Windows 7 System Files Corruption

[Sysnative Windows Update]

Please reboot and then do the following:

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Try updating the system just like you have in the past. Ensure you select only one update.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the magnifying glass on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and provide the link to the LogFile.PML file as well as your CBS.log Examples of services to upload to are Dropbox or OneDrive or SendSpace.

 

[Pingaware]

I have done the steps above but the LogFile.PML is over 2GB. Is this a reasonable size for the file?

 

[Sysnative Windows Update]

Yes, zip it up and use a file sharing service. Anything from a few hundred MBs to 40+GBs is normal.

 

[Pingaware]

Yes, my mistake for forgetting to zip it up. Uploading it now.

 

[Pingaware]

Okay, links to the zipped LogFile and CBS log (with apologies for the doublepost)

 

[Sysnative Windows Update]

Thanks.
Please do the following:

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

[Pingaware]

Okay as requested. Ran with no issues and no need for restart. Fixlog contents below.

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-09-2019
Ran by Si (15-09-2019 21:33:44) Run:1
Running from C:\Users\Si\Desktop
Loaded Profiles: UpdatusUser & Si (Available Profiles: UpdatusUser & Caro & Si)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
cmd: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
[-HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_a0993462c6c6d41b989ac11206171d09_31bf3856ad364e35_6.1.7601.24513_none_c67625034702b31c]
[-HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\a0993462c6c..11206171d09_31bf3856ad364e35_6.1.7601.24513_c67625034702b31c]
StartRegedit:
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_a0993462c6c6d41b989ac11206171d09_31bf3856ad364e35_6.1.7601.24513_none_c67625034702b31c]
"S256H"=hex:a0,a0,41,4b,6f,f1,8a,50,2a,f9,e0,c3,5e,96,90,85,54,29,47,b6,8d,71,\
  99,df,d7,98,98,96,e8,e4,40,0c
"identity"=hex:61,30,39,39,33,34,36,32,63,36,63,36,64,34,31,62,39,38,39,61,63,\
  31,31,32,30,36,31,37,31,64,30,39,2c,20,43,75,6c,74,75,72,65,3d,6e,65,75,74,\
  72,61,6c,2c,20,56,65,72,73,69,6f,6e,3d,36,2e,31,2e,37,36,30,31,2e,32,34,35,\
  31,33,2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,66,33,38,\
  35,36,61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,72,63,68,\
  69,74,65,63,74,75,72,65,3d,61,6d,64,36,34,2c,20,76,65,72,73,69,6f,6e,53,63,\
  6f,70,65,3d,4e,6f,6e,53,78,53
"ClosureFlags"=dword:00000003
"c!a0993462c6c..11206171d09_31bf3856ad364e35_6.1.7601.24513_c67625034702b31c"=hex:

[HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\a0993462c6c..11206171d09_31bf3856ad364e35_6.1.7601.24513_c67625034702b31c]
"appid"=hex:61,30,39,39,33,34,36,32,63,36,63,36,64,34,31,62,39,38,39,61,63,31,\
  31,32,30,36,31,37,31,64,30,39,2c,20,43,75,6c,74,75,72,65,3d,6e,65,75,74,72,\
  61,6c,2c,20,56,65,72,73,69,6f,6e,3d,36,2e,31,2e,37,36,30,31,2e,32,34,35,31,\
  33,2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,66,33,38,35,\
  36,61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,72,63,68,69,\
  74,65,63,74,75,72,65,3d,61,6d,64,36,34,2c,20,76,65,72,73,69,6f,6e,53,63,6f,\
  70,65,3d,4e,6f,6e,53,78,53
"CatalogThumbprint"="c931a45d484522f0a4b39bed99b71e04f74d54be3bad09bbac4288cbf4809078"
"p!CBS_package_1780_for_kb4516065~31bf3856ad364e35~amd64~~6.1.1.7.4_0c0131f031759973"=hex:53,\
  00,00,00,00,00,00,00,50,61,63,6b,61,67,65,5f,31,37,38,30,5f,66,6f,72,5f,4b,\
  42,34,35,31,36,30,36,35,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,\
  7e,61,6d,64,36,34,7e,7e,36,2e,31,2e,31,2e,37,2e,34,35,31,36,30,36,35,2d,35,\
  30,31,34,5f,6e,65,75,74,72,61,6c,5f,4c,44,52
"i!CBS_package_1780_for_kb4516065~31bf3856ad364e35~amd64~~6.1.1.7.4_0c0131f031759973"=hex:53,\
  00,00,00,00,00,00,00,50,61,63,6b,61,67,65,5f,31,37,38,30,5f,66,6f,72,5f,4b,\
  42,34,35,31,36,30,36,35,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,\
  7e,61,6d,64,36,34,7e,7e,36,2e,31,2e,31,2e,37,2e,34,35,31,36,30,36,35,2d,35,\
  30,31,34,5f,6e,65,75,74,72,61,6c,5f,4c,44,52
EndRegedit:

*****************

Restore point was successfully created.

