[SOLVED] Windows Update/Component Store corruption (missing payload) for FlashPlayer files

SFCFix version 2.4.4.0 by niemiro.
Start time: 2015-06-03 21:52:23.293
Microsoft Windows 8.1 Update 3 - amd64
Using .zip script file at C:\Users\jim\Desktop\SFCFix.zip [0]








PowerCopy::
Successfully took permissions for file or folder C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json
Successfully took permissions for file or folder C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\utc.app.json


WARNING: File C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json was not backed up as that would replace the current backup.
Successfully copied file C:\Users\jim\AppData\Local\niemiro\Archive\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json to C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json.
Successfully copied file C:\Users\jim\AppData\Local\niemiro\Archive\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\utc.app.json to C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\utc.app.json.


Successfully restored ownership for C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json
Successfully restored permissions on C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\telemetry.ASM-WindowsDefault.json
Successfully restored ownership for C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\utc.app.json
Successfully restored permissions on C:\WINDOWS\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.3.9600.17807_none_910ac2c6daa01c43\utc.app.json
PowerCopy:: directive completed successfully.








Successfully processed all directives.
SFCFix version 2.4.4.0 by niemiro has completed.
Currently storing 6 datablocks.
Finish time: 2015-06-03 21:52:25.996
Script hash: to3ub9VMcTX1Sv8D6a9g1yoJ400cgZBNEg1t+sRSXB0=
----------------------EOF-----------------------


Will post CBS.log as soon as it sfc completes.
 
OK, here is the issue.
Code: 
2015-06-03 21:54:46, Error                 CSI    0000000c@2015/6/4:01:54:46.637 (F) base\xml\udom_xmlcursor.cpp(50): Error STATUS_XML_PARSE_ERROR originated in function CXmlCursor::Next expression: RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )

Finding this corruption isn't easy. I have two ideas. This is the first. Please do the following.

Step#1 - Capture Process Monitor Trace
 1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Right-click on the Start
w8start.png
button and select Command Prompt (Admin)
3. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
sfc /scannow

4. Stop Process Monitor as soon as sfc /scannow is complete. You can simply do this by clicking the magnifying glass on the toolbar as shown below.
11908d1430506241-windows-updates-fail-repeatedly-stop-jpg


5. Copy and paste the following into the command-prompt window and press Enter. If asked to overwrite the previous file, please do.
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

6. Once this has completed please go to your Desktop and you will find CBS.txt => Please upload CBS.txt to this thread
7. In Process Monitor, select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
8. Zip up and attach the LogFile.PML
 
Default filters. If you have used ProcMon before, make sure to reset the filters back to the default. If you haven't used it before just leave as is and do the capture. Thanks.
 
Procmon was helpful. We found the culprit. If we look at your CBS log...

Code: 
2015-06-03 23:56:07, Error                 CSI    0000000c@2015/6/4:03:56:07.863 (F) base\xml\udom_xmlcursor.cpp(50): Error STATUS_XML_PARSE_ERROR originated in function CXmlCursor::Next expression: RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )

And correlate the times with the Procmon log we see the file that is having issues. Generalize.xml.

Procmon.JPG

Please zip and send me that file. I'll get you a good copy and we'll go from there. Thanks.

There's also a ton of the following messages in the CBS log which provide more evidence of this finding.

Code: 
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e45@2015/6/4:01:55:58.919"]00000e45@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Marking Sysprep Corrupt. All Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e46@2015/6/4:01:55:58.919"]00000e46@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e47@2015/6/4:01:55:58.919"]00000e47@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e48@2015/6/4:01:55:58.919"]00000e48@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e49@2015/6/4:01:55:58.919"]00000e49@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4a@2015/6/4:01:55:58.919"]00000e4a@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4b@2015/6/4:01:55:58.919"]00000e4b@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4c@2015/6/4:01:55:58.919"]00000e4c@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4d@2015/6/4:01:55:58.919"]00000e4d@2015/6/4:01:55:58.919[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4e@2015/6/4:01:55:58.935"]00000e4e@2015/6/4:01:55:58.935[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
2015-06-03 21:55:58, Info                  CSI    [EMAIL="00000e4f@2015/6/4:01:55:58.935"]00000e4f@2015/6/4:01:55:58.935[/EMAIL] Sysprep Warning: Corruption detected. Sysprep Commands will be ignored
 
Please unzip the attached file. Use the file to overwrite your Generalize.xml. If you are able to do this successfully then please continue. If you run into any issues, stop and let me know. Thanks.

