thadd\AppData\Local\niemiro\Archive\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\r\ole32.dll to C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\r\ole32.dll.
Successfully copied file C:\Users\Thadd\AppData\Local\niemiro\Archive\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\f\ole32.dll to C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f\f\ole32.dll.

Successfully restored ownership for C:\Windows\WinSxS\Backup
Successfully restored permissions on C:\Windows\WinSxS\Backup
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 35465 datablocks.
Finish time: 2023-06-07 07:12:46.538
Script hash: +tvukqtd3OWt+ncEyJQmxDPcV+ZflR/c4Zl2nkYqfPY=
----------------------EOF-----------------------

Re: your last instruction, C:\Windows\WinSxS\pending.xml doesn't seem to exist.

 

[Gary R]

Looking over your latest logs now, further consultation with my colleagues needed, so may take a while. Back ASAP.

 

[Gary R]

Can you try updating please.

If successful please let me know.

If unsuccessful, please post your latest CBS.log

 

[tadc]

Update failed, same error.

 

[Gary R]

• Start FRST.
• Hit your Windows Key + R to open a Run window
• Type Notepad then click OK
• This will open an empty Notepad document
• Copy/Paste the following into it (Don't include Code: ) .....

DeleteValue: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_for_ServicingStack_2905~31bf3856ad364e35~amd64~~19041.2905.1.0 | ExtendedError
Reboot:

• Save it as fixlist.txt to the same location as FRST (must be in this location)
• NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

Next ...

Please try updating your computer, and let me know if successful.

If not, please post me your latest CBS.log

 

[tadc]

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2023
Ran by Thadd (07-06-2023 14:49:20) Run:4
Running from C:\Users\Thadd\Downloads
Loaded Profiles: Thadd
Boot Mode: Normal
==============================================

fixlist content:
*****************
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_for_ServicingStack_2905~31bf3856ad364e35~amd64~~19041.2905.1.0 | ExtendedError
Reboot:
*****************

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_for_ServicingStack_2905~31bf3856ad364e35~amd64~~19041.2905.1.0\\ExtendedError" => removed successfully


The system needed a reboot.

==== End of Fixlog 14:49:20 ====

reapplied the update, same failure.

 

[Gary R]

Damn, hoped we might have fixed things with that one.

Looking over your latest log, will get back to you as soon as I have something further.

 

[Gary R]

Can you please post me the following logfile (if available) ....

C:\Windows\Logs\CBS\poqexec.log

As we've made quite a few changes to your machine ....

Next ... please post me a fresh copy of your COMPONENTS hive ...

• Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
• The file will likely be too large to upload here, if so please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Please post me the link to the file

Next ... please post me a fresh copy of your CBS hive ...

• Click on the Start button and in the search box, type regedit
  • When you see regedit on the list, right-click on it and select Run as administrator
• When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

• Once selected, click File > Export....
  • Change the Save as type: to Registry Hive Files (.)
  • Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
• Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
• Attach the .ZIP file to your next post.
• If the file is too large to upload here, please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Finally ... can you please do the following ....

• Download and run Process Monitor
  • Leave this running while you perform the next steps.
• Try updating the system just like you have in the past.
• Stop Process Monitor as soon as it fails.
  • You can simply do this by clicking the "Square" icon on the toolbar (third one from the left) or by hitting Ctrl+E
• Select the File menu ... Save ... and save the file to your Desktop.
  • The name will be LogFile.PML.
• Zip the file, and upload to a file sharing service.
• Provide the link to LogFile.PML
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Also attach a copy of your ... C:\Windows\Logs\CBS\CBS.log ... with your reply.

 

[tadc]

Can you please post me the following logfile (if available) ....

C:\Windows\Logs\CBS\poqexec.log

As we've made quite a few changes to your machine ....

Next ... please post me a fresh copy of your COMPONENTS hive ...

• Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
• The file will likely be too large to upload here, if so please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Please post me the link to the file

Next ... please post me a fresh copy of your CBS hive ...

• Click on the Start button and in the search box, type regedit
  • When you see regedit on the list, right-click on it and select Run as administrator
• When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

• Once selected, click File > Export....
  • Change the Save as type: to Registry Hive Files (.)
  • Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
• Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
• Attach the .ZIP file to your next post.
• If the file is too large to upload here, please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Finally ... can you please do the following ....

