Fatal Error C000009A applying update operation [number] of [number]
-
Thursday, February 03, 2011 6:54 PM
I tried posting this here , since my error is with SP1 RTM, but the MVPs seemed unwilling to cooperate.
Anyway, on to the problem:
Upon restarting my computer after updating, it continues updating during boot. It works fine until it reaches the registry updates. It then throws up Error C000009A. After a few minutes, it changes to Fatal Error C000009A and hangs. I have tried system restore, but for some reason, my restore points are missing. Startup repair found no problems.
I'm running 64 bit Windows 7 with 8 GB of RAM.
I use IE 9, Chrome 10.0.648.6, and Firefox 4.0b9.
I use Comodo Antivirus
My router has a built in firewall, so there isn't one installed on the PC.
I have Spybot Search & Destroy installed, but I hardly ever use it. I also have WonderShare TimeFreeze installed.
See the other thread for more information.
Answers
-
Friday, February 04, 2011 9:47 PM
Generate a kernel dump [1] when you get it again, zip the Memory.dmp and upload the zip.
André
[1] http://support.microsoft.com/kb/969028/
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:19 PM
-
Saturday, February 05, 2011 1:54 PM boot from a LiveCD (Linux, WinPE) and backup all personal data and install Windows again.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:18 PM
-
Thursday, February 10, 2011 1:43 PM
You can also uninstall updates offline if Windows doesn't boot. But this only works for normal updates (not only GDR updates, also LDR fixes) but not for Service Packs.
Can you run the WinRE (Recovery environment - F8), run regedit, load the registry of the dead Windows, enter the settings to generate the dump and reboot and use the key combination to get the dump?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:18 PM
All Replies
-
Thursday, February 03, 2011 7:26 PM
Windows 7 SP1 RTM has not been officially released by Microsoft, so you won't get any support for it.
As to your problem, you should never attempt a Service Pack with things like anti-virus and Spybot active: they should be disabled or uninstalled before the process starts. Another possible cause is that the Registry was damaged in some way before the Service Pack was applied.
It is unlikely that you will be able to recover your system from the state it is in, so the best course might be to re-format and re-install Windows 7. When SP1 is released, you can then try again. SP1 should install without problems on a system that is reasonably clean.
Robin Walker -
Thursday, February 03, 2011 7:32 PM
Spybot was not active, and things like TeaTimer were disabled. Comodo was not running during the update.
I can edit the registry in the recovery console, so the hives are not damaged.
I reeeeeeeeeeally don't want to reformat and reinstall unless ABSOLUTELY necessary. Is there some way to identify what exactly is causing the error so I can attempt to fix it?
-
Thursday, February 03, 2011 7:46 PM
//
// MessageId: STATUS_INSUFFICIENT_RESOURCES
//
// MessageText:
//
// Insufficient system resources exist to complete the API.
//
#define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009A L)Your system has no free RAM to make the operation. Make a Clean Boot [1] and try to install the Sp1 again.
André
[1] http://support.microsoft.com/kb/929135
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, February 03, 2011 10:32 PMI have 8GB of RAM, so I highly doubt that's the problem. This happens EVERY time I try to boot Windows, so clean booting isn't the solution.
-
Friday, February 04, 2011 1:50 PMIt doesn't matter how much RAM you have. A driver can have a memory leak which uses too much kernel memory (paged or nonpaged) so that the pools reach the limits.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, February 04, 2011 5:01 PMWell, how do I fix it?
-
Friday, February 04, 2011 9:47 PM
Generate a kernel dump [1] when you get it again, zip the Memory.dmp and upload the zip.
André
[1] http://support.microsoft.com/kb/969028/
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:19 PM
-
Friday, February 04, 2011 9:49 PMHow do I do this if Windows won't boot?
-
Friday, February 04, 2011 10:13 PMCan you boot into safe mode?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, February 04, 2011 10:14 PMNope.