========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========

The operation completed successfully.


========= End of CMD: =========

HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_a0993462c6c6d41b989ac11206171d09_31bf3856ad364e35_6.1.7601.24513_none_c67625034702b31c => not found
HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\a0993462c6c..11206171d09_31bf3856ad364e35_6.1.7601.24513_c67625034702b31c => not found
Registry ====> The operation completed successfully.


==== End of Fixlog 21:35:05 ====

 

[Sysnative Windows Update]

Please run System Update Readiness Tool and attach CheckSUR.log.

 

[Pingaware]

SURT ran fine. Attached all three logs that it produced.

 

[Sysnative Windows Update]

Please do the following:

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
3. Save any open documents and close all open windows.
4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
6. SFCFix will now process the script.
7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

Followed by System Update Readiness Tool.

 

[Pingaware]

Done as requested. See all logs below.

SFCFix version 3.0.2.1 by niemiro.
Start time: 2019-09-15 22:30:20.409
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\Si\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\windows\Temp\CheckSur\Winsxs\Manifests

Successfully copied file C:\Users\Si\AppData\Local\niemiro\Archive\Manifests\amd64_a0993462c6c6d41b989ac11206171d09_31bf3856ad364e35_6.1.7601.24513_none_c67625034702b31c.manifest to C:\windows\Temp\CheckSur\Winsxs\Manifests\amd64_a0993462c6c6d41b989ac11206171d09_31bf3856ad364e35_6.1.7601.24513_none_c67625034702b31c.manifest.

Successfully restored ownership for C:\windows\Temp\CheckSur\Winsxs\Manifests
Successfully restored permissions on C:\windows\Temp\CheckSur\Winsxs\Manifests
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 11 datablocks.
Finish time: 2019-09-15 22:30:21.064
Script hash: Sio+opU/GXX2VdGPCA8GUCzGE/T/tnvigp8Rq+OuGLA=
----------------------EOF-----------------------

 

[Sysnative Windows Update]

Remove Update Manually
1. Click on the Start button and in the search box, type Command Prompt
2. When you see Command Prompt on the list, right-click on it and select Run as administrator
3. When command prompt opens, copy and paste the following command into it, and press Enter
wusa /uninstall /KB:2982791

4. Let me know if it says it was successful or if there are any errors.

 

[Pingaware]

Tried as instructed, got the following error message.

 

[Sysnative Windows Update]

Interesting. Please retry updates. If the fail, we'll go deeper with the fixes.

 

[Pingaware]

Still failing with the same error code I'm afraid.

 

[Sysnative Windows Update]

Can you repeat the ProcMon steps?

 

[Pingaware]

ProcMon steps run again. CBS files and ProcMon logfile.

 

[Sysnative Windows Update]

Thanks. Pasting for reference. Will provide a fix when I wake up.

Good night.

HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-a..ence-inventory.data_31bf3856ad364e35_6.1.7601.24513_none_b7bc252e464e1aca

 

[Sysnative Windows Update]

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

[Pingaware]

Apologies for the delay in getting this done, I've been away from the computer again.

Ran FRST64, no need for restart.

Fix result of Farbar Recovery Scan Tool (x64) Version: 18-09-2019 01
Ran by Si (20-09-2019 18:42:03) Run:2
Running from C:\Users\Si\Desktop
Loaded Profiles: UpdatusUser & Si (Available Profiles: UpdatusUser & Caro & Si)
Boot Mode: Normal
==============================================

