[SOLVED] Win10 BSOD 0xC000021A plus no way to restore - caused by Windows update

[eludwig]

Hello everyone,

after an automated Windows update the Lenovo B50-70 Notebook of my wife ended up not booting anymore and displaying the error code 0xC000021A. After some Google search I got into the recovery mode and tried without luck all proposed repair solutions in following order:

1. Automatic repair in troubleshoot / advanced options.

2. loading of all restore points.

3. loading windows in safe mode with disabled driver signature enforcement.

4. Fdisk went thru without errors.

5. Dism and sfc failed due to /online parameter which could not be executed from Windows PE environment.

6. Reset Windows was aborted for some reason.

7. Get back to previous build also. . .

I already excluded Memory and HardDrive errors as you can read HERE.

Then I removed the disk and intedgrated it into my desktop in order to save important data.

After that I found in another forum another proposal. So I loaded the command prompt and tried dism not with the /online but with the /image parameter and in the log there was a checksum difference for Difxapi.dll. I also got SFC running with sfc /scannow /offbootdir=d:\ /offwindir=d:\windows and got more or less the same result (see CBS.log attached for the complete log):

Read More:

I just checked the log myself (by hand; not automated), although I didn't know what to look for. . . however following entries are the moste interesting:

00000001 Shim considered [l:125]'\??\c:\windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.400_none_eb2ff40c1d41442d\wcp.dll' : got STATUS_OBJECT_PATH_NOT_FOUND

00000002 Shim considered [l:122]'\??\c:\windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.400_none_eb2ff40c1d41442d\wcp.dll' : got STATUS_SUCCESS

00000001@2019/1/15:19:45:52.560 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7ff90a84c2b9 @0x7ff90d2349db @0x7ff90d234b1e @0x7ff61add5e80 @0x7ff61add1684 @0x7ff61add147d)

00000003 Servicing stack shim unable to mark handle 1c4 ('\Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\temp\SSS_356eb4ea0aadd4010100000058075c07\msdelta.dll') for delete-on-close, error STATUS_CANNOT_DELETE

00000004 Servicing stack shim unable to mark handle 194 ('\Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\temp\SSS_356eb4ea0aadd4010100000058075c07') for delete-on-close, error STATUS_DIRECTORY_NOT_EMPTY


then along the log there are a lot of "Duplicate ownership for directory" Errors (which I assume are not BSOD relevant) like this:


00003691 Error: Overlap: Duplicate ownership for directory \??\C:\WINDOWS\bcastdvr in component Microsoft-OneCore-Multimedia-BroadcastDVR, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}

00003692 Warning: Overlap: 1 directory duplicate ownerships detected.

000037c0 Error: Overlap: Duplicate ownership for directory \??\C:\Program Files\Common Files\Microsoft Shared\Ink in component Microsoft-Shared-Ink-Directory, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}

000037c1@2019/1/15:19:54:09.560 CSIPERF - FileMapsCreated 154ms


or this:


0001022e Warning: Overlap: Directory \??\C:\WINDOWS\SysWOW64\drivers\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

0001022f Warning: Overlap: Directory \??\C:\WINDOWS\SysWOW64\wbem\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

00010230 Warning: Overlap: Directory \??\C:\WINDOWS\help\mui\0409\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

00010231 Error: Overlap: Duplicate ownership for directory \??\C:\WINDOWS\SysWOW64\setup\en-US in component Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

00010232 Error: Overlap: Duplicate ownership for directory \??\C:\WINDOWS\SysWOW64\en-US in component Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.17134.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
00010233@2019/1/15:20:24:04.584 CSIPERF - FileMapsCreated 904ms
00010234 Warning: Overlap: 2 directory duplicate ownerships detected.
00010235 CSIPERF - FilePI Commit 1073ms


And most interesting I found following entries which confirm the DISM findings:


000055ed Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055ee [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch

000055f0 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

000055f1 [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
000055f2 [SR] This component was referenced by [l:145]'Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.microsoft-windows-client-features-deployment001120-Deployment'

000055f3 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

000055f4 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

000055f5 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\difxapi.dll; source file in store is also corrupted

000055f6@2019/1/15:19:59:11.725 Primitive installers committed for repair
000055f7 [SR] Verify complete
000055f8 [SR] Repairing 1 components
000055f9 [SR] Beginning Verify and Repair transaction

000055fa Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

000055fb [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch

000055fc@2019/1/15:19:59:11.756 Primitive installers committed for repair

000055fd Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

000055fe [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch

000055ff [SR] This component was referenced by [l:145]'Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.microsoft-windows-client-features-deployment001120-Deployment'

00005600 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

00005601 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.

00005602 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\difxapi.dll; source file in store is also corrupted

00005603@2019/1/15:19:59:11.813 Primitive installers committed for repair

Now I'd like to know how to repair the corrupted difxapi.dll?

Unfortunately the SFCFix doesn't seem to becompatible with the crashed Windows version :-(

Thanks for the help!

Bert

 

[eludwig]

:noidea: Noone can help me? :s5::s13:

 

[eludwig]

I got help to replace the corrupted difxapi.dll and sfc and DISM are running thru successfully. However my Windows still doesn't boot.
Any ideas why? Are there another tests except sfc and DISM to find out what's wrong?

 

[Sysnative Windows Update]

Hello and welcome!

What makes you think it was caused by an update?

Please do the following so I can inspect your system for any obvious issues:

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.

2. Copy it to your USB drive.
3. Boot to recovery environment.
4. Launch CMD and launch FRST64.exe from the USB.
5. Press Scan button.
6. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the USB)
7. Please attach the log back here.


Please note that there is no guarantee that I will be able to help you, but I will try.

 

[eludwig]

Hello softwaremaniac,

thanks for trying to help me; any help is better than none. I'm bumping from error to error; it's really frustrating, since I hoped to get the system booting after the successful replacement of difxapi.dll.

I assume it was the update, since my wife said last thing before the boot-loop and the resulting 0xc000021a-error was an update.

Anyhow, please find attached the requested FRST.txt

Thanks,

Bert

 

[Sysnative Windows Update]

Okay, there's nothing obvious. Could you please run another SFC Scan and provide CBS.log just like you have done in the past?

 

[eludwig]

Ok, please find attached the required CBS.log

The message in the command prompt says: Windows Resource Protection did not find any integrity violations.
However the log still says:

Read More:

000055ed Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055ee [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
000055ef@2019/1/15:19:59:11.693 Primitive installers committed for repair
000055f0 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055f1 [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
000055f2 [SR] This component was referenced by [l:145]'Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.microsoft-windows-client-features-deployment001120-Deployment'
000055f3 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055f4 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055f5 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\difxapi.dll; source file in store is also corrupted
000055f6@2019/1/15:19:59:11.725 Primitive installers committed for repair
000055f7 [SR] Verify complete
000055f8 [SR] Repairing 1 components
000055f9 [SR] Beginning Verify and Repair transaction
000055fa Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055fb [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
000055fc@2019/1/15:19:59:11.756 Primitive installers committed for repair
000055fd Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
000055fe [SR] Cannot repair member file [l:11]'difxapi.dll' of Microsoft-Windows-difxapi, version 10.0.17134.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
000055ff [SR] This component was referenced by [l:145]'Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.microsoft-windows-client-features-deployment001120-Deployment'
00005600 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
00005601 Hashes for file member [l:11]'difxapi.dll' do not match.
Expected: {l:32 ml:4096 b:a9f82a8e23334ced11b13172bd10b9c818820203560e0ec2cd7cc15e6aa8d15a}.
Actual: {l:32 b:4364de40699b051e6480348cea22ea5781fe2c4179deea55edbe86ffb5d344c5}.
00005602 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\difxapi.dll; source file in store is also corrupted
00005603@2019/1/15:19:59:11.813 Primitive installers committed for repair

 

[Sysnative Windows Update]

Good. That was an old message, which is apparent from the date stamp. There is no corruption present any longer so I would recommend you open a new thread here: https://www.sysnative.com/forums/bsod-crashes-kernel-debugging/ for the BSOD experts to check it out.

 

[eludwig]

Ok, done! Thank you! Greetings to Croatia!

 

[Sysnative Windows Update]

Thanks!