Using CheckSUR and update packages to fix corruption


My last post was on CheckSUR and I wanted to follow it up with how you can use the CheckSUR utility to fix corruption errors that CheckSUR might detect, but that cant be fixed with the utility.

Typically, the way that CheckSUR works is that it takes the information included with its payload, loads it locally to your machine into the \Windows\CheckSUR directory and then runs the actual executable on the system.  As this executable runs, it detects discrepencies in the package store and corrects the errors that it carries a payload for.  But, what do you do when you have a package manifest that shows up in the CheckSUR log but doesnt have the payload with it?  If you were to call my team we’ll typically try to walk you through getting the files from another server, taking ownership of the servicing directories and moving the files.  But what if this is an isolated server?  Worse, what if you only have one PC at home and you’re having issues?  Well, there is an easier way.

What you should do is identify the package(s) that CheckSUR was not able to fix, they’re usually listed at the end of the log.  From there, you can take that information and go the Microsoft Download site and pull down the KBXXXXXX.MSU that corresponds to the package that you’re seeing failures on.  Since you’ve already run CheckSUR to get to this point, you can copy that .MSU to the \Windows\CheckSUR\packages directory (NOTE: This directory does not exist by default and must be created) and then re-run CheckSUR which will take care of the rest.  If you’re still having issues afterwards, that just means that something else is going on with the system that is going to require more than CheckSUR can accomplish.  Typically, this is true corruption and it may be unrecoverable.

As a side note, CheckSUR doesnt have a command line interface component, so you cant rerun it once its been downloaded and installed, you just need to re-run the downloaded MSU package. 

Hope that helps.

–Joseph

Comments (43)

  1. Anonymous says:

    Payload refers to the manifests (package or component), individual component binaries and any additional files required to install an update.  These will vary from update to update.

  2. Anonymous says:

    Look for those keys in HKLMComponents branch, export them and then rescan the system for updates.

  3. Anonymous says:

    No problem

  4. Anonymous says:

    What is the command you're running to install the .Net Framework?  Are you installing it via Windows Update or command line?

  5. Anonymous says:

    You should only need to right click on the service name and choose Start.  You dont need to change any of the permissions.

  6. Anonymous says:

    You'd have to search within the Components branch to find them.  Export them to a directory that you know of, it can be anything.

  7. Anonymous says:

    @Amy;  Did you create the packages directory and put the MSU in there?  If that didnt work for you, then manual copy will be your only other option.

  8. Anonymous says:

    @Jacob;

    No, there isnt a way to point it to SCCM as a source.

  9. Anonymous says:

    Glad to hear that worked for you Jose.  This functionality is now built into Windows 8, just so everyone knows 🙂

  10. Anonymous says:

    No problem, glad that worked for you.

  11. Anonymous says:

    Not really new, just easier.  In reference to  the documentation above,  we still use that method to fix certain types of corruption in the event that this workaround doesnt work.  But, I've had good success with this method and it doesnt require users to hork around with system permissions (yes, hork is a technical term <G>)

  12. Anonymous says:

    LOL, no worries Falcon, it's a great comment.

    I might try to find a way to have a discussion on CBS related stuff once I have a little more free time.  Right now, I'm doing some work that is taking up a lot of my time and that's one reason I havent been able to do more than keep up with comments right now.

    I think one thing that would be a good idea, potentially, is to have the "geek out" here on the blog in a post/comment type format.  Someone asks a question about a particular piece of CBS and I will do what I can to give answers to that.  Rinse and repeat.

    –Joseph

  13. Anonymous says:

    It will return codes related to missing or corrupted manifests.  I dont have all of the codes off of the top of my head though.

  14. Anonymous says:

    Bob;

    It's a little difficult to tell you how to walkthrought the component branch via a blog and without really knowing whats going on (aside from the comments here).  You'll need to have control of the components branch in the registry, which is usually owned by Trusted Installer.  You can manually give yourself full permissions to those keys using regedit and the permissions tab for that branch.  From there you can export the keys you need to export to a safe location and then delete them and reattempt the operation.

  15. Anonymous says:

    LOL, no problem.

    Try starting the Windows Modules Installer service.  Open services.msc, find that service and right click on it.  Choose Start and you should see the hive load.

  16. Anonymous says:

    @Rahul;

    Not really.  Corruption is one of those things that just happens on PCs.  I can tell you the most common cause from what I have personally seen is dirty shutdowns.  Other causes I have seen, bad memory, bad segment on disk and malware.

  17. Anonymous says:

    Gotcha, that can happen sometimes during a servicing operation.  I wouldn't worry too much about it unless it was rampant.

  18. Anonymous says:

    Captain, correct, Windows Modules Installer is a portion of the trusted installer.

    Have fun on the trip.  When you get back, I'd like to know what you mean by you dont have the right permissions?  You should be able to modify that value unless you arent an administrator on your machine.

  19. Anonymous says:

    You could audit the directory but it could potentially get pretty busy. Was the package manifest (MUM) that was corrupted the same both times?

  20. Anonymous says:

    No problem, glad that helped.

