[SOLVED] Windows Server 2016 Task Manager and Update Issue

[fuesting]

Hi Sysnative people. What a great site. I can't believe it's taken my server problem to find such a great site. I work in IT but Windows is definitely not my expertise.

I'm running Windows Server 2016 at home doing some Plex hosting and backup operations for my fleet of devices. I noticed the task manager was stuck updating its statistics as soon as I launched it. A quick search led me to corrupt files and DISM. No luck with SFC or DISM, with DISM posting:

C:\Users\Administrator>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.14393.4169

Image Version: 10.0.14393.4169

[==========================100.0%==========================]
Error: 1734

The array bounds are invalid.

Unfortunately, my research led me to no concrete answers or fixes. I ran across Sysnative and joined up hoping to get a helping hand.

I've prepared logs from SFC, DISM and ComponentsScanner.

Any help would be greatly appreciated.

Thank you in advance.

 

[fuesting]

Bump. Any input? Thanks!

 

[Maxstar]

Hi and welcome to Sysnative,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

 

[fuesting]

Thank you for your reply Maxstar. I just followed your instructions.

Attached is the SFCFix.txt and the DISM command completed successfully! Not sure if things are fixed yet but wanted to post results.

C:\Windows\system32>DISM /online /cleanup-image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.14393.4169

Image Version: 10.0.14393.4169

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\Windows\system32>

 

[Maxstar]

Hi,

This looks good, let me know if there are any remaining issues.

 

[fuesting]

The server is not having any obvious issues other than the task manager is not working correctly. It launches but the statistics are frozen; no updates. I was thinking of trying Windows Updates but wanted to wait for some guidance. DISM is completing successfully.

 

[Maxstar]

Please run the System File Checker first and post the result. If it fails attach a new copy of the CBS logs.

SFC /Scannow

 

[fuesting]

C:\Users\Administrator>SFC /Scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Administrator>

 

[Maxstar]

The attached ZIP-file is empty?

 

[fuesting]

Sorry about that.

 

[Maxstar]

This log looks good, are you still having issues with the Task Manager?

 

[fuesting]

I would agree the logs look good but no task manager is not functioning correctly. It's like its taking a screen capture of itself at the moment I launch it. So the statistics are up-to-date but are also not updating or changing. I do have a windows update available, which I'm not sure will complete successfully but I do not think its related to this issue.

 

[Maxstar]

Please run the following tool to get some more information.

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

• Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
• Right-click to run the tool as administrator. When the tool opens click Yes to disclaimer.
• Note: Ensure that the Addition.txt check box is checked at the bottom of the form within the Optional Scan area.
• Press the Scan button.
• Please wait for the tool to finish. It will produce two logfiles called FRST.txt and Addition.txt in the same directory the tool is run from (which should be the desktop)
• Post the logfiles FRST.txt and Addition.txt as attachment in your next reply.

 

[fuesting]

Thank you

 

[Maxstar]

Name: Trojan:Win32/Trafog!pz
Path: containerfile:_M:\Software\PC\Adobe Photoshop Plugins\Panopticum_Digitalizer_v1.1.rar

Name: Trojan:Win32/Zbot!pz
Path: containerfile:_M:\Software\PC\Swish\ucfwib13.zip

Hi,

I noticed a number of cracks, patched execuatbles and keygens. So let's scan this server first to see if it is infected.

Download

ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens select the English language and click on Get Started.
• Accept the license agreement, and select in the "Before we start..." screen the following options:
  • No thanks, I am not interested. (if you don't want to share anonymous data with ESET.)
  • Enable feedback system (recommended).
• Click on Continue and click on the Full Scan option.
• Select Enable ESET to detect and quarantine potentially unwanted applications - then click Start scan. (This may take some time.)
• When the scan is ready and if threats have been detected, select Save scan log. Save it to your desktop as Eset.txt. Click on Continue.
• ESET Online Scanner will now ask if you'd like to turn on the Periodic Scan feature. Disable this option if you don't want to plan the periodic scan.
• Click on Continue If you left feedback, click Submit and continue. If not, Close without feedback.
• Attach the scan log Eset.txt to your next reply.

 

[fuesting]

Unfortunately, the ESET scanner is crashing about 3 mins into the scan. It never makes it to scanning and is stuck at 1% of "System is downloading module update".



Also, noting on those found questionable files. Those are very old pieces of software stored for archival reasons. They have never and would never be installed on this system. I don't even remember where they came from. I think they were files found on friends on machines when I've backed up or fixed them over the years. They might be 15 years old. Either way they are gone now; deleted.

 

[Maxstar]

Hi,

Okay, but very strange why ESET is crashing! However, check the following for Task Manager > open the View menu and check if Update Speed is not set to Paused.

 

[fuesting]

I_am_so_embarrassed. Your suggestion fixed Task Manager. How/why in the heck would that have happened!? The only way I did that was through a series of accidental clicks by my cat.

If you're tracking, my search for this problem was: "task manager not updating" led me to verifying corrupt files, which led me to DISM, etc, which led me to Windows updates not working right, which led me here.

As far as ESET not working, I want to figure that out too. Is there another AV you would recommend in the interim?

 

[Maxstar]

I don't have a explanation why this happens, but I've seen similar cases were TaskMgr was set to Paused for some reason?

To investigate the issue with ESET we could check the Event Logs.

Upload the Event Viewer logs.

• Click the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
  Copy and paste the following commands one at a time into the command prompt and press enter after each.
  

  wevtutil epl SYSTEM "%userprofile%\Desktop\System.evt"
  wevtutil epl APPLICATION "%userprofile%\Desktop\Application.evt"
  PowerShell Compress-Archive -Path "%userprofile%\Desktop\*.evt" -DestinationPath "%UserProfile%\Desktop\EventLogs.zip"

• These commands will collect the System and Application logs and create EventsLogs.zip on your Desktop.
• Attach this file in your next reply.

 

[fuesting]

Also, saw this in event log:
Faulting application name: ESETOnlineScanner.exe, version: 10.34.8.0, time stamp: 0x65f09154
Faulting module name: ntdll.dll, version: 10.0.14393.6343, time stamp: 0x6502749b
Exception code: 0xc0000005
Fault offset: 0x000587a9
Faulting process id: 0x960
Faulting application start time: 0x01da811b0a687587
Faulting application path: C:\Users\Administrator\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 989e0d67-1783-4caa-9326-e60ef2482649
Faulting package full name:
Faulting package-relative application ID: