[SOLVED] Problem MSDTC.LOG -> hash mismatch

jorfen · Jul 23, 2015

Hi all, I have a serious problem:

I ran sfc /scannow and got:

2015-07-23 12:45:09, Info CSI 0000097a [SR] Cannot repair member file [l:18{9}]"MSDTC.LOG" of Microsoft-Windows-COM-DTC-Runtime, Version = 6.3.9600.17415, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-07-23 12:45:09, Info CSI 0000097c [SR] Cannot repair member file [l:18{9}]"MSDTC.LOG" of Microsoft-Windows-COM-DTC-Runtime, Version = 6.3.9600.17415, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-07-23 12:45:09, Info CSI 0000097d [SR] This component was referenced by [l:164{82}]"Package_929_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.3000850-2734_neutral_GDR"

I found your site and ran sfcfix.exe with "SFCFixScript.txt" for MSDTC.LOG only and got the following:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-07-22 16:08:03.946
Microsoft Windows 8.1 Update 3 - amd64
Not using a script file.

AutoAnalysis::
CORRUPT: C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG

SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 1
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.

Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-07-22 16:15:24.478
----------------------EOF-----------------------

I have ran "dism /online /cleanup-image /restorehealth" and it have some problems ...

https://www.dropbox.com/s/w5f33qathgwzszt/CBS.log?dl=0

Can you help me please?

Aura · Jul 23, 2015

Hi jorfen :)

My name is Aura and I'll be assisting you with your issue. Follow the instructions below please.

SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.

Download SFCFix and move the executable on your Desktop;
Download the attached SFCFix.zip and move the archive to your Desktop;
Note: Make sure that the file is named SFCFix.zip, do not rename it.
Save any work you have open, and close every programs;
Drag the SFCFix.zip archive file over the SFCFix.exe executable and release it;
SFCFix will launch, let it complete;
Once done, a file will appear on your Desktop, called SFCFix.txt;
Open the file, then copy and paste its content in your next reply;

SFCFix.zip

jorfen · Jul 24, 2015

Hi Aura,

thanks for your quick response. The result of the requested operations is as follows:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-07-24 14:16:39.195
Microsoft Windows 8.1 Update 3 - amd64
Using .zip script file at C:\Users\Jordi\Desktop\SFCFix.zip [0]

PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG
Successfully copied file C:\Users\Jordi\AppData\Local\niemiro\Archive\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG to C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG.
Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG
Successfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.3.9600.17415_none_0a5dfdcc33c06e7e\MSDTC.LOG
PowerCopy:: directive completed successfully.

Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2015-07-24 14:16:39.648
Script hash: k9hg3Bv6kQoct6VaAveX+EKWM1C8FjDhDNK0aiL5glI=
----------------------EOF-----------------------

I guess I have to restart the computer and rerun: sfc / scannow ??

I await further instructions. Best regards. Jorfen

Aura · Jul 24, 2015

You can run a new SFC scan right now and provide me the CBS.log after that :)

System File Checker (SFC)
Follow the instructions below to run a SFC scan on your system and to provide the CBS log in your next reply;

On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select

Run as Administrator
On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
Enter the command below and press on Enter;
Code:
```
sfc /scannow
```
Note: There's a space between "sfc" and "/scannow";
Once the scan is complete, enter the command below and press on Enter
Code:
```
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
```
A file called cbs.txt will have appeared on your Desktop. Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Note: Please note that the CBS.log is volatile, which means that if you don't upload it after the SFC scan is completed, it won't contains the information from the scan anymore. So archive it and upload it as soon as you can.

jorfen · Jul 24, 2015

Hi Aura,

fantastic, perfect "sfc /scannow" not report any problems ...

but I think there is a problem in CBS.txt, attached link:

https://www.dropbox.com/s/7y2ey80qb85kx2l/cbs.txt?dl=0

Best regards. Jorfen

Aura · Jul 24, 2015

I don't see any problems in your CBS.log :) Also since it returned clean, it seems like your issue has been solved. If there's nothing else, I'll be marking this thread as solved :)

jorfen · Jul 24, 2015

Hi, many thanks Aura, .... yes ... I think the problema with MSDTC.LOG is solved ...

but I think there is still a problem in the system when running DISM ("Dism /Online /Cleanup-Image /ScanHealth"), I get the error: 14093 and the dism.log is :

https://www.dropbox.com/s/ekirchs7i091h1h/dism.txt?dl=0

I guess I have to open another thread for this ???

