Unicode Registry Corruption - SFC doesn't work and Windows Update won't

ukanalyst · Sep 6, 2015

Hi Guys,

I'm tearing my hair out with an issue and I really hope someone will be able to point me in the right direction. I've had an issue with my Windows Home Server 2011 SP1 machine for a few months now since I spotted that windows update would no longer work complaing of unknown error with code '80070002'. I started with the fairly straight forward fixes like deleting the SoftwareUpdate folder ... then I found out that SFC /scannow would not run, no matter how I tried this (from Safe Mode/Repair mode, online/offline etc) ... it complains of the error 'Windows Resource Protection could not perform the requested operation.'.

I also tried DISM online and offline with the restoreHealth and Cleanup-Image and RevertPendingActions flags in various combinations ... all reported error 87 'The cleanup-image option is unknown.'

So as I got more desperate I tried restoring the server back as far as I had a backup ... about 2 weeks and this made no difference, I then tried an in-place upgrade ... wouldn't let me do this because the version installed is newer than the version on disc (I'd installed SP1) ... tried to remove SP1 ... doesn't list any updates in control panel. I then worked through a guide to use DISM to slipstream SP1 onto my WHS 2011 install media ... same error when trying the in-place upgrade.

So I moved onto a new install on a second volume ... install worked but then I get HTTP error 503 preventing me from moving forward with the initial WHS setup :banghead:. In desperation I tried copying 'windows\servicing\packages' files from my clean install to the broken one and also from 'windows\winsxs\manifests' ... I also tried importing some keys from HKLM\COMPONENTS ... again no joy.

It isn't often I admin defeat with problems like this but I really am stuck. Thanks very much in advance ... here's the output of SFCFIX:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-09-05 10:10:56.290
Microsoft Windows Server 2008 R2 Service Pack 1 - amd64
Not using a script file.

AutoAnalysis::
WARNING: Unicode Registry Corruption Detected: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_prnca00a.inf_31bf3856ad364e35_6.1.7600.16385_none_dcb5d50c451bacd

SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 0
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 18
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.

Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-09-05 10:32:25.636
----------------------EOF-----------------------

... and here's my CBS folder zip: View attachment CBS.zip

zcomputerwiz · Sep 8, 2015

Did you recently have memory or disk problems with this machine?

Let's take a look at your components hive.

Run this script to upload it:
SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

[sfcfixdownload]Download SFCFix[/sfcfixdownload] (by niemiro) and save this to your Desktop.
Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a log should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u...eric/Collect/COMPONENTS/SFCFixScript.txt?dl=1

LogBot · Sep 9, 2015

Logfile submission from ukanalyst

Logfile submission from ukanalyst.

The logfiles are available at: https://www.sysnative.com/niemiro/fileDistribution/2015-09/6543.zip

ukanalyst · Sep 9, 2015

Hi zcomputerwiz and thanks very much for replying! I did have a faulty memory module but that was a while ago.

I did as you asked, cheers

Dave

Code:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-09-09 20:13:19.414
Microsoft Windows Server 2008 R2 Service Pack 1 - amd64
Using .txt script file at C:\Users\Administrator\Desktop\SFCFixScript.txt [0]




Collect:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-09-09 20:14:29.409
----------------------EOF-----------------------

zcomputerwiz · Sep 9, 2015

I did have a faulty memory module but that was a while ago.

Good, I'm glad that was resolved. Bad RAM is usually the cause of bit flips like these :)

I have fixed some of the corrupt keys, you'll need to replace the current components hive with the modified one.

Replace Components Hive Manually

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download COMPONENTS.ZIP and save to your desktop.
Right-click on it and select Extract all.... Make sure the "Show extracted files when complete" is checked and click Extract.
Now we have the COMPONENTS file that we will be using to replace your current one.
Navigate to C:\Windows\System32\config
Right-click on the current COMPONENTS file and select rename. Rename it to COMPONENTS.bad.
Note: If you get an error that the file is in use, reboot your computer and then try again.
Take the file from the Components folder on your desktop and paste it into C:\Windows\System32\config

View attachment 16270

After this, reboot and run the System Update Readiness Tool again. Attach C:\Windows\Logs\CBS\CheckSUR.log when it completes.

ukanalyst · Sep 10, 2015

Thanks again for your help with this, please find attached checksur.log captured following a reboot after replacing the windows\system32\config\components file.

Dave

ukanalyst · Sep 10, 2015

This looks a lot healthier ... haven't tried to fix anything yet ... will await direction but this is a step forwards!

Code:

C:\Users\Administrator>sfc /verifyonly

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found integrity violations. Details are included in

the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log

C:\Users\Administrator>

zcomputerwiz · Sep 10, 2015

OK, I did some more fixing. Same process with this hive, replace it then run SURT and attach the logs again.

