Frequent BSODs after Windows Updates are were installed. SFC broken.

D

DisgruntledPotato

Member
Joined
Dec 10, 2013
Posts
9
Hi everyone. I was hoping to find some help here with an issue I've been having since I installed a batch of about 15-20 Windows Updates last Tuesday. My computer has blue screened over 10 times in the past three days with the message "IRQL_NOT_LESS_OR_EQUAL" caused by driver ntoskrnl.exe (according to whocrashed). I ran chkdsk and it said it found errors, and that I needed to restart and let it scan so I did so. Strangely, it found nothing in the full scan. I also tried to run sfc /scannow but I am met with the message Windows Resource Protection could not perform the requested operation. Running sfc in safe mode produces the same error. I'm so confused :huh:
 
Please post your CBS log - it may tell us what's causing the problem....

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your reply.
 
Hmmm - I thought I'd responded to this yesterday!.... Obviously not.

Your CBS log contains a lot of this type of error...

Code: 
 Line 12233: 2013-12-10 17:35:05, Error                 CSI    [EMAIL="0000000b@2013/12/10:22:35:05.092"]0000000b@2013/12/10:22:35:05.092[/EMAIL] (F) d:\win7sp1_gdr\base\lstring\lblob.cpp(2221): Error STATUS_ILLEGAL_CHARACTER originated in function RtlTranscodeLBlobs expression: __rv.UcsCharacter != (0xffffffff)
 Line 12259: 2013-12-10 17:58:27, Error                 CSI    [EMAIL="00000005@2013/12/10:22:58:27.151"]00000005@2013/12/10:22:58:27.151[/EMAIL] (F) d:\win7sp1_gdr\base\lstring\lblob.cpp(2221): Error STATUS_ILLEGAL_CHARACTER originated in function RtlTranscodeLBlobs expression: __rv.UcsCharacter != (0xffffffff)

Not one I've seen before :(
Please download and save the CheckSUR tool from Use System Update Readiness tool to fix package corruption errors
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your SkyDrive Public folder so I can take a look - post a link in your reply.
 
Here you go! I don't have a Windows account so I'm not able to access SkyDrive. I assume it's similar to Google Drive though so I uploaded it into a folder there for you. Here you go!

https://drive.google.com/folderview?id=0B0nmti001ccCWUJhdEp4alVsSEE&usp=sharing

*EDIT* If it's of any help to you I set my computer today to save memory dumps whenever my computer crashes. From what I understood in Windows if you have more than 2GB of RAM it will only give you the option to save kernel memory dumps. I found a website that demonstrated changing a particular registry key to let you save full memory dumps. I'm checking them daily with BlueScreenView to see if there are any offending drivers. Thanks again for the help! :smile9:
 
CheckSUR has found and fixed a considerable number of errors - and been unable to fix a few.
Code: 
Summary:
Seconds executed: 774
 Found 213 errors
 Fixed 209 errors
  CSI Manifest Missing Total count: 2
  CSI Missing Component Key Total count: 34
  Fixed: CSI Missing Component Key.  Total count: 34
  CSI Missing Pinned Component Key Total count: 23
  Fixed: CSI Missing Pinned Component Key.  Total count: 23
  CSI Missing Identity Total count: 57
  Fixed: CSI Missing Identity.  Total count: 57
  CSI Corrupt Identity Total count: 2
  CSI Missing C Mark Total count: 63
  Fixed: CSI Missing C Mark.  Total count: 63
  CSI F Mark Missing Total count: 54
  Fixed: CSI F Mark Missing.  Total count: 54
  CBS MUM Missing Total count: 1
  Fixed: CBS MUM Missing.  Total count: 1
  Fixed: CBS Paired File.  Total count: 1
Unavailable repair files:
 winsxs\manifests\amd64_0cda7b0da«9c9942ac94176eada96003_31bf3856ad364e35_6.1.7601.21733_none_017´0ff8d4991aca.manifest
 winsxs\manifests\amd64_f006f421c5d17780894664de465c63e1_ÿ1bf3856ad364e35_6.1.7601.17621_none_ed8c3a6777e43a2a.manifest

This looks to me to be the result of registry corruption known as 'bitflips' where a single character is 'accidentally' changed in a file - this sort of error is often caused by problems with RAM, or problems with the hard drive system.