  21. Anonymous says:

    Dude! Wow. VERY good info to know. Sheez, I really need to set up an RSS reader or something, specifically for watching this blog. Component servicing is kinda my #1 "windows to-learn list" item… I've covered pretty much everything else to date – heck, last night I found corruption in a registry key name ASCII representation caused by the guy's unstable RAM during the early days of his build. I corrected it over the INTERNET with remote control, using "reg save", a hex editor to find the offending byte (0110 0101 / "e" -> 0010 0101 / "%" = crashes Regedit mis-interpreting the "%"), and then Sysinternals "movefile" and "pendmoves" (then manually replacing SysWOW64config with System32config due to the 32-bit tools), to reboot-swap the patched registry. Best part is, it worked.

    (just a little grin-inspiring geek tale there, haha)

    But really though, CBS is smack center of my radar right now, in a good/bad way. Good in that it's extremely powerful and allows Windows to take care of itself. Bad in that a "persistent failure state" is actually possible – and not just possible, but pretty common, it seems. I'm trying to find ways to patch the holes and build/inspire the repair tools us repair geeks need to fix it! With the stuff I've learned so far, I think I'm about 30% versed in CBS internals, but the info online is so murky it's just… literally *impossible* to find some things…

    The most glaring omission I've found to date is the lack of the "logical continuation" of the component servicing model: being able to use a functioning (and online) image to diagnose and repair a non-functioning offline image from a real computer. I deployed Windows 7 to our whole 25-user office, and while DISM would've been nice to know at the time, I find it much more useful in working with functioning, live systems (existing installs), than working with deployment WIMs. The most useful tool to have, right now, would be a tool that can "create a package" using an *existing* package inside an image – that is, specifically, an "Export" function. With that exported package, I can use DISM to reinstall/repair a matching version of the component that *should* be installed in a non-functioning image/"system".

    True story: last night I thought, "WOW! HKLMSoftMSWinCVComponent Based ServicingPackages!! I can remove some of this crap from my SSD, woohoo!" Long story short (and yeah, I just deleted 2 paragraphs after realizing I'm tl;dr'ing), I nixed Client-Drivers-Package and spent 4 hours trying to find SOME way to Export the package (and dependencies) from a working system and DISM them into the one I just screwed up. No such luck. I ended up using my Windows Home Server ( 🙂 ) and in a last ditch effort to gain one last week of use out of this installation (I only reformat when I get a new PC, if I can! This one's lasted almost 8 months of daily use and geekery), I Robocopy /MIR /B'd the backup Windows folder over my b0rked one, and that's what I'm writing this on now (shockingly, flawless – though I know its hardlinks/junctions are all messed up now). Coulda probably saved it all if I'd just had a way to "un-remove" a package using a working system as a reference… :/

    … Gotta ask, though. Would you happen to have a way to keep in touch outside 10-page-long blog comments? I'm really embarassed to be TL;DR'ing your amazingly useful blog posts. And, just noticed I also nix'd the part about "how this relates and why I'm saying this here": pretty sure if I had known this CheckSUR trick, I could've used the SP1 package as the package reference, and the Microsoft-Windows-HomePremiumEdition package should notice the missing "child" package, and used SP1 to repair it. Hindsight, 20/20, etc… 🙂 But man, I would really love to share a geek-out session with you over CBS… I think I could really help a lot of people out if I just understood more of it myself!

  22. JC says:

    Thanks you so much for that.  Copying the msu to the packages directory and running checksur solved a problem I had with an update that wasn't installing properly.  Tried a ton of things and only this fixed the issue.

  23. Drewfus says:

    This is great information, and i would suggest the SURT description article could be updated to reflect this.

    support.microsoft.com/…/947821

    The following page refers to the SURT for fixing an empty Windows Features dialog.

    http://www.raymond.cc/…/fix-blank-or-empty-list-in-vista-turn-windows-features-on-or-off-optionalfeaturesexe

    Could you please comment on this page, in particular, point 7?

    Aaron Stebner links to this page, in this post:

    blogs.msdn.com/…/9303167.aspx

  24. Drewfus says:

    Joseph, is the method of adding MSU files to WindowsCheckSURpackages relatively new? I ask after finding this article:

    technet.microsoft.com/…/ee619779(WS.10).aspx

    This recommends adding *.mum and *.cat files to %windir%TempCheckSURservicing, and *.manifest files to %windir%TempCheckSURmanifests for ‘Unavailable repair files’ errors, and a more complicated fix for ‘Payload File Missing’ errors. Article dated
    Sep 2009. Are these essentially redundant methods, or is the point to avoid having to download .MSU files, or just an alternative method to that decribed in this blog?

  25. Drewfus says:

    Ok, thanks.

    What exit codes does CheckSUR return?