fixlist content:
*****************
cmd: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
[-HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-a..ence-inventory.data_31bf3856ad364e35_6.1.7601.24513_none_b7bc252e464e1aca]
[-HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\b63582e6408..a228faff4bd_31bf3856ad364e35_6.1.7601.24513_484673aa4f653328]
StartRegedit:
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-a..ence-inventory.data_31bf3856ad364e35_6.1.7601.24513_none_b7bc252e464e1aca]
"identity"=hex:4d,69,63,72,6f,73,6f,66,74,2d,57,69,6e,64,6f,77,73,2d,41,70,70,\
  6c,69,63,61,74,69,6f,6e,2d,45,78,70,65,72,69,65,6e,63,65,2d,49,6e,76,65,6e,\
  74,6f,72,79,2e,44,61,74,61,2c,20,43,75,6c,74,75,72,65,3d,6e,65,75,74,72,61,\
  6c,2c,20,56,65,72,73,69,6f,6e,3d,36,2e,31,2e,37,36,30,31,2e,32,34,35,31,33,\
  2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,66,33,38,35,36,\
  61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,72,63,68,69,74,\
  65,63,74,75,72,65,3d,61,6d,64,36,34,2c,20,76,65,72,73,69,6f,6e,53,63,6f,70,\
  65,3d,4e,6f,6e,53,78,53
"S256H"=hex:f2,98,d0,6f,b6,24,cf,fd,af,8f,c3,32,f2,79,16,a0,b7,d5,d6,be,3f,e9,\
  b1,2c,0b,f5,5a,2d,59,0a,bb,84
"f!appraiser_telemetryrunlis_d63b84423996cc8d"=hex:41,00,70,00,70,00,72,00,61,\
  00,69,00,73,00,65,00,72,00,5f,00,54,00,65,00,6c,00,65,00,6d,00,65,00,74,00,\
  72,00,79,00,52,00,75,00,6e,00,4c,00,69,00,73,00,74,00,2e,00,78,00,6d,00,6c,\
  00
"f!appraiser_data.ini_f2e523499636f688"=hex:41,00,70,00,70,00,72,00,61,00,69,\
  00,73,00,65,00,72,00,5f,00,44,00,61,00,74,00,61,00,2e,00,69,00,6e,00,69,00
"f!appraiser.sdb"=hex:61,00,70,00,70,00,72,00,61,00,69,00,73,00,65,00,72,00,2e,\
  00,73,00,64,00,62,00
"c!b63582e6408..a228faff4bd_31bf3856ad364e35_6.1.7601.24513_484673aa4f653328"=hex:

[HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\b63582e6408..a228faff4bd_31bf3856ad364e35_6.1.7601.24513_484673aa4f653328]
"appid"=hex:62,36,33,35,38,32,65,36,34,30,38,66,34,37,30,30,37,61,35,33,37,61,\
  32,32,38,66,61,66,66,34,62,64,2c,20,43,75,6c,74,75,72,65,3d,6e,65,75,74,72,\
  61,6c,2c,20,56,65,72,73,69,6f,6e,3d,36,2e,31,2e,37,36,30,31,2e,32,34,35,31,\
  33,2c,20,50,75,62,6c,69,63,4b,65,79,54,6f,6b,65,6e,3d,33,31,62,66,33,38,35,\
  36,61,64,33,36,34,65,33,35,2c,20,50,72,6f,63,65,73,73,6f,72,41,72,63,68,69,\
  74,65,63,74,75,72,65,3d,61,6d,64,36,34,2c,20,76,65,72,73,69,6f,6e,53,63,6f,\
  70,65,3d,4e,6f,6e,53,78,53
"CatalogThumbprint"="c931a45d484522f0a4b39bed99b71e04f74d54be3bad09bbac4288cbf4809078"
"p!CBS_package_1780_for_kb4516065~31bf3856ad364e35~amd64~~6.1.1.7.4_aef39073d432f02a"=hex:53,\
  00,00,00,00,00,00,00,50,61,63,6b,61,67,65,5f,31,37,38,30,5f,66,6f,72,5f,4b,\
  42,34,35,31,36,30,36,35,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,\
  7e,61,6d,64,36,34,7e,7e,36,2e,31,2e,31,2e,37,2e,34,35,31,36,30,36,35,2d,35,\
  30,31,33,5f,6e,65,75,74,72,61,6c,5f,4c,44,52
"i!CBS_package_1780_for_kb4516065~31bf3856ad364e35~amd64~~6.1.1.7.4_aef39073d432f02a"=hex:53,\
  00,00,00,00,00,00,00,50,61,63,6b,61,67,65,5f,31,37,38,30,5f,66,6f,72,5f,4b,\
  42,34,35,31,36,30,36,35,7e,33,31,62,66,33,38,35,36,61,64,33,36,34,65,33,35,\
  7e,61,6d,64,36,34,7e,7e,36,2e,31,2e,31,2e,37,2e,34,35,31,36,30,36,35,2d,35,\
  30,31,33,5f,6e,65,75,74,72,61,6c,5f,4c,44,52
EndRegedit:
*****************


========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========

The operation completed successfully.


========= End of CMD: =========

HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-a..ence-inventory.data_31bf3856ad364e35_6.1.7601.24513_none_b7bc252e464e1aca => not found
HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\b63582e6408..a228faff4bd_31bf3856ad364e35_6.1.7601.24513_484673aa4f653328 => not found
Registry ====> The operation completed successfully.


==== End of Fixlog 18:42:59 ====