The problem on your particular computer is actually that the registry value holding the SHA256 value is corrupt. I knew (well, very strongly suspected) this right from your first post. This was why I asked for the CheckSUR.log: with a registry corruption like this, it's all the more important to know the full story prior to a fix.
There are always two causes of a manifest corruption: either the manifest is corrupt, or CBS incorrectly thinks that the manifest is corrupt (the hash of the manifest stored in the registry is corrupt). You've worked this all out already.
Now, we could use the found and expected hashes to our advantage - if I know what the expected hash for this manifest *should* be (simple, just hash it), and it doesn't match with the expected hash in the logfile, registry corruption. If the expected hash I know matches that of the logfile's expected hash, but not the logfile's "found" hash, file corruption. If it doesn't match either, either the registry and file system of the OP's system are corrupt, or I've made some error somewhere.
However, hashes such as SHA256 are designed to give a lot of entropy for a very small change. The matching characters at the beginning (EEEA185B) make this, almost to within statistical impossibility (I haven't actually calculated the probability, but it's going to be minute) a case of registry corruption, hands down.
However, I chose not to do this. I chose to go down the "repair the manifest, if no go, repair the registry" route. You're probably thinking WHY??? if I (supposedly) knew this all already.
It was actually because you mentioned you were on a WSUS server, and then this final line "Any help finding correct version of that manifest?". I knew that you were an IT guy. And the sad reality is that I get a huge amount of flak off IT guys. Sometimes it's just because I've overexplained something - it's not that I'm trying to be patronizing in any way, it's because I don't know how skilled each member is, so I have generic canned speeches to use, and future search engine users to think about. I've just completely given up to be honest, and now seek any method which avoids yet another discussion along these lines. From your final comment, it seemed to me that you had already decided that the manifest was corrupt, and that if I said "no, actually, it's the registry" we'd end up with a huge problem over whether or not I fully understood the meaning of "FileHashMismatch". So I decided to get my trainee to go down the not strictly necessary file replace option just to give me some easy ammo to work with on investigating the registry side of things.
But you sussed it out. However, before you are too quick to judge, please take a look at the situation from my shoes. I get IT guys everyday, and in the time it takes me to write this post, I could have answered virtually every other one of today's threads in this forum. With important university entrance exams coming up, I need to save all the time I can. You don't have to agree with this, but do you understand what I'm trying to do and why?
As for using SFCFix, I do that because we have backend tools which help us write the scripts extremely quickly, and it helps us by doing all the permissions, ownership, backups, attributes, etc. It also double checks, under the right conditions, file replacements prior to performing them so that it picks up and prevents mistakes. It's the safest way for us to perform replacements, even if not absolutely necessary.
If you want my assistance and if your willing to work with me, then great. Otherwise I suggest you find another forum to ask your question on.
Richard