  26. Amy says:

    My log shows these missing packages. Since they are all the same KB, I downloaded that kb's .msu file but nothing happens. The checksur tool doesn't pick it up. 🙁

    (f) CBS MUM Missing 0x00000002 servicingPackagesPackage_3_for_KB980182~31bf3856ad364e35~x86~~6.1.1.1.mum

    (f) CBS MUM Missing 0x00000002 servicingPackagesPackage_4_for_KB980182~31bf3856ad364e35~x86~~6.1.1.1.mum

    (f) CBS MUM Missing 0x00000002 servicingPackagesPackage_for_KB980182_RTM~31bf3856ad364e35~x86~~6.1.1.1.mum

    (f) CBS MUM Missing 0x00000002 servicingPackagesPackage_for_KB980182~31bf3856ad364e35~x86~~6.1.1.1.mum

  27. Deepak says:

    Thank you so much for this. Worked for me 🙂

  28. Captainsguard says:

    SP1 for Win & 64bit fails to load.

    Check Sur reads :-

    Checking System Update Readiness.

    Binary Version 6.1.7601.21645

    Package Version 12.0

    2011-07-08 19:32

    Checking Windows Servicing Packages

    Checking Package Manifests and Catalogs

    Checking Package Watchlist

    Checking Component Watchlist

    Checking Packages

    (f) CBS Registry Error 0x80070002 Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385 failed to get Visibility

    (f) CBS Registry Error 0x80070002 Microsoft-Windows-Printing-XPSServices-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385 failed to get Visibility

    (f) CBS Registry Error 0x80070002 Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385 failed to get Visibility

    (f) CBS Registry Error 0x80070002 Microsoft-Windows-WMPNetworkSharingService-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385 failed to get Visibility

    Checking Component Store

    Summary:

    Seconds executed: 635

    Found 4 errors

     CBS Registry Error Total count: 4

    Tried Update Check and various MS checks to cure,Tried upgrade using Disk and it fails I dont want to Reinstall to cure any guidance.

  29. Captainsguard says:

    Hi

    Where do I find the keys and how do I export and where to.

    Thanks

  30. Captainsguard says:

    Hi Jocson

    In Regedit I dont see the components branch could it be hidden, the only ones I can see are BCD00000000,Hardware,SAM,Security,Software and System.

    I would like to cure myself  your help  so far has been well appreciated by a 70yr oldtecky GR8 Gdad still learning!!

  31. Captainsguard says:

    Joseph

    Windows Modules Installer I presume is the trusted installer I dont have the right permissions to open and haven't time to spend altering, I am enjoying learning and finding my way around.

    Off to Budapest to catch a cruise down the Danube to the Black Sea and her indoors won't let me take the

    PC with me.

    Thanks again catch up when I get back.

    Bob

  32. Captainsguare says:

    I  have admin rights but the permissions are read execute and read. When I double click to run it doesn't run.

  33. Captainsguard says:

    Back from hols PC been at local shop to no avail,additional info in Register edit failed installation was 6.1.7600.16385(Win 7_rtm.090713_1255)    REG-DWORD    0x00000003  (3). Traced to KB974431 update but update tells me its installed.

    Can you walk me thru to Components branch in   HKLM or Windows Module installer.

    Bob

  34. Jose Wilches says:

    I tried everything, was about to reformat, this worked!! thanks!!

    God bless.

  35. rahul says:

    I had servicing issues last month and ran chksur it fixed the problem to resurface again this month on 2k8r2 machine. On both occasions there were different MUM files that were corrupt…

    Is there a way I can know what is corrupting the MUM files?

  36. rahul says:

    Since it happened twice I was concerned… Can I setup Auditing on the winsxs folder? Would it be too heavy to log?

    Only one MUM file got corrupted on each of the instances.. Is it co-incidence or something wrong ?

  37. rahul says:

    Nope.. unfortunately different on both occasions 🙁

    Something like name did not match the expected name for different MUM files on both occasions

  38. rahul says:

    Thank you!!

  39. Jacob says:

    Hi Is there a parameter you can add when running to tell it to down load the packages form SCCM ?

    a bit like this one :

    CheckSURPackage.EXE /Quiet /WindowsUpdate /DeleteBadCab /pkgversion=9.0 /fixcab=%windir%CheckSurv1.0*.CAB /fixcab=%windir%CheckSur*.CAB /pkgdownload

    where it will use widnwdows update to get the packages, unfortunatly we cant use this one since the the servers are gpo'ed to use SCCM and dont have firewall allowence to go to microsft.com

  40. Ruud Harmsen says:

    What does the word "payload" mean in your MS jargon? I have been knowing English for about 45 years and I have worked in ICT for over 30 years, but "payload" does not mean anything to me. Can you explain?

  41. Ruud Harmsen says:

    Summary:

    Seconds executed: 5768

    Found 2 errors

    15 minutes is 900 seconds in my book.

  42. Dan_IT says:

    microsoft/john,

    can someone please respond!!!!!!!

    i've performed two fresh install/restores (didn't restore from backup as it's appears to be corrupted)  and dell has been useless so far. system will not let me update/install most of .NET framework 3.5 and 4 stuff – resulting in a number of the error codes described above:

    Code 80073712, 643, 935.

    because of this problem, i can't install the MS Office 2010 that i bought! none of the proposed solutinos haven't worked for me. please help!

  43. Dan_IT says:

    update:

    i'm only seeing these error codes: 80073712, 643. oh, just fyi – i don't have any hardware issues