Windows Fails or BSODs When Updating, SFC Fails (OS: Windows 10.0.18362 Build 18362)

Maxstar · Aug 10, 2023

Hi,

Can you please attach a copy of the CSB folder with all the CBSpersist_logs, as well as the logs of the following tool.

Download and run SetupDiag from Microsoft

Download

SetupDiag to your desktop.
Right-click on SetupDiag.exe and select Run as administrator.
When completed the following files are created: "Logs.zip, SetupDiag.exe.config and SetupDiagResults.log"
Attach SetupDiagResults.log and Logs.zip to your next reply.

Sketch · Aug 10, 2023

Running SetupDiag, the program finished immediately, even running as admin, and did not generate the specified logs. I dug around a little to be safe and found a SetupDiag folder in %systemroot%\Logs, which did have an xml file labled SetupDiagResults, but not a .log file. I tried running it from a cmd window with admin and tried setting the log output switch to go to the desktop but still nothing. Finally I just ran it with /Verbose and *that* caused it to generate the logs the config and the SetupDiagResults.log, but not the Logs.zip. I've attached the zipped CBS folder and SetupDiagResults.log

Maxstar · Aug 10, 2023

That's odd, the CBS logs does not reveal any useful information either about the rollback. So we'll need to wait for @x BlueRobot to analyse your memory dump in post #20.

Can you please perform the following instructions as well to get more information about your system.

Download the

Sysnative BSOD Dump + System File Collection App to your desktop.

Right-click on SysnativeBSODCollectionApp.exe and select "Run as administrator".
When the tool is ready, it will open the directory: C:\Users\<username>\Documents.
Post the zipfile: SysnativeFileCollectionApp.zip as attachment in your next reply.
The textfile 'BSODPostingsInstructions' you may close.

Sketch · Aug 10, 2023

Alrighty, here you go

Maxstar · Aug 10, 2023

Just some notes in anticipation of further analysis:
Your current BIOS version is 1805 (12-19-2012), the latest version is 2104 (09-16-2013) to improve system stability and add support for "newer" CPU's for your motherboard Asus P8Z77-V Pro (but don't install this BIOS version yet!)

The memory dump shows: Bug check 0x7F: UNEXPECTED_KERNEL_MODE_TRAP

The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.

This trap could be either of the following types:

A bound trap, which is a trap the kernel isn't permitted to catch.
A double fault, which is a fault that occurred while processing an earlier fault, which always results in a system failure.

Rich (BB code):

Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT

FAILURE_BUCKET_ID:  0x7f_8_VRF_nt!KiDoubleFaultAbort

02 ffffdd00`3898b090 fffff804`65ccb1c8     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2c5 (TrapFrame @ ffffdd00`3898b090)

Sketch · Aug 10, 2023

Oh that's interesting, thank you. Alright I'll hold off on messing with anything until we hear back from BlueRobot.

x BlueRobot · Aug 11, 2023

It looks like your nvidia graphics card driver has caused a stack overflow because it possibly got itself caught into some recursive loop.

Rich (BB code):

6: kd> !lmi FFFFF80F508D0000
Loaded Module Info: [fffff80f508d0000]
         Module: nvlddmkm
   Base Address: fffff80f508d0000
     Image Name: nvlddmkm.sys
   Machine Type: 34404 (X64)
     Time Stamp: 64af47fa Thu Jul 13 01:40:26 2023
           Size: 3962000
       CheckSum: 3862ee7
Characteristics: 22 
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    88, ac37d4,  ac1dd4 RSDS - GUID: {2177D8BA-411A-4345-91DD-D36631F30BD4}
               Age: 1, Pdb: C:\dvs\p4\build\sw\rel\gpu_drv\r535\r536_62\drivers\display\lddm\nvlddmkm\_out\wddm2_amd64_release\nvlddmkm.pdb
           VC_FEATURE    14, ac385c,  ac1e5c [Data not mapped]
                 POGO   43c, ac3870,  ac1e70 [Data not mapped]
                   ??     4, ac3cd4,  ac22d4 [Data not mapped]
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: NONE     - PDB not found from symbol server.
    Load Report: no symbols loaded

If you aren't using the latest studio ready driver then I would recommend switching to that version instead, otherwise please roll back a few driver versions and make sure you use the older studio ready driver. Please make sure that you remove any existing drivers using DDU first: Utilizing DDU Display Driver Uninstaller Properly

Sketch · Aug 12, 2023

Alright, I was a little out of date on my driver, so I ran DDU in safe mode after creating a restore point and disabling the windows update service. Then I installed the latest driver and restarted in normal mode. I'll try running windows update again while I head to the store.

(Edit) Hmm, it looks like the windows update service already set itself back to manual mode. Maybe that's because I opened the windows update dialogue first though.

Sketch · Aug 12, 2023

Ah okay it failed before it got to the restart phase.

Code:

2020-12 Cumulative Update for Windows 10 Version 1903 for x64-based Systems (KB4592449) - Error 0x80073701

Tried running SFC again to see if it could find anything now that we've cleaned up some stuff, but it still failed at 64%.
DISM /Online /Cleanup-Image /ScanHealth completed but didn't find anything "No component store corruption detected."
Both were run from an admin cmd prompt.