-
Saturday, February 05, 2011 1:54 PM boot from a LiveCD (Linux, WinPE) and backup all personal data and install Windows again.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:18 PM
-
Sunday, February 06, 2011 3:50 PM
Again, I'd like to exhaust all other options before I resort to this.
I can edit the registry thru WinPE, and I have access to all the files on the HD thru Ubuntu, which I have installed on another disk. Is this still my only option?
-
Sunday, February 06, 2011 3:59 PM
If system restore doesn't work it is the only way.Is this still my only option?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Sunday, February 06, 2011 4:10 PM
Well, I guess I'll have to . . .
I'll probably procrastinate a bit first, though.
-
Wednesday, February 09, 2011 4:49 PM
Don't wipe yet!
Boot to a Win7 Install disc. Instead of clicking "Install Now" press shift-F10. This should give you a command prompt. Find the drive letter corresponding to the windows installation on the hard disk.
[I'll provide more instructions shortly]
Hmm, it turns out you can't do a offline uninstall of SP (you can for GDRs). However, if you can share out your *.dmp files by using the above command prompt to copy them to a USB stick, I'd be happy to take a look.
-
Wednesday, February 09, 2011 11:35 PM
this is correct. Offline servicing for Service packs is not possible.Hmm, it turns out you can't do a offline uninstall of SP (you can for GDRs). However, if you can share out your *.dmp files by using the above command prompt to copy them to a USB stick, I'd be happy to take a look.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, February 10, 2011 12:51 AM
The error never made dumps, and besides, I've already deleted most of the installation. I'm about to reinstall.
- Proposed As Answer by Andre.Ziegler Thursday, February 10, 2011 2:47 PM
-
Thursday, February 10, 2011 1:04 AM
Wait, can you install updates on an offline installation? I have a laptop that won't boot in need of this update.Hmm, it turns out you can't do a offline uninstall of SP (you can for GDRs).
-
Thursday, February 10, 2011 1:16 AM
-
Thursday, February 10, 2011 1:25 AM
YOU, sir, are AMAZING.
-
Thursday, February 10, 2011 1:43 PM
You can also uninstall updates offline if Windows doesn't boot. But this only works for normal updates (not only GDR updates, also LDR fixes) but not for Service Packs.
Can you run the WinRE (Recovery environment - F8), run regedit, load the registry of the dead Windows, enter the settings to generate the dump and reboot and use the key combination to get the dump?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Marked As Answer by SwooshyCueb Thursday, February 10, 2011 9:18 PM
-
Thursday, February 10, 2011 1:58 PMAs I've said, I've already deleted most of the installation in preparation of a new install.
-
Thursday, February 10, 2011 2:47 PMok.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, February 10, 2011 3:24 PMI've just reinstalled Win7. SP1 installed fine this time.
-
Monday, February 14, 2011 10:11 AMHello Andre (All):
I'm experiencing the exact same problem described by SwooshyCueb (Error C000009A Applying update operation 118972 of 337926 - which is a registry update operation) on my Win7x64 Test System when attempting to install Win7 SP1 RTM ... I realize SP1 hasn't been officially released yet, and will be, shortly. I have created a Kernel Dump after waiting quite a long time after the error displays and I'm in the process of uploading it, here ... Unfortunately, my Restore Points were devoured in the process of attempting to install SP1 (I was able to get back to the previous restore point once, then all traces of any restore point disappeared after the 2nd attempt with the same result), so there is no way to really recover, short of an overlay install of Win7, which I'm not about to do. This is originally a WinXP SP3 System made into a Dual Booter with Win7x64 installed on an additional drive for testing... I'm aware of the "loss of restore points" issue when booting back in WinXP...
