Windows 7 64bit-windows update error 8007370B. unable to correct error

M

mrxero2

Member
Joined
Nov 12, 2014
Posts
11
I have been experiencing BSODs that usually refer to some sort of memory error. Recently I lost my ability to access microsoft office 2013. I attempted to follow MS support instructions which had me uninstall office. I have not been able to reinstall office without receiving an error. I contacted ms help desk and they indicated to me that the problem was update related but wanted to be paid for further assistance. I would like to see if I can correct the problem myself with a little guidance.

I have had windows update problems in the past and I thought I was able to avoid them by using the offline windows update (WSUS). It appears i was mistaken. Any help given would be greatly appreciated.


here is a copy of the SFCfix log:

SFCFix version 2.4.1.0 by niemiro.
Start time: 2014-11-12 22:46:42.933
Not using a script file.




AutoAnalysis::
FIXED: Successfully repaired missing store directory C:\Windows\winsxs\amd64_microsoft-windows-msclient-netmscli-pro_31bf3856ad364e35_6.1.7600.16385]none_f67b1c3af4a2b896.
FAILED: Could not repair missing store directory C:\Windows\winsxs\x86_microsoft-windows/m..oracle-provider-dll_11bf3856ad364e35_6.1.7602.16385_none_92f9516ff490edd0 with error code ERROR_INVALID_NAME.




SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: -1723
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 2
SURT total detected corruption count: 44
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.1.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2014-11-12 22:49:51.453
----------------------EOF-----------------------
 
Hello mrxero2 and welcome to Sysnative forums.

First of all I am very sorry for the long delay that you have had here. All the errors that are being identified from the SFC scan and the SURT scan are pointing to registry corruptions. For corruptions to occur inside the registry are normally a result from bad memory. Judging by the comments you mad about the BSOD memory errors it does sound like you may be having some memory issues.

Please follow the instructions for MemTest86+, for atleast 10 passes. Let me know the results. Please note this can take several hours.

Once the above is done can you please follow the steps here: https://www.sysnative.com/forums/bs...ons-windows-10-8-1-8-7-and-windows-vista.html

Once you have the zip file please attach it to your next post.

Alex
 
Thanks for your reply. No worries on the wait, I wasn't having any luck anywhere else, either. I'm just glad to finally find some direction.

I ran the memory test on both of my memory modules. I immediately received errors on one of the modules in all available memory slots. The other appears to be OK, although I have not completed 10 passes in all slots yet. As you noted, it can take hours to complete 10 passes. once I have completed the memory test for this module, I will run through the BSOD instructions.

Should I post the results to this thread or begin a new thread?

Tony
 
Hi Tony,

Please post the files here and I will get one of the BSOD experts to come and take a look :).

As for repairing the corruptions, I am afraid when damage like this is done it is always best to do a fresh install of Windows. There are too many error to try and repair, and often after fixing one more pop up.

Alex
 
Here are the files. I had hoped to avoid a fresh install. I suppose a restore point is unlikely to succeed if the memory issue existed at the time of the restore point or even a system image?
 

Attachments

You can try a system restore, its worth a shot. Just no guarantees it will fix the issue, if you like you can try a full system restore then run another scan with SURT and we can see if the corruptions are still there.

When doing the memtest have you worked out if it is a bad RAM stick or an issue with the slot?

I will get someone now to have a look the BSOD dump files.
 
I tried the bad chip in all 4 slots and got errors on all of them instantly. Then I repeated with the "good" chip. I did not get any errors. I only made it through 10 passes on 2 of the slots so far and I made it through several passes on the other 2. It takes my computer about 12 straight hours to go through 10 uninterrupted passes. I am running them at night or while I am at work so it may be another couple days before I can officially proclaim the second chip and all slots as "good".
 
Sorry for the delay.
As mentioned, it's almost certainly a failing RAM module and not the DIMM slot on the motherboard.

Code: 
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: [COLOR="#FF0000"]fffff0a024705cc4[/COLOR], memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000315634e, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000007, (reserved)

Invalid system memory has been referenced, this was the reason for the bugcheck. Although the quetsion is why was invalid system memory referenced?

Code: 
fffff880`035a0968 fffff800`02f0653b : 00000000`00000050 fffff0a0`24705cc4 00000000`00000000 fffff880`035a0ad0 : [COLOR="#0000FF"]nt!KeBugCheckEx[/COLOR]
fffff880`035a0970 fffff800`02e87cee : 00000000`00000000 fffff0a0`24705cc4 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`035a0ad0 fffff800`0315634e : fffff8a0`2511e4c0 fffff880`00961000 00000000`0000020e 00000000`000007ff : [COLOR="#FF8C00"]nt!KiPageFault+0x16e[/COLOR]
fffff880`035a0c60 fffff800`03157055 : fffff880`035a0de0 fffff8a0`00000001 fffff880`035a11f8 fffff880`035a11f0 : [COLOR="#800080"]nt!CmpKcbCacheLookup+0x1de[/COLOR]
fffff880`035a0d50 fffff800`03153704 : fffff8a0`03f938a0 fffff880`035a11f0 fffff880`035a1240 fffff880`035a1220 : [COLOR="#800080"]nt!CmpBuildHashStackAndLookupCache+0x335[/COLOR]
fffff880`035a1130 fffff800`03185878 : fffffa80`15ed21c8 fffffa80`00000000 fffffa80`15ed2010 fffff880`00000000 : [COLOR="#800080"]nt!CmpParseKey+0x294[/COLOR]
fffff880`035a1430 fffff800`03186a96 : ffffffff`80000838 fffffa80`15ed2010 00000000`00000000 fffffa80`0ca987a0 : [COLOR="#800080"]nt!ObpLookupObjectName+0x588[/COLOR]
fffff880`035a1520 fffff800`0313c0a8 : fffff8a0`342cda70 00000000`00000000 fffffa80`0ca85000 fffff800`031d3f0e : [COLOR="#800080"]nt!ObOpenObjectByName+0x306[/COLOR]
fffff880`035a15f0 fffff800`0313c946 : fffff880`035a1a00 00000000`000f003f fffff880`035a1a10 fffff8a0`1e3f5470 : [COLOR="#800080"]nt!CmCreateKey+0x2e1[/COLOR]
fffff880`035a1760 fffff800`02e88e53 : fffffa80`0ca71040 00000000`00000000 fffffa80`0ca85040 fffff800`031817a4 : [COLOR="#800080"]nt!NtCreateKey+0x2e[/COLOR]
fffff880`035a17b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