Best regards. Jorfen

Aura · Jul 24, 2015

What is the exact error message other than the error code? Also, run DISM, but then upload the CBS.log right away after please.

jorfen · Jul 24, 2015

Hi, I ran DISM , and the report error is this :

ERROR_SXS_IDENTITY_PARSE_ERROR14093 (0x370D)The identity string is malformed. This may be due to a trailing comma, more than two unnamed attributes, missing attribute name or missing attribute value.

The link for the new CBS.log is :

https://www.dropbox.com/s/ut59ydqtkokr5qe/CBS.log?dl=0

Best regards. Jorfen

Aura · Jul 24, 2015

Alright, run DISM one more time and provide the CBS.log again, I want to see if the error is still present and if it matches the same information I identified. Use the DISM command below.

Dism /Online /Cleanup-Image /RestoreHealth

jorfen · Jul 24, 2015

Hi, again I have run Dism /Online /Cleanup-Image /RestoreHealth , and the CBS.log file is :

https://www.dropbox.com/s/zlfs5qpzx70u10n/CBS.zip?dl=0

Best regards. Jorfen

Aura · Jul 24, 2015

We'll uninstall an update that appears to be corrupted.

Uninstall a Windows Update - Command Prompt
Follow the instructions below to uninstall a Windows Update manually via the command prompt.

On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select Run as Administrator
On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
Enter the command below (you can copy/paste it, to paste in the command prompt, right-click inside it and select Paste):
- wusa /uninstall /KB:2919355
Let me know the outcome of the command: either it uninstall the update or either it says that the update isn't installed on the system;

jorfen · Jul 25, 2015

Hi Aura, I ran this command, but it report Error 8007370D :

Could it be that the problem is because of these two keys, installation and component ???

2015-07-24 19:33:08, Info CBS Failed to EnumerateComponentDeployment, component: amd64_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_11.0.9600.17416_none_6399eebd1d799384 [HRESULT = 0x8007370d - ERROR_SXS_IDENTITY_PARSE_ERROR]
2015-07-24 19:33:08, Info CBS Failed to load component owners on component: amd64_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_0.0.0.0_none_dfdf1b7d3afe120a, version: 11.0.9600.17416 [HRESULT = 0x8007370d - ERROR_SXS_IDENTITY_PARSE_ERROR]

-- Perhaps, if this part of installation is repaired, and also their keys in "components" solves the problem ???

Best regards. Jorfen

Aura · Jul 25, 2015

That's my theory, yes. I'll need your COMPONENTS Hive to take a look at it. Follow the instructions below please.

Retrieve Components Hive

Please download the Freeware RegBak from here: Acelogix Software - Download products
You will find it at the bottom of the page that the link brings you to.
Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
Click the New Backup button. Accept the defaults and simply click Start.
When it says Finished successfully, click the Close button.
This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, one of which is named COMPONENTS.
Copy the COMPONENTS file to your Desktop. If the COMPONENTS file does not exist, please fetch it instead from C:\Windows\System32\config\COMPONENTS.
Now right click on the COMPONENTS file that is on your desktop and select Send to > Compressed (zipped) folder.
Then please upload the zip file (COMPONENTS.zip) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Dropbox or One Drive or SendSpace and then just provide the link in your reply.
You can close any open windows you have as well as the RegBack program now.

jorfen · Jul 25, 2015

Hi, I've made the process as you indicate and the file COMPONENTS is :

https://www.dropbox.com/s/9jmw1njg3pbt1rd/components.zip?dl=0

Best regards. Jorfen

Aura · Jul 25, 2015

Sorry for the delay jorfen. Follow the instructions below please.

SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.

Download SFCFix and move the executable on your Desktop;
Download the attached SFCFixScript.txt and move the file to your Desktop;
Note: Make sure that the file is named SFCFixScript.txt, do not rename it.
Save any work you have open, and close every programs;
Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it;
SFCFix will launch, let it complete;
Once done, a file will appear on your Desktop, called SFCFix.txt;
Open the file, then copy and paste its content in your next reply;

SFCFixScript.txt

DISM - Fixing Component Store Corruption
Follow the instructions below to run a DISM scan on your system:

On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
Enter the command DISM /Online /Cleanup-Image /RestoreHealth and press on Enter;
Let the scan run until the end (100%);
Copy the C:\Windows\Logs\DISM folder and C:\Windows\Logs\CBS\CBS.log file on your Desktop, then right-click on it, go to Send to... and select Compressed .zip archive;
Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Therefore, your next reply should contain:

Copy/pasted SFCFix log;
Download URL to the DISM.log and CBS.log;

jorfen · Jul 26, 2015

Hi, I think this has worked well ....

The report of SFCFIX.exe is :

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-07-26 14:40:54.113
Microsoft Windows 8.1 Update 3 - amd64
Using .txt script file at C:\Users\Jordi\Desktop\SFCFixScript.txt [0]

RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\d49c967ad5e..6d865dfe08a_31bf3856ad364e35_11.0.9600.17416_fb569ba94b26cc96.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\d49c967ad5e..6d865dfe08a_31bf3856ad364e35_11.0.9600.17416_fb569ba94b26cc96.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\d49c967ad5e..6d865dfe08a_31bf3856ad364e35_11.0.9600.17416_fb569ba94b26cc96.
RegistryScript:: directive completed successfully.

Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 3 datablocks.
Finish time: 2015-07-26 14:40:54.238
Script hash: J+nxYIr4VPSM3WnA2CEBd/9c939X7f255J0W0xh7nFY=
----------------------EOF-----------------------

The report of "DISM /Online /Cleanup-Image /RestoreHealth" is :

Microsoft Windows [Versión 6.3.9600]
(c) 2013 Microsoft Corporation. Todos los derechos reservados.
C:\Windows\system32>DISM /Online /Cleanup-Image /RestoreHealth
Deployment Image Servicing and Management tool
Version: 6.3.9600.17031
Image Version: 6.3.9600.17031
[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was repaired.
The operation completed successfully.

And the log Files requested are :

https://www.dropbox.com/s/ikpiblshjkastyp/LOG_DISM_CBS.zip?dl=0

I would say the problem is resolved. I'll try to update the system and see if does not give any error. If it works, with all due respect, I think you've gained a donation.

Thank you so much for everything. Best regards. Jorfen

Aura · Jul 26, 2015

Looks like it indeed worked, yes :) And please let me know if the updates install successfully or not. If they don't, we'll keep on working on the issue, if they do and your issue has been solved, I'll be marking this thread as such :)

And you're welcome Jorfen :)

jorfen · Jul 26, 2015

Hi, the update worked perfectly, but manually, I downloaded and have installed KB3065822.

I've done it this way, because the Windows Update process, had been stopped in its installation, for a long time. So I stopped the process, I restarted the computer and I have used the manual way without any problem. Checking with "DISM" does not report any problem.

Best regards. jorfen

Aura · Jul 26, 2015

Yes, installing updates manually is always a viable solution for some, not when you have like 50+ to install

And glad to see that your issue has been solved Jorfen, I'll be marking this thread as such now :)

[SOLVED] Problem MSDTC.LOG -> hash mismatch

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst

Contributor

Sysnative Staff, Security Analyst