I'm determined to understand this issue, because as I can see so far, a number of people are experiencing it. The Test System is a 3 GB Laptop and I'm trying a few more things before I give up for the moment. I've never kernel debugged but I have just loaded all the necessary tools to do it. Perhaps with your assistance (or someone else on the fora), we can get to the bottom of this Error! My Win7x64 Ultimate had all updates applied before the SP1 attempt (never had a previous SP1 RC on it). I'm currently looking into whether my Virtual Memory was inadequate and/or registry size/space and/or permissions.
I can boot into the Windows Restore Cmd Window and I can access the drive via my WinXP Boot, for modifying the Registry and trying things.
... I also tried to complete the update by Safe Booting, but with a similar result: there is no display/indication that the SP1 updates are going on, but the hard disk activity is indicative of the process and the hang. I suppose if I knew how the Trusted Installer Boot operation works and where the 337926 update operations are, I could manually go in there and apply the one it's erroring on and see what happens, but that may be a little tricky to do! ... I had installed some National Instruments Software/Drivers a few months ago without any problem, but that could be gobbling up some memory/resources.
| Also, I did have all the Language Packs installed and that could have something to do with it.
Thanks for any assistance in advance and if you have any suggestions/comments, I'm listening!
(Looking right now on how I can upload the Kernel Dump File, Memory.Dmp)
| Uploaded, but I guess I need an Email Address to share it?
- Edited by Justa.User Thursday, February 17, 2011 9:16 AM
-
Monday, February 14, 2011 1:52 PMpost the link here so that John E can look at it.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Monday, February 14, 2011 4:20 PM
http://cid-a14b66c4136c1747.office.live.com/browse.aspx/Kernel%20Dump
[No longer shared, see further down for Complete Memory Dump Session]
Thanks, Andre & John E- Edited by Justa.User Wednesday, February 16, 2011 8:36 PM
-
Monday, February 14, 2011 5:56 PM
Great work, Justa.User - I appreciate the detailed background and the kernel dump!
I've redirected it to the right folks here. In the meantime, could you share out the files in %windir%\logs\cbs? Also, if you are planning on making another attempt, could you first enable a "complete memory dump"? (Instructions @ http://support.microsoft.com/kb/969028 are valid for Win7 as well). It looks like the hang is in user-mode and Win7 defaults to making a kernel-only dump. That would greatly aid our investigation.
Thanks!
John E
-
Monday, February 14, 2011 6:37 PM
Thanks & you're welcome ... I'll try to get that done in the next 24 hours and I will append this thread with the links. I only performed the Kernel Dump as per Andre's suggestion, earlier. The CBS Logs before were quite large, with all the attempts that were made and I tried to clear them and run, but got nothing in this phase of the Service Pack Install, and placed them back ... It could be due to removing them and I shouldn't have done that! ... I did save them, though, no matter what... As I recall, the same error as mentioned earlier in the thread by Andre (i.e., STATUS_INSUFFICIENT_RESOURCES ), and a few other problems, but nothing that stuck out of the ordinary or gave a definite clue why...
Yes it's a user-mode stop by me via the keyboard ... The screen just sits there with the Fatal Error showing when it occurs, flushes something to disk for about a minute or so, then sits there ... I have to force the dump. I could force the dump sooner when the error message shows (in my case, the error message shows Fatal Error right away and stays like that) ... This is not a blue screen, as it just appears to show the failed update and loops, waiting for something to happen.
- Edited by Justa.User Tuesday, February 15, 2011 9:54 AM
-
Monday, February 14, 2011 8:28 PM
yes, we need the complete dump. We need the PTE from the poqexec.exe which handles the pending.xml file which is not availabvle in the kernel dump.