Now this callstack looks a bit suspicious. We'll come to this later on though.

Code: 
0: kd> [COLOR="#008000"]r @cr2[/COLOR]
[COLOR="#800080"]cr2=fffff0a024705cc4[/COLOR]

Alright, our address which referenced invalid memory was stored in the 2nd Control Register, this register contains the value for the Page Fault Linear Address; so when a program attempts to access memory it is interrupted and stored in this register.

Code: 
0: kd> [COLOR="#008000"].frame /r[/COLOR]
00 fffff880`035a0c60 fffff800`03157055 nt!CmpKcbCacheLookup+0x1de
rax=000000001360cf2d rbx=0000000000000000 rcx=00000000000005c4
rdx=00000000000001ec rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000315634e rsp=fffff880035a0c60 rbp=fffff8a0042f8010
 r8=0000000000000006  r9=0000000000000000 r10=0000000000000c1c
r11=fffff880035a0de0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=0000  es=0000  fs=0000  gs=0000             efl=00010282
[COLOR="#800080"]nt!CmpKcbCacheLookup+0x1de[/COLOR]:
fffff800`0315634e 418b45f4        [COLOR="#800080"]mov [/COLOR]    [COLOR="#00FFFF"]eax[/COLOR],dword ptr [r13-0Ch] ds:[COLOR="#8B4513"]ffffffff`fffffff4[/COLOR]=????????

We attempted to move data from the address ffffffff`fffffff4 to the eax register, this is pretty obvious that the address isn't valid.
But wait... didn't we want to access fffff0a024705cc4?
The address which we were supposed to access is invalid.

Code: 
0: kd> [COLOR="#008000"]!pte fffff0a024705cc4[/COLOR]
                                           VA fffff0a024705cc4
PXE at FFFFF6FB7DBEDF08    PPE at FFFFF6FB7DBE1400    PDE at FFFFF6FB7C280918    PTE at FFFFF6F850123828
contains 0000000000000000
[COLOR="#FF0000"][B]not valid[/B][/COLOR]

So we tried to access memory A which was invalid, the operating system came back and said we can't access memory B which doesn't make sense.
Although both were invalid, it's still a clear sign of bad RAM.

I would like to have a KErnel memory dump though as the callstack in this dump, and a few others is a bit suspicious.

Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Kernel memory dump.

Once a dump is created go to:

Code: 
C:\Windows\memory.dmp

Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
 
I'll do this first chance i get after I get home this evening.
Just as an FYI, I have removed the bad module from the system and I am now operating off the single 8GB module. I have not received a BSOD since. I also collected both of the perfmon data and the BSOD data that I posted after I removed the bad module.
I don't know if that makes a difference in what steps come next in the diagnosis, but I thought I would put it out there in case it was important for you to know.
 
I made the changes as requested. I assume I must now wait for a BSOD before I'll have the opportunity to give you the Memory.dmp file?
 
I have done a system restore. I am now able to install updates. However, I am not able to install office 2013. I reran SFCFix. I am attaching a link to the CBS folder (its huge compared to the last one) and the log from SCFfix:


SFCFix version 2.4.1.0 by niemiro.
Start time: 2014-11-25 23:10:43.903
Not using a script file.




AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 0
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 44
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.1.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2014-11-25 23:11:21.438
----------------------EOF-----------------------


https://onedrive.live.com/redir?resid=F5601316E09752BC!949&authkey=!AKQvaiAjjmJEi2Q&ithint=file,zip
 
SFCFix version 2.4.1.0 by niemiro.
Start time: 2014-11-26 19:50:57.722
Not using a script file.




AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.1.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2014-11-26 19:51:35.872
----------------------EOF-----------------------
 
Please follow the instructions Here to run the System Update Readiness Tool. When the SURT finishes installing, copy (Ctrl + C) and paste (Ctrl + V) the contents of the SURT log into your next post please:
C:\Windows\Logs\CBS\CheckSUR.log
C:\Windows\Logs\CBS\CheckSUR.persist.log
 
Sorry, I wasnt very clear in my previous post. Thanks for the SURT log, its clean. All those registry corruptions have appeared to be fixed.

What error are you getting when trying to install Office 2013?
 
It was 30175-4, but without my bad memory and registry errors to get in the way, I was able find a fix on the microsoft support website. A previous uninstall of office 2010 was not complete, apparently.
After I ran the fix, I was able to install office without any further issues.

At this point, I am not aware of any other issues and everything seems to be running smoothly. Corsair has replaced my memory under their warranty and you have helped me get my operating system back in working order. I appreciate your time and effort. Thank you very much.
 
That's good news, any other problems let us know.
 
You must log in or register to reply here.
Back
Top