catdb cache corruption

A friend's Win 7 Home Premium machine is logging an Error a second,
complaining about checksum mismatch trying to read from (apparently) a
cache of catdb that's created at boot. There are Info messages in the
log, four of them, that indicate that the cache was constructed
successfully during boot, but a few seconds later the errors begin
getting logged.

I've tried sfc with no luck. The error message suggests it might be
hardware. Diagnostics all pass and the extra-long flavor of chkdsk
completed without reporting any problems.

The only other thing I noticed is that Windows Update seems to fail every
time it tries. The machine reports 75 pending updates but fails to
install any.

Any ideas whre to look?

Jason wrote:

A friend's Win 7 Home Premium machine is logging an Error a second,
complaining about checksum mismatch trying to read from (apparently) a
cache of catdb that's created at boot. There are Info messages in the
log, four of them, that indicate that the cache was constructed
successfully during boot, but a few seconds later the errors begin
getting logged.

I've tried sfc with no luck. The error message suggests it might be
hardware. Diagnostics all pass and the extra-long flavor of chkdsk
completed without reporting any problems.

The only other thing I noticed is that Windows Update seems to fail every
time it tries. The machine reports 75 pending updates but fails to
install any.

Any ideas whre to look?

Delete the local cache for Windows Update; see:

https://support.microsoft.com/en-us/kb/971058

I've never used that KB article. In the past, I've done it the manual
way. On the next connect to the WU site, the catalog will be built anew
so it might take longer to determine what newer updates are applicable
to your setup.

Jason wrote:
A friend's Win 7 Home Premium machine is logging an Error a second,
complaining about checksum mismatch trying to read from (apparently) a
cache of catdb that's created at boot. There are Info messages in the
log, four of them, that indicate that the cache was constructed
successfully during boot, but a few seconds later the errors begin
getting logged.

I've tried sfc with no luck. The error message suggests it might be
hardware. Diagnostics all pass and the extra-long flavor of chkdsk
completed without reporting any problems.

The only other thing I noticed is that Windows Update seems to fail every
time it tries. The machine reports 75 pending updates but fails to
install any.

Any ideas whre to look?


There's a command for verifying it at the bottom of this.

https://web.archive.org/web/20121028...integrity.aspx

Event ID 257 - System Catalog Database Integrity

esentutl /g %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

There's possibly more than one root cause.
I can see the symptoms on malware repair sites too.

HTH,
Paul

In article , says...
There's a command for verifying it at the bottom of this.

https://web.archive.org/web/20121028...integrity.aspx

Event ID 257 - System Catalog Database Integrity

esentutl /g %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

There's possibly more than one root cause.
I can see the symptoms on malware repair sites too.

HTH,
Paul


"Access Denied" when I try it - even with Admin privileges

But, I noticed something suspicious. I looked at the Update History and
found that this poor machine has been trying to install the same huge
collection of updates since last May! Pick any update number: Windows
tried to apply it hundreds of times - that goes for ALL the updates
since May. All are in Failed status save for a handful.

The first one that failed was a .Net update. Almost all subsequent
updates failed, including the .Net update which shows up too many times
to count. So I'll try reinstalling .Net to see if that changes anything.

Jason wrote:
In article , says...
There's a command for verifying it at the bottom of this.

https://web.archive.org/web/20121028...integrity.aspx

Event ID 257 - System Catalog Database Integrity

esentutl /g %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

There's possibly more than one root cause.
I can see the symptoms on malware repair sites too.

HTH,
Paul


"Access Denied" when I try it - even with Admin privileges

But, I noticed something suspicious. I looked at the Update History and
found that this poor machine has been trying to install the same huge
collection of updates since last May! Pick any update number: Windows
tried to apply it hundreds of times - that goes for ALL the updates
since May. All are in Failed status save for a handful.

The first one that failed was a .Net update. Almost all subsequent
updates failed, including the .Net update which shows up too many times
to count. So I'll try reinstalling .Net to see if that changes anything.

Try picking an update from the Microsoft web, and installing
it manually. I would expect the same symptoms, at least
in terms of the ESE database. If you cannot install an update
manually, then it's really broken.

Another example of a procedure here for the ESE NT Utility.

https://technet.microsoft.com/en-us/...(v=ws.10).aspx

Note that "net stop cryptsvc" is also part of stopping
Windows Update. The Windows Update reset procedure includes
these items...

net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc

before working in Windows Update related folders. On Windows 7,
wuauserv is the one that burns up all those CPU cycles. It
lives in a svchost.

*******

And if you need to impersonate SYSTEM to gain access,
use at.exe from an administrator command prompt window.

at.exe 17:12 reg delete "HKLM\system\somekey..." /f

If the current time is 17:11, that will schedule via
the Task Scheduler, to run "reg delete" as SYSTEM account
in one minutes time. That's for cases where Administrator
cannot change some permissions in the registry, and you think
maybe System account is required. The AT command
was available in WinXP with an /interactive option,
so you could run Command Prompt as SYSTEM. But the
later OSes consider this is a security issue, so only
non-interactive commands can be spawned that way.
The /interactive option no longer works.
For example, if you have a "recipe" to run, just
package it into a .bat and AT.exe that thing.
If there were spaces in the path name, you might
need to put double quotes around the command.

With that kind of stuff, you have to be really
careful with quoting and escape sequences, so
packaging in a .bat for any command you want
to issue, might be easier. I didn't actually
run the above example - it's just something I
could show as an example of a "non-interactive"
command. In fact, without the /f on the end, the
command tries to prompt you for permission, and
of course you're not present to type "Yes" to it :-)

But at this point, I don't know why Admin cannot
do the esentutl, so reaching for yet another hammer
may not be the right response. I'm just pointing
out, that now I have a way to do both Admin and SYSTEM
stuff. I have a way to do TrustedInstaller too,
but I'm not sharing that one, because the third-party
code isn't trustworthy (it modified something
in the administrator account). At least the
SYSTEM trick, you're still in control of your
own destiny, and no third-party tools are required.

Paul