SFC Scan
1. Right-click on the Start
w8start.png
button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
 sfc /scannow

3. Once it finishes, copy and paste the following into the command-prompt window and press Enter.
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

4. Once this has completed please go to your Desktop and you will find CBS.txt => Please upload CBS.txt to this thread

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.
 

Attachments

Had to take ownership of the folder to copy the fix into it, then reverted ownership back to TrustedInstaller. SFC is running now (50% complete) will provide log as soon as complete.

FYI, I checked the other xml files in that folder and all three of them are corrupted as well. Where can i find replacements for them?
 
Actually all the corruption from that log is gone. The only thing left is the known issue I discussed back in Post#9.

So if we could please run DISM again as follows and look at the log that would be great. Thanks.

Step#1 - DISM /RestoreHealth Scan
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.




  1. Right-click on the Start
    w8start.png
    button and select Command Prompt (Admin)
  2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
    Dism /Online /Cleanup-Image /RestoreHealth
  3. When DISM finishes scanning your component store, zip up and attach your CBS log to your next post:
    C:\Windows\Logs\CBS\CBS.log




Please Note:: if the file is too big to upload to your next post please upload via a service such as SendSpace and just provide the link.
 
CBS.log: Microsoft services

So, I started the /restorehealth run last night at halftime of the Golden State-Cleveland NBA game. Didn't have time to check it until now. The command prompt window readout says, "The restore operation completed successfully. The component store corruption was repaired. The operation completed successfully."

As you will see in the log, it appears that the /restorehealth command restarted itself multiple times during the night, most recently at approximately 8 am. Hasn't run again, so i guess it's done, although the end result of that run doesn't appear any different then the previous four or five runs.

Look forward to hearing your take.
 
Your logs are clean for the most part. You have one error but I'm not certain what it's about.
Code: 
2015-06-04 19:23:47, Info                  CBS    Warning: Unable to mark idle scavenging complete. Error code: 0X80004004 [HRESULT = 0x80004004]

Next thing I would like you to try is the following.

Clean Boot
1. Please perform a Clean Boot following the information from https://support.microsoft.com/en-us/kb/929135
2. Then try installing the update that you downloaded https://support.microsoft.com/en-us/kb/3025417

Let me know how it goes.
 
Hi Brian,

Hope you had a nice weekend. Did as instructed above. First clean boot didn't work. Tried again today and worked without a hitch. Tried to install the downloaded update. Failed as usual. CBS log is huge - 100 MB. Hope you find answer(s) in it.

Microsoft services
 
Thanks for the info. I had a great weekend. First time in my lifetime (anyone's lifetime actually) that I got to see my home team win a finals game. Go Cavs!

We have some more corrupt XML files it looks like. Stay in a clean boot when performing these steps.

Code: 
2015-06-08 14:40:36, Error                 CSI    00000020@2015/6/8:18:40:36.121 (F) base\xml\udom_microdom.cpp(4255): Error STATUS_XML_PARSE_ERROR originated in function RtlCreateMicrodom expression: (null)
[gle=0x80004005]
2015-06-08 14:55:33, Error                 CSI    00000001@2015/6/8:18:55:33.151 (F) Logged @2015/6/8:18:54:41.995 : [ml:174{87},l:172{86}]"MOF (install online) $(runtime.programFiles)\Windows Defender\ProtectionManagement.mof"
[gle=0x80004005]
2015-06-08 14:55:33, Error                 CSI    00000002@2015/6/8:18:55:33.166 (F) CMIADAPTER: Inner Error Message from AI HRESULT = 80041025 [Error,Facility=FACILITY_ITF,Code=4133 (0x1025)]
 [
[139]"An error occurred while processing item 18 defined on lines 243 - 245 in file C:\Program Files\Windows Defender\ProtectionManagement.mof:

Since you are familiar with Procmon, I'll abbreviate my steps.

1. Run Procmon without any filters.
2. While it's running try to install that update again.
3. Stop Procmon as soon as it fails.
4. Save and Send me the Procmon log and the newest CBS.log

Thank you.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top