View attachment 16315

ukanalyst · Sep 11, 2015

Thanks for that, the log said it fixed some errors so I ran it twice, the second run looks a heck of a lot healthier!:

First run:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2015-09-11 14:29


Checking Windows Servicing Packages


Checking Package Manifests and Catalogs


Checking Package Watchlist


Checking Component Watchlist


Checking Packages


Checking Component Store
(f)	CSI Catalog Missing	0x00000002	d0206ad8d542d212d6513a3b53b84711dd609a10fb5e8af05e360d9ee887ff5d.cat	microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_50934f2ebcb7eb57	Missing catalog or invalid CatalogThumprint
(fix)	CSI Catalog Missing	CSI File Replaced	Deleted CatalogThumbprint
(f)	CSI Missing Component Key	0x00000000	x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57	HKLM\Components\DerivedData\Components	
(fix)	CSI Missing Component Key	CSI Registry Item Repaired	Key created.  There will be more reports as values are replaced.
(f)	CSI Catalog Missing	0x00000002	1cec9b2aadeccd8208e4857d2b7b185ade4dcdead03dc0f10d3a2b6cbb3fc312.cat	policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_f480bfaef65491a5	Missing catalog or invalid CatalogThumprint
(fix)	CSI Catalog Missing	CSI File Replaced	Deleted CatalogThumbprint
(f)	CSI Missing Component Key	0x00000000	x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_f480bfaef65491a5	HKLM\Components\DerivedData\Components	
(fix)	CSI Missing Component Key	CSI Registry Item Repaired	Key created.  There will be more reports as values are replaced.
(f)	CSI C Mark Deployment Missing	0x00000000	c!4a1985f0141..)3197a6b078_b77a5c561934!089_6.1.7601.17933_0c13e65cf74bd5fc	msil_datasvcutil_b77a5c561934e089_6.1.7601.17933_none_cfc5aca1bac6ff6e	
(f)	CSI Missing C Mark	0x00000000	c!microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_50934f2ebcb7eb57	x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57	Missing c!
(fix)	CSI Missing C Mark	CSI Registry Item Repaired	c!microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_50934f2ebcb7eb57 successfully added to x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57
(f)	CSI Missing C Mark	0x00000000	c!policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_f480bfaef65491a5	x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_f480bfaef65491a5	Missing c!
(fix)	CSI Missing C Mark	CSI Registry Item Repaired	c!policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_f480bfaef65491a5 successfully added to x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_f480bfaef65491a5


Summary:
Seconds executed: 1200
 Found 7 errors
 Fixed 6 errors
  CSI Catalog Missing Total count: 2
  Fixed: CSI Catalog Missing.  Total count: 2
  CSI Missing Component Key Total count: 2
  Fixed: CSI Missing Component Key.  Total count: 2
  CSI Missing C Mark Total count: 2
  Fixed: CSI Missing C Mark.  Total count: 2
  CSI C Mark Deployment Missing Total count: 1

second run:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2015-09-11 14:56


Checking Windows Servicing Packages


Checking Package Manifests and Catalogs


Checking Package Watchlist


Checking Component Watchlist


Checking Packages


Checking Component Store
(f)	CSI C Mark Deployment Missing	0x00000000	c!4a1985f0141..)3197a6b078_b77a5c561934!089_6.1.7601.17933_0c13e65cf74bd5fc	msil_datasvcutil_b77a5c561934e089_6.1.7601.17933_none_cfc5aca1bac6ff6e	


Summary:
Seconds executed: 1216
 Found 1 errors
  CSI C Mark Deployment Missing Total count: 1

zcomputerwiz · Sep 11, 2015

Let's delete that errant entry.

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a file should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

View attachment SFCFix.zip

As usual, once complete run SURT again and attach the log.

ukanalyst · Sep 11, 2015

You're a star! Thanks very much for your help!

Here's the log from sfcfix:

Code:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-09-11 23:55:45.871
Microsoft Windows Server 2008 R2 Service Pack 1 - amd64
Using .zip script file at C:\Users\Administrator\Desktop\SFCFix.zip [0]








RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\msil_datasvcutil_b77a5c561934e089_6.1.7601.17933_none_cfc5aca1bac6ff6e.


Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\msil_datasvcutil_b77a5c561934e089_6.1.7601.17933_none_cfc5aca1bac6ff6e.


Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\msil_datasvcutil_b77a5c561934e089_6.1.7601.17933_none_cfc5aca1bac6ff6e.
RegistryScript:: directive completed successfully.








Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2015-09-11 23:55:48.632
Script hash: kn3WqZWoQiaHCSsiVo81gp9TK+LpCdoP9wY0XCRqehE=
----------------------EOF-----------------------

and here's the final readiness assessment tool log:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2015-09-11 23:58


Checking Windows Servicing Packages


Checking Package Manifests and Catalogs


Checking Package Watchlist


Checking Component Watchlist


Checking Packages


Checking Component Store


Summary:
Seconds executed: 1193
 No errors detected

zcomputerwiz · Sep 13, 2015

Looks good :thumbsup2:

Check for Windows Updates and try to install any that are offered.

If one of the updates fail, zip and attach C:\Windows\Logs\CBS\CBS.log

Search

Search

Unicode Registry Corruption - SFC doesn't work and Windows Update won't

ukanalyst

Member

zcomputerwiz

Windows Update Expert

LogBot

Well-known member

ukanalyst

Member

zcomputerwiz

Windows Update Expert

ukanalyst

Member

Attachments

ukanalyst

Member

zcomputerwiz

Windows Update Expert

ukanalyst

Member

zcomputerwiz

Windows Update Expert

ukanalyst

Member

zcomputerwiz

Windows Update Expert