You can see the effect in the main CheckSUR log here....
Code: 
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) amd64_0cda7b0da«9c9942ac94176eada96003_31bf3856ad364e35_6.1.7601.21733_none_017´0ff8d4991aca Bad identity
(f) CSI Manifest Missing 0x00000002 amd64_0cda7b0da«9c9942ac94176eada96003_31bf3856ad364e35_6.1.7601.21733_none_017´0ff8d4991aca.manifest amd64_0cda7b0da«9c9942ac94176eada96003_31bf3856ad364e35_6.1.7601.21733_none_017´0ff8d4991aca 
(f) CSI Corrupt Identity 0xC0000161 (not UTF8) amd64_f006f421c5d17780894664de465c63e1_ÿ1bf3856ad364e35_6.1.7601.17621_none_ed8c3a6777e43a2a Bad identity
(f) CSI Manifest Missing 0x00000002 amd64_f006f421c5d17780894664de465c63e1_ÿ1bf3856ad364e35_6.1.7601.17621_none_ed8c3a6777e43a2a.manifest amd64_f006f421c5d17780894664de465c63e1_ÿ1bf3856ad364e35_6.1.7601.17621_none_ed8c3a6777e43a2a
note the two odd characters present in the filenames.

I need to have a look at your COMPONENTS registry hive

Please copy the
C:\Windows\System32\config\COMPONENTS
file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site
(preferably Dropbox or SkyDrive - or Google :)) and post a link.
 
NoelDP said:
Please copy the
C:\Windows\System32\config\COMPONENTS
file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site
(preferably Dropbox or SkyDrive - or Google :)) and post a link.
Click to expand...

I tried to copy the 43 MB components file but it tells me that the action could not be complete as the file is already open in System.


After reading what you said about this possibly having been caused by RAM or my hard drive I decided to run the built-in Windows Memory Diagnostics. The results were:

Code: 
+ System 


  - Provider 


   [ Name]  Microsoft-Windows-MemoryDiagnostics-Results 
   [ Guid]  {5F92BC59-248F-4111-86A9-E393E12C6139} 
 
   EventID 1102 
 
   Version 0 
 
   Level 2 
 
   Task 0 
 
   Opcode 0 
 
   Keywords 0x8000000000000000 
 
  - TimeCreated 


   [ SystemTime]  2013-12-09T01:39:35.938085100Z 
 
   EventRecordID 100144 
 
   Correlation 
 
  - Execution 


   [ ProcessID]  2720 
   [ ThreadID]  2264 
 
   Channel System 
 
   Computer thepc 
 
  - Security 


   [ UserID]  S-1-5-18 
 


- UserData 


  - Results 


   LaunchType Manual 
 
   CompletionType Fail 
 
   MemorySize 4053 
 
   TestType 10 
 
   TestDuration 388 
 
   TestCount 12 
 
   NumPagesTested 1036630 
 
   NumPagesUnTested 1121 
 
   NumBadPages 2 
 
   T1NumBadPages 2 
 
   T2NumBadPages 2 
 
   T3NumBadPages 2 
 
   T4NumBadPages 2 
 
   T5NumBadPages 2 
 
   T6NumBadPages 2 
 
   T7NumBadPages 2 
 
   T8NumBadPages 2 
 
   T9NumBadPages 2 
 
   T10NumBadPages 2 
 
   T11NumBadPages 2 
 
   T12NumBadPages 2 
 
   T13NumBadPages 0 
 
   T14NumBadPages 0 
 
   T15NumBadPages 0 
 
   T16NumBadPages 0




I also ran Memtest86+ and it returned no errors. I opened a technical support ticket with Corsair today to sort that out. Lets hope that's what's causing the problem!
 
I think if you boot to Safe Mode, it should then allow you to copy the file to the desktop, and you can proceed from there :)
 
I've uploaded a file - COMPaa.zip - to my SkyDrive at Noel's SkyDrive

Please download and save it to your desktop.


Right-click on the file and select Extract All, and save to the default destination (which should be a folder COMPaa on the desktop)

Create a new System Restore point
Open an Elevated Command Prompt, and run the following commands.

REN C:\Windows\System32\config\COMPONENTS COMPONENTS.OLD1

(If you get the earlier error of 'file in use', try using Safe Mode again)COPY %userprofile%\desktop\COMPaa\COMPONENTS C:\Windows\System32\config
If you get an error with either command, STOP THERE - do not reboot! - post for instructions.

Assuming both commands go OK, reboot, and run another CheckSUR scan - post the new CheckSUR.log file.

 
Here you go! Apologies for the delay, my wireless network card decided to randomly stop working today.



=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 22.0
2013-12-15 01:17


Checking Windows Servicing Packages


Checking Package Manifests and Catalogs


Checking Package Watchlist


Checking Component Watchlist


Checking Packages


Checking Component Store


Summary:
Seconds executed: 950
No errors detected
 
Yay! got it in one :)

Now please run another SFC /SCANNOW, and post the new CBS.log file - and we'll see if there's anything new there to work on.
 
Hi Noel. Unfortunately I'm unable to access the internet on my computer yet again today. My wireless card isn't able to connect to any of my networks, and the error it produces in Event Viewer is "The wlan extensibility module has stopped".

It's very strange to me as to how this has suddenly become a problem in the past two days, when it was even accruing even before I replaced the components file with the one you sent me. As soon as I am able to figure out what is going on I can upload the new CBS.log for you.
 
According to MS, this should work...
Code: 
[COLOR=#000000] [/COLOR]
[COLOR=#000000] [/COLOR]
[COLOR=#000000]Please follow the methods and check if it works fine.[/COLOR]
[COLOR=#000000] [/COLOR]
[B][COLOR=#000000]Method 1:[/COLOR][/B]
[COLOR=#000000]Disable the Wireless Network Connection, and then enable the Wireless Network Connection[/COLOR]
[COLOR=#000000] [/COLOR]
[COLOR=#000000]To disable the Wireless Network Connection, and then enable the Wireless Network Connection:[/COLOR]
[COLOR=#000000]a)      Click on Start, click on Control Panel, click on Network and Internet, click on Network and Sharing Center, and in Tasks, and click on Manage network connections. [/COLOR]
[COLOR=#000000]b)      Right-click on the Wireless Network Connection that you want to manage, and in the drop-down menu, click on disable.[/COLOR]
[COLOR=#000000]c)       After the Wireless Network Connection is disabled, right-click the connection, and then click Enable.[/COLOR]
[COLOR=#000000] [/COLOR]
[B][COLOR=#000000]Method 2:[/COLOR][/B]
[COLOR=#000000]Follow the steps to restart the WLAN AutoConfig service[/COLOR]
[COLOR=#000000] [/COLOR]
[COLOR=#000000]a.       Press Windows Key + R[/COLOR]
[COLOR=#000000]b.      In the run box, type services.msc and press enter.[/COLOR]
[COLOR=#000000]c.       Right-click on WLAN AutoConfig[/COLOR]
[COLOR=#000000]d.      Click on Properties, and on the General tab, in Startup type, select Automatic, and then click on Start.[/COLOR]

[LIST]
[/LIST]
 
I have an active internet connection to my computer now thanks to my phone. I figured out how to tether the Wi-Fi. Attached is the new CBS.log.

I still encounter the same error after following those steps from Microsoft to fix my wireless adapter. I even tried re-installing the driver, and driver software. Corsair finally responded to my support ticket and stated that judging from my Memtest86 logs it appears that I'll need to RMA this stick of memory. They also suggested re-installing Windows after I receive the new stick as memory corruption can often cause issues with the OS.
 

Attachments

Judging from the following error...
Code: 
2013-12-15 00:03:00, Info                  CSI    [EMAIL="00000004@2013/12/15:05:03:00.229"]00000004@2013/12/15:05:03:00.229[/EMAIL] PopulateComponentFamiliesKey - Begin
2013-12-15 00:03:00, Error                 CSI    [EMAIL="00000005@2013/12/15:05:03:00.245"]00000005@2013/12/15:05:03:00.245[/EMAIL] (F) d:\win7sp1_gdr\base\lstring\lblob.cpp(2221): Error STATUS_ILLEGAL_CHARACTER originated in function RtlTranscodeLBlobs expression: __rv.UcsCharacter != (0xffffffff)
[gle=0x80004005]
2013-12-15 00:03:00, Info                  CBS    NonStart: Failed to get store. [HRESULT = 0x80070246 - ERROR_ILLEGAL_CHARACTER]
2013-12-15 00:03:00, Info                  CBS    Failed to ensure no startup processing was required. [HRESULT = 0x80070246 - ERROR_ILLEGAL_CHARACTER]
2013-12-15 00:03:00, Info                  CBS    Failed during startup processing, continuing with Trusted Installer execution [HRESULT = 0x80070246 - ERROR_ILLEGAL_CHARACTER]
2013-12-15 00:03:00, Info                  CBS    Startup processing thread terminated normally
2013-12-15 00:03:00, Info                  CSI    [EMAIL="00000006@2013/12/15:05:03:00.463"]00000006@2013/12/15:05:03:00.463[/EMAIL] PopulateComponentFamiliesKey - Begin

It would seem that Corsair is likely to be right :(
 
:(

This has been a nightmare of a computer build. I've had to RMA the hard drive, the PSU, the graphics card, and now the memory. Yikes!

I can't thank you enough for your help Noel. I normally would have posted on BleepingComputer or Geeks 2 Go as I usually do, but there was something that stood about about this forum. You all seemed to have a better understanding computer crashes and errors. I'll be sure to return here if I encounter any other problems like this in the future. Thank you again so much. Merry early Christmas!

*EDIT* The wireless card started working again by itself until I rebooted my computer. It has a mind of it's own I suppose :lol:
 
Ouch! Things like that are a nightmare to troubleshoot - and almost always hardware-based.

Good luck with it! - and a Merry Christmas to you too :)
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top