The only thing i see is that the CM31 Pooltag is used heavily in the paged kernel pool (but far away from the limit):
*** Virtual Memory Usage ***
Physical Memory: 786030 ( 3144120 Kb)
Page File: \??\C:\PageFile.Sys
Current: 4194304 Kb Free Space: 4194300 Kb
Minimum: 4194304 Kb Maximum: 12582912 Kb
Available Pages: 358594 ( 1434376 Kb)
ResAvail Pages: 720586 ( 2882344 Kb)
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 33557798 ( 134231192 Kb)
Modified Pages: 1434 ( 5736 Kb)
Modified PF Pages: 1434 ( 5736 Kb)
NonPagedPool Usage: 31349 ( 125396 Kb)
NonPagedPool Max: 577537 ( 2310148 Kb)
PagedPool 0 Usage: 152116 ( 608464 Kb)
PagedPool 1 Usage: 19874 ( 79496 Kb)
PagedPool 2 Usage: 18416 ( 73664 Kb)
PagedPool 3 Usage: 18280 ( 73120 Kb)
PagedPool 4 Usage: 18384 ( 73536 Kb)
PagedPool Usage: 227070 ( 908280 Kb)
Session Commit: 0 ( 0 Kb)
Shared Commit: 42 ( 168 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 670 ( 2680 Kb)
PagedPool Commit: 227134 ( 908536 Kb)
Driver Commit: 8205 ( 32820 Kb)
Committed pages: 326363 ( 1305452 Kb)
Commit limit: 1834145 ( 7336580 Kb)
Total Private: 33478 ( 133912 Kb)
0174 poqexec.exe 33343 ( 133372 Kb)
010c smss.exe 107 ( 428 Kb)
0004 System 28 ( 112 Kb)
NonPaged Paged
Tag Allocs Used Allocs Used
CM31 0 0 100900 434270208 Internal Configuration manager allocations , Binary: nt!cm
MmSt 0 0 27755 67502880 Mm section object prototype ptes , Binary: nt!mm
SaEe 0 0 1045 34996736 UNKNOWN pooltag 'SaEe' , please update pooltag.txt
NtfF 0 0 23580 33200640 FCB_INDEX , Binary: ntfs.sys
NtFs 6 206112 130650 27895456 StrucSup.c , Binary: ntfs.sys
Ntff 10 3200 22078 27200096 FCB_DATA , Binary: ntfs.sys
FMfn 4 1216 53193 23338880 NAME_CACHE_NODE structure , Binary: fltmgr.sys
CM25 0 0 2911 14741504 Internal Configuration manager allocations , Binary: nt!cmthis tag is used for registry operations (loading hives). Do you know what this SaEe pooltag is? Do you use an AntiVirus tool which may inpact the SP installation?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Monday, February 14, 2011 9:12 PM
Forgot to mention, the \Windows\winsxs\poqexec.log would also be very helpful even if the CBS logs are gone.
Thanks!
John
-
Monday, February 14, 2011 11:27 PM
Should I attempt to trigger the Complete Dump at the point I see the Fatal Error Message displayed, or should I wait a couple minutes after that, when disk activity ends, as I did with the Kernel Dump, before?
... BTW, I had not replaced back the CBS Log file as I previously stated, and nothing new showed up during the last several tries, but that may be due to the Trusted Installer not willing to allocate a new CBS.log file? I do have the older 1/22/11 CBS.log saved now as CBS.rar and less than 8MB ... Should I place CBS.log back into the correct system folder and hope the next time I boot, that it correctly appends to it, if it attempts to log? I guess it couldn't hurt ...
... Still waiting to list the winsxs folder, here ... lol ... OK, there is the poqexec.log ... Unfortunately, I have to cycle into work now, so it'll be a number of hours before I can get all this uploaded/done ... Let me see if I can quickly up this log file, at least:
http://cid-a14b66c4136c1747.office.live.com/self.aspx/Kernel%20Dump%20Session/poqexec.log
[link no longer valid, at the moment]
-
Tuesday, February 15, 2011 4:24 AM
[...]
SaEe 0 0 1045 34996736 UNKNOWN pooltag 'SaEe' , please update pooltag.txt
[...]
Do you know what this SaEe pooltag is? Do you use an AntiVirus tool which may inpact the SP installation?