• Download and run Process Monitor
  • Leave this running while you perform the next steps.
• Try updating the system just like you have in the past.
• Stop Process Monitor as soon as it fails.
  • You can simply do this by clicking the "Square" icon on the toolbar (third one from the left) or by hitting Ctrl+E
• Select the File menu ... Save ... and save the file to your Desktop.
  • The name will be LogFile.PML.
• Zip the file, and upload to a file sharing service.
• Provide the link to LogFile.PML
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Also attach a copy of your ... C:\Windows\Logs\CBS\CBS.log ... with your reply

Apologies, I tried to save a draft of my in-progress message and somehow only the attachments got saved.

C:\Windows\Logs\CBS\poqexec.log doesn't seem to exist.
Components.zip and ComponentBaseServicing hive attached.

When I went to reinstall the update with ProcMon running, it reported that the update was already installed, which got me excited for a moment but turns out it had "installed" in the background same as previous attempts, but on reboot it got to the after-POST, pre-boot stage and rolled back the update again.

Completed reboot, re-ran the update with ProcMon running and logfile.PML is here: procmon log

 

[Gary R]

Looking over your logs. Whilst I do that, can you do the following for me ....

Please navigate to ... C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f ... and double click on it to open that directory.

Please take a screenshot of it's contents, and post it in your next reply.

Please repeat for ... C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f ... and post the screenshot for that folder as well.

 

[tadc]

 

[Gary R]

Can I please ask you to do a similar couple of screenshots for ....

C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3

C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3

... if they are present on your machine.

You'll probably have to search for them manually, as they may not show up if you use the Search function. They may be folders, or perhaps zero byte files.

 

[tadc]

No directory (or file) by that name in WinSxS:



This folder exists, but errors when I try to open it:

 

[Gary R]

Thanks, that confirms things, and we think it is the directory in Backup that appears to be causing the problem.

Just going to consult and will get back to you ASAP.

 

[Gary R]

• Start FRST.
• Hit your Windows Key + R to open a Run window
• Type Notepad then click OK
• This will open an empty Notepad document
• Copy/Paste the following into it (Don't include Code: ) .....

RemoveDirectory: C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3

• Save it as fixlist.txt to the same location as FRST (must be in this location)
• NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

 

[tadc]

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2023
Ran by Thadd (09-06-2023 09:19:59) Run:5
Running from C:\Users\Thadd\Downloads
Loaded Profiles: Thadd
Boot Mode: Normal
==============================================

fixlist content:
*****************
RemoveDirectory: C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3
*****************

could not remove "C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3" => Scheduled to remove on reboot.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 09-06-2023 10:21:10)

C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3 => Could not move

==== End of Fixlog 10:21:10 ====

Dir is still there, still same problem:

 

[Gary R]

Feared that might be the case.

OK, let's try again, this time with your computer booted into Recovery Environment.

• Download FRST64 to a USB flash drive.

Next ...

• Click Start
• Type notepad.exe in the search programs and files box and click Enter.
• A blank Notepad page should open.
  • Copy/Paste the contents of the code box below into Notepad.

RemoveDirectory: C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3

• • Save it to your USB flashdrive as fixlist.txt
• Plug the USB drive into the infected machine.

Boot your computer into Recovery Environment

• Right click on Start and select Shutdown or sign out
• Hold down your Shift key and then click on Restart
• A Choose an Option window will open ... click on Troubleshoot
• A Troubleshoot window will open ... click on Advanced options
• A Advanced options window will open ... click on Command Prompt
• Your computer will reboot into Recovery Environment.
• Click on your account, and when prompted enter your password.
• Once the Command window is open.
  • Type notepad then hit Enter.
  • Notepad will open.
    • Click File > Open then select Computer.
    • Note down the drive letter for your USB Drive.
    • Close Notepad.
• Back in the command window ....
  • Type e:/frst64.exe and hit Enter (where e: is replaced by the drive letter for your USB drive)
  • FRST will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Fix button.
    • FRST will now process the fixlist and will make a log Fixlog.txt on the flash drive.
• Close the command window.
• Boot back into normal mode and post me the Fixlog.txt log please.

 

[tadc]

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2023
Ran by SYSTEM (09-06-2023 15:56:19) Run:6
Running from D:\
Boot Mode: Recovery
==============================================

fixlist content:
*****************
RemoveDirectory: C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3
*****************

"C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_20ddd445a787b81f_ole32.dll_e9dcc2e3" => could not remove

==== End of Fixlog 15:56:19 ====