(Edit) checked for minidumps and memory.dmp but nothing new there. Attaching CBS.log if y'all need it.

Maxstar · Aug 12, 2023

Rich (BB code):

2023-08-11 21:26:40, Error                 CSI    000001cc@2023/8/12:04:26:40.308 (F) onecore\base\wcp\componentstore\deltastore.cpp(3065): Error STATUS_INVALID_PARAMETER originated in function ComponentStore::CRawStoreLayout::DecompressFile expression: Parameter check failed
[gle=0x80004005]

Hi,

Please run SFC /Scannow again with Process Monitor running

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Run SFC /Scannow just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square (CTRL +E) on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free and provide the link with a new copy of the CBS log and a copy of the COMPONENTS hive.

Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

Sketch · Aug 12, 2023

Alright, here's the log file from process monitor: Logfile.zip
COMPONENTS is attached below.

Maxstar · Aug 13, 2023

Thanks but please attach also the CBS log as requested for the timestamps.

Sketch · Aug 13, 2023

Oh, woops, I forgot that one. I repeated the previous instructions so all of these are fresh files with a corresponding CBS.log : ProcMon-8-13-23.zip

Maxstar · Aug 14, 2023

It looks like Process Monitor was stopped to early, please perform the same steps again but wait for 30 seconds before you stop the trace when SFC failed.

Sketch · Aug 14, 2023

Okay, let it run for a minute or so after. I just waited until the time stamps on the display caught up with roughly when SFC ended so hopefully it's all in there. Here are the files: ProcMon-8-14-23_2_20am.zip

Maxstar · Aug 14, 2023

Rich (BB code):

11:19:20.2570056 AM    TiWorker.exe    16104    RegQueryValue    HKLM\COMPONENTS\DerivedData\Components\amd64_netfx4-system.runtime.remoting.resources_b03f5f7f11d50a3a_4.0.15788.0_ja-jp_57dbcd3f1709b51a\f!system.runtime.remoting.r_3abb8b3923bc1ea1    BUFFER TOO SMALL    Length: 0
11:19:20.2570179 AM    TiWorker.exe    16104    RegQueryValue    HKLM\COMPONENTS\DerivedData\Components\amd64_netfx4-system.runtime.remoting.resources_b03f5f7f11d50a3a_4.0.15788.0_ja-jp_57dbcd3f1709b51a\f!system.runtime.remoting.r_3abb8b3923bc1ea1    SUCCESS    Type: REG_DWORD, Length: 4, Data: 33

Great, now I could find the corrupt registry key. So here's the next fix.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker again with Process Monitor running and attach the trace and the CBS.log if it fails.

Code:

SFC /Scannow

Sketch · Aug 14, 2023

"Beginning verification phase of system scan.
Verification 74% complete.

Windows Resource Protection could not perform the requested operation."

Hey, we got 10% further this time, progress! I followed the instructions and gave procmon time to grab all the details as before. I've uploaded everything here: ProcMon-8-14-23-3_50am.zip

Maxstar · Aug 14, 2023

Rich (BB code):

12:52:19.2090209 PM    TiWorker.exe    6604    RegQueryValue    HKLM\COMPONENTS\DerivedData\Components\msil_system.windows.form..alization.resources_31bf3856ad364e35_4.0.15788.0_ja-jp_b4ab794ae2dd7e08\f!system.windows.forms.data_30c0b01a14f582e4    BUFFER TOO SMALL    Length: 0
12:52:19.2090334 PM    TiWorker.exe    6604    RegQueryValue    HKLM\COMPONENTS\DerivedData\Components\msil_system.windows.form..alization.resources_31bf3856ad364e35_4.0.15788.0_ja-jp_b4ab794ae2dd7e08\f!system.windows.forms.data_30c0b01a14f582e4    SUCCESS    Type: REG_DWORD, Length: 4, Data: 33

Here's the next fix:

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker again with Process Monitor running and attach the trace and the CBS.log if it fails.

Code:

SFC /Scannow

Sketch · Aug 14, 2023

Holy smokes it finished, SFC stated it found corrupted files and repaired them, and that it would log it in the CBS.log. I'm attaching that in case it's needed since I'm going to hit the hay. I'm guessing the next step will be trying windows update again though?

Maxstar · Aug 14, 2023

Great, this looks much better. I would suggest to run the following DISM command first. Just to be sure there are no remaining corruptions before we try to updating again.

Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

Code:

DISM /online /cleanup-image /RestoreHealth

Windows Fails or BSODs When Updating, SFC Fails (OS: Windows 10.0.18362 Build 18362)

Windows Update Moderator, Security Analyst

Contributor

Attachments

Windows Update Moderator, Security Analyst

Contributor

Attachments

Windows Update Moderator, Security Analyst

Contributor

Administrator

Contributor

Contributor

Attachments

Windows Update Moderator, Security Analyst

Contributor

Attachments

Windows Update Moderator, Security Analyst

Contributor

Windows Update Moderator, Security Analyst

Contributor

Windows Update Moderator, Security Analyst

Attachments

Contributor

Windows Update Moderator, Security Analyst

Attachments

Contributor

Attachments

Windows Update Moderator, Security Analyst