... Sorry, I missed this comment/question earlier ... SaEe is part of Symantec EndPoint Protection (SEP) (I just GOOGLEd it and came across this rather interesting link:
http://www.msfn.org/board/topic/141015-bsod-irql-not-less-than-equal/ ) for AntiVirus etc. Protection.
Before I performed the SP Install, I disabled SEP 11, but perhaps that's not good enough and I needed to uninstall it! Thank you for spotting this. Perhaps if I disable the driver? from loading, it will work ... But before I do that, let me work on the complete memory dump...
Complete Memory Dump (3GB, expanded!):
http://cid-a14b66c4136c1747.office.live.com/browse.aspx/CompleteDump
... The Dump was keyboard initiated 4 minutes after the Error displayed. Disk Activity ceased approx. 2.5 to 3 minutes after the error displayed.
CBS.log from 1/22/11:
http://cid-a14b66c4136c1747.office.live.com/self.aspx/CBS/CBS.rar
... No additions to the CBS.log occurred during the Complete Memory Dump Session.
Complete Memory Dump poqexec.log:
http://cid-a14b66c4136c1747.office.live.com/self.aspx/CompleteDump/poqexec.log
[All these links invalid for the moment - were passed on to MS for further analysis]
- Edited by Justa.User Tuesday, February 15, 2011 7:50 PM
-
Tuesday, February 15, 2011 4:10 PM
Uh-oh! Looks like one of the RAR files got corrupted during the upload. Can you compare your local MD5 sums to the below and re-upload the bad upload?
Thanks!
John
e096ad117fb107c2099ac0cc91f27805 *MEMORY.part01 (1).rar
e096ad117fb107c2099ac0cc91f27805 *MEMORY.part01.rar
5ceaece95eef2d06e2640e6fe00c9790 *MEMORY.part02 (1).rar
5ceaece95eef2d06e2640e6fe00c9790 *MEMORY.part02.rar
4ec0c8058492ee904446a194ca9d2a35 *MEMORY.part03 (1).rar
4ec0c8058492ee904446a194ca9d2a35 *MEMORY.part03.rar
d23f6ddcbf8515f21d31bba60293cded *MEMORY.part04 (1).rar
d23f6ddcbf8515f21d31bba60293cded *MEMORY.part04.rar
d3652ffb23bd3609a9beedd060750e9f *MEMORY.part05 (1).rar
d3652ffb23bd3609a9beedd060750e9f *MEMORY.part05.rar
05847fbd070df0ddd99e42952b5b5415 *MEMORY.part06 (1).rar
05847fbd070df0ddd99e42952b5b5415 *MEMORY.part06.rar
fa73a1c3aa9e6f8831dc6694b1f36d01 *MEMORY.part07 (1).rar
fa73a1c3aa9e6f8831dc6694b1f36d01 *MEMORY.part07.rar
1f8f43563cc809ca373730b7b5076b34 *MEMORY.part08 (1).rar
1f8f43563cc809ca373730b7b5076b34 *MEMORY.part08.rar
77d0981c4402112ed8b7a971ef176f7f *MEMORY.part09 (1).rar
77d0981c4402112ed8b7a971ef176f7f *MEMORY.part09.rar
6f9e7b9d2a37dc165524a046e007f305 *MEMORY.part10 (1).rar
6f9e7b9d2a37dc165524a046e007f305 *MEMORY.part10.rar
33beddd20344efd0f09b3b73891002ab *MEMORY.part11 (1).rar
33beddd20344efd0f09b3b73891002ab *MEMORY.part11.rar
0a7a525104a433ae0b11803c30f05df9 *MEMORY.part12 (1).rar
0a7a525104a433ae0b11803c30f05df9 *MEMORY.part12.rar
ef79a7de749a06dd1e6f6b9491387e62 *MEMORY.part13 (1).rar
ef79a7de749a06dd1e6f6b9491387e62 *MEMORY.part13.rar -
Tuesday, February 15, 2011 4:18 PM
Nevermind. Worked with a different file archiver!
