[SOLVED] Another COMPONENTS hive corrupted?

[Computerguy]

I've had a problem with win10 updates for a while. Initially I thought it was microsoft's limitation for win updates on older (very capable) processors so I did not do any more research. I've had some time now and looked into it further because I wanted to do a win11 upgrade. It failed too. I've done the typical attempts to fix via dism and sfc from a downloaded image of win10. All to no avail.
I found your site here the exact issue and everyone helped by fixing the COMPONENTS hive file. Hoping for a miracle at this point.

cbs log:
2022-06-06 08:34:37, Info CBS Failed to load the COMPONENTS hive from 'C:\WINDOWS\System32\config\COMPONENTS' into registry key 'HKLM\COMPONENTS'. [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS Failed to load component store [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS Failed to get CSI store. [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS Failed to get CSI Store. [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS Failed to get CSI session store. [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS Failed to check CSI store. [HRESULT = 0x800705aa - ERROR_NO_SYSTEM_RESOURCES]
2022-06-06 08:34:37, Info CBS
2022-06-06 08:34:37, Info CBS =================================
2022-06-06 08:34:37, Info CBS Checking System Update Readiness.
2022-06-06 08:34:37, Info CBS
2022-06-06 08:34:37, Info CBS
2022-06-06 08:34:37, Info CBS Summary:
2022-06-06 08:34:37, Info CBS Operation: Detect and Repair
2022-06-06 08:34:37, Info CBS Operation result: 0x800705aa
2022-06-06 08:34:37, Info CBS Last Successful Step: CBS store detection completes.
2022-06-06 08:34:37, Info CBS Total Detected Corruption: 0
2022-06-06 08:34:37, Info CBS CBS Manifest Corruption: 0
2022-06-06 08:34:37, Info CBS CBS Metadata Corruption: 0
2022-06-06 08:34:37, Info CBS CSI Manifest Corruption: 0
2022-06-06 08:34:37, Info CBS CSI Metadata Corruption: 0
2022-06-06 08:34:37, Info CBS CSI Payload Corruption: 0
2022-06-06 08:34:37, Info CBS Total Repaired Corruption: 0
2022-06-06 08:34:37, Info CBS CBS Manifest Repaired: 0
2022-06-06 08:34:37, Info CBS CSI Manifest Repaired: 0
2022-06-06 08:34:37, Info CBS CSI Payload Repaired: 0
2022-06-06 08:34:37, Info CBS CSI Store Metadata refreshed: False

dism log:
2022-06-06 08:34:37, Error DISM DISM.EXE: DISM Package Manager processed the command line but failed. HRESULT=800705AA

COMPONENTS hive attached.

 

[Computerguy]

And SFCFix output

 

[DR M]

Hi, Computerguy.
Welcome to Sysnative Forums.

Thank you for your patience. I hope you are still there.

I am a Security Analyst and a Windows Update Trainee, and I will be assisting you regarding your computer's issues. Since I'm still in training, my fixes have to be approved by a qualified Update Expert, so there may be a slight delay in my replies. Look at it as a good thing though, since you will have two people looking at your problem.

Reviewing your logs, I caught this significant error: ERROR_NO_SYSTEM_RESOURCES

This error seems to be related with not sufficient system resources, usually RAM, or not enough disk space.

Let's take a better look into your computer.


1. Search for RegistrySizeLimit

• Press Windows icon key on your keyboard, together with the letter R.
• Type cmd, and press Ctrl + Shift + Enter to run Command Prompt as administrator.
• Copy and paste the following command and press Enter to execute it:

reg query "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v "RegistrySizeLimit"

• Let me know the result (a screenshot).

2. Run FRST

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

 

[Computerguy]

Hi and yes still here. Thanks in advance for any and all help you can provide.
I don't believe resources is the issue as I am running with 8gb ram and have 184 GB of disk space available. But here are the results.

 

[DR M]

Hi, Computerguy!

I'm glad you are still there!

I'll need some time to review your logs. This will be done tomorrow, since here it's almost 10 PM now.

I'll be back to you as soon as I am ready.

 

[Computerguy]

Hi Dr M,
Wanted to let you know updates are installing currently. Didn’t want you to spend additional time on this yet.
Your request for the registry led me to a Microsoft article. I set the key to 0(in decimal). After a reboot it downloaded and installed updates I believe successfully. Currently doing the cumulated functionality update and looks ok so far. Certainly further than in the past.
I’ll advise when it is done if successful and if we can close this thread.
Thanks for finding that key. How did you find it? I searched and searched for a root cause for weeks and did not come across this one
Hopefully update this later today.

 

[Computerguy]

Dr M,
All's good. That registry update allowed the updates to continue.
How did you find to look at that registry key? I searched and searched for a root cause for my problem for weeks and did not come across this one.
Thanks again and you can close this as Solved.

 

[DR M]

Great news, Computerguy!

So now you are running the latest Windows version!

How did you find to look at that registry key? I searched and searched for a root cause for my problem for weeks and did not come across this one.

Well, my instructor in Updates is great!

The key, was this error in your logs: ERROR_NO_SYSTEM_RESOURCES
That led us to investigate the value of RegistrySizeLimit.

Although we could stop here and mark the topic as Solved, I noticed some things in your FRST logs which suggest a bit of tidiness in your computer. If you like, we can continue with that. Let me know about your thoughts.

 

[Computerguy]

Maybe, what did you see?

 

[DR M]

I can initially mention the 2 antivirus you have installed (in addition to Windows Defender), the "expired" Adobe Flash Player, some unnecessary policies and several tasks, remnants from previous installations.

If you would like to deal with the above, I'll need fresh FRST logs (Addition and FRST), since you upgraded the operating system.

 

[Computerguy]

Yeah, I saw that AV issue looking through the logs. Thanks for bringing it up.
That's interesting about AV Bitdefender. I uninstalled it (successfully?) a while ago. Or so I thought. It is no longer in the installed programs list. I then installed Kaspersky. And Defender is there by default. Old habits I guess, I never liked Defender in prior OS versions so pretty much forgot it was there. We definitely can try adn remove Bitdefender. Not sure if Defender is a problem with Kaspersky. I know in older days 2 AVs were not good. But I haven't seen any issues. Like to hear your advice.
Maybe updates were needed for Adobe to update? Or maybe I shut update off? Either way would probably be good to update it (as long as the version is still free).
And we can look at the other items on an as needed basis. I know of some of them but probably not all.

 

[DR M]

Hi, Computerguy.

When I have to uninstall an antivirus, I use the Revo Uninstaller free. It initially uses antivirus' uninstaller and then further removes any remnants.

Windows Defender, is the built-in Windows 10 antivirus. It has nothing to do with previous Microsoft antivirus, like Security Essentials. Defender in Windows 7 was not an antivirus, but antispyware, so as you understand we are talking about different things. These days, Windows Defender is a really good security solution, and many experts agree that it is the best solution for Windows 10 and above. It's also true that there are users' reports about issues when using 3rd party antivirus in these particular operating systems. It's a user's choice, of course. Personally I find Windows Defender as good enough to protect me, and use it as my basic security solution.

Here are my next comments/instructions regarding your logs:

1. Adobe Flash Player

This product reached its end of life in January 2020. Keeping it is a security risk.

• Press the Windows Key + R.
• Type appwiz.cpl in the Run box and click OK.
• The Add/Remove Programs list will open. Locate the following program on the list:

Adobe Flash Player 32 PPAPI

• Select the above program and click Uninstall.
• Restart the computer.

2. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
AV: Bitdefender Antivirus Free Antimalware (Enabled - Up to date) {EA21BCE8-A461-99C3-3A0D-4C964E75494E}
AS: Bitdefender Antivirus Free Antimalware (Disabled - Up to date) {51405D0C-825B-964D-00BD-77E435F203F3}
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-2593509216-3608631724-722380641-1000\...\MountPoints2: {f1a12823-56f5-11ec-9390-f01faf36e3cd} - "F:\WD Drive Unlock.exe" autoplay=true
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] -> 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Splashtop Wired XDisplay Agent.lnk [2020-12-18]
ShortcutTarget: Splashtop Wired XDisplay Agent.lnk -> C:\Program Files (x86)\Splashtop\Splashtop Wired XDisplay\Agent\SWXDAgent.exe (No File)
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicyScripts\User: Restriction <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {20C00BDF-A3D9-4CC2-B121-51CF35279395} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (No File)
Task: {2D54B048-6E95-4B90-BA44-AD1A44AC5D9F} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (No File)
Task: {2E943C36-4D9F-400D-BE0F-83595D438353} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_pepper.exe -check pepperplugin (No File)
Task: {33640AE9-0219-4985-B0B3-F92F31CB5841} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (No File)
Task: {34D961A2-185C-4F38-9195-CA2AC9569ABD} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {486D715E-6AA2-44CF-BC48-B6990CBB53C6} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControlsMigration => {343D770D-7788-47C2-B62A-B7C4CED925CB}
Task: {4B61EEC5-FA13-4443-A51C-65F279F78BD8} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (No File)
Task: {52D4EF2B-67D1-47F6-8328-0829B960C056} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (No File)
Task: {53F4132D-9A91-44DE-A4A5-2A516A5297EA} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (No File)
Task: {54D28F28-D3E8-4401-902E-6227BA437AAE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (No File)
Task: {57B0B9D1-F29F-4C0B-8679-DFBEF504F562} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (No File)
Task: {5B42DD9C-5A26-4F27-BB95-34603F0997E5} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControls => {DFA14C43-F385-4170-99CC-1B7765FA0E4A}
Task: {5D995DF8-C9AE-495A-BBB0-C344FACC6BBF} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {78B9A413-33A5-4FC0-9D70-B22E5A83CB4C} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (No File)
Task: {86057560-D0FC-4895-A4B8-CDE1BBC27CCA} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (No File)
Task: {8CF9F122-BD90-4F7B-91FC-6B572EE991CD} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (No File)
Task: {98EB90D8-BE27-46BE-8B75-BD093D53CA90} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (No File)
Task: {9BF56E03-0E71-461C-9219-DA3E72F20C09} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (No File)
Task: {AD80EE5F-D6F6-496F-BB07-DB3A2B8F5DCA} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4F47-879B-29A80C355D61}
Task: {AEA1CA47-5CBE-4486-8020-5BED38426F2F} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (No File)
Task: {B0CBAB43-44FC-469B-A4CE-87426761FDCE} - System32\Tasks\Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor => {EA9155A3-8A39-40B4-8963-D3C761B18371}
Task: {B43B80DB-B769-4EF3-B67E-2AD386AF8D13} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (No File)
Task: {B867B92B-A5E1-449C-B3BF-260B14DE371E} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (No File)
Task: {CD9C8D59-6BFA-4101-B996-7785F3F7D29E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (No File)
Task: {E8015F8C-9568-4CAC-96B4-213FA350A596} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (No File)
Task: {EC64B1CA-FF6E-4D44-B56F-BA2051C10CBE} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (No File)
Task: {FD4578CB-A17E-4AEC-915D-11F25EF79CCB} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (No File)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
FF HKLM\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Cloud 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Cloud 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [No File]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [No File]
2022-06-13 08:58 - 2022-06-13 08:58 - 000003762 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player PPAPI Notifier
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
EmptyTemp:
End::

• Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please post the log in your next reply.

In your next reply please post:

1. If uninstalling Flash went fine
2. The fixlog.txt

 

[Computerguy]

Hi,
Ah, we you mentioned Adobe my mind went directly to Acrobat. Yes I recall the Flash going EOL but never did anything about it. It is now uninstalled.
Ran the fix for FRST. Log attached. I should have asked before running it. The log shows it removed a lot of stuff. What did it clean up beyond Bitdefender?
Thanks again for your help and guidance.

 

[DR M]

Hi, Computerguy.

The fix took care of the things mentioned here.

Are you experiencing any connectivity issues?

This line is from your logs:

A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

Please check this:

• Press the Windows logo key and the letter r and in the blank area type: inetcpl.cpl
• OK
• Select Advanced tab and then scroll down to Security and make sure to tick TLS 1.0, TLS 1.1 and TLS 1.2
• OK

Is there any remaining issue/question/concern regarding this computer?

 

[Computerguy]

Hi,
Those three options are ticked. No, I can't say I have any connectivity problems. If I see something later I'll open another thread.
I do see it also cleared all temp files including cookies and recents in the previous process.
Nothing else to assist with currently. You can consider this thread resolved.
Thanks for all your help. Great help to the community for al the tasks you do here. Much appreciated and highly recommended.
Also wish you much success in your career.

 

[DR M]

You are very welcome!

The following tool will remove FRST tool and its logs, as well as reset system restore points. You can also delete manually any other tool used, along with any log created.

Download KpRm by kernel-panik and save it to your desktop.

• Right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please copy and paste its contents in your next reply.