-
Tuesday, February 15, 2011 4:35 PM
I can see from the poqexec.log this:
//
// MessageId: STATUS_SHARING_VIOLATION
//
// MessageText:
//
// A file cannot be opened because the share access flags are incompatible.
//
#define STATUS_SHARING_VIOLATION ((NTSTATUS)0xC0000043 L)74c, c0000043 , 3600, 0, MoveFile ;\SystemRoot\WinSxS\Temp\PendingRenames\7fcc99993548cb01f7090500b409c406.inetcorp.iem, \??\C:\Windows\Inf\IEM\0414\inetcorp.iem
so moving the file was not possible
and here is the c000009a error:
1cbbac7fccb65f4: 74c, c000009a , 1d0bb, 0, DeleteKeyValue ;\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-d..roperties.resources_31bf3856ad364e35_sk-sk _8e57ec8a6ce2b595\6.1, 6.1.7600.16385
So deleting a value for the Slovakian MUI fails with the error. And what I already saw was the higher CM31 pool usage which is used for Registry operation. the SaSe tag is used by the Symantec driver:
1: kd> !for_each_module s -a @#Base @#End "SaEe "
fffff880`014acdd0 53 61 45 65 b9 01 00 00-00 ff 15 69 c6 fc ff 48 SaEe.......i...H
1: kd> u fffff880`014acdd0-1
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS
SRTSP64+0x3fdcf:
fffff880`014acdcf b853614565 mov eax,65456153h
fffff880`014acdd4 b901000000 mov ecx,1
fffff880`014acdd9 ff1569c6fcff call qword ptr [SRTSP64 +0xc448 (fffff880`01479448)]
fffff880`014acddf 4885c0 test rax,rax
fffff880`014acde2 488bd8 mov rbx,rax
fffff880`014acde5 7410 je SRTSP64 +0x3fdf7 (fffff880`014acdf7)
fffff880`014acde7 4c8bc7 mov r8,rdi
fffff880`014acdea 33d2 xor edx,edx
1: kd> lmvm SRTSP64
start end module name
fffff880`0146d000 fffff880`014e2000 SRTSP64 (no symbols)
Loaded symbol image file: SRTSP64.SYS
Image path: \SystemRoot\System32\Drivers\SRTSP64.SYS
Image name: SRTSP64.SYS
Timestamp: Fri Mar 05 04:21:57 2010This must have something to do with it, but I can't answer this. John should forward this to the Sp development team. This is something I can't fix.
But Symantec is a good candidate for causing this. Before installing ServicePacks and making an InPlace Upgrade you should always completely remove any install AntiVirus tools.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Tuesday, February 15, 2011 6:33 PM... Great work, Andre ... Looks like I need to find a way to disable SRTSP64.SYS ("SaEe") (perhaps by simply renaming it?) and see if the error goes away.
-
Tuesday, February 15, 2011 6:53 PM... My RARer might be slightly newer, sorry.
-
Tuesday, February 15, 2011 6:54 PM
I've sent the complete dump to SP installer folks along with the log, but it's more likely than not that they'll confirm Andre's assessment.
Justa.User - You may want to check out http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN for removal instructions.
Andre- If you have good coding skills, you should check out
https://careers.microsoft.com/JobDetails.aspx?ss=&pg=0&so=&rw=5&jid=17182
:)
-
Tuesday, February 15, 2011 7:36 PM
John, thanks for forwarding to the SP Installer Folks and the removal link. I came across this link which I think would be better in my case:
"How to manually uninstall the Symantec Endpoint Protection client from Windows Vista, Windows 7, and Windows 2008 R2 64-bit"
http://www.symantec.com/business/support/index?page=content&id=TECH91038&locale=en_US
I'll most likely attempt to rename the driver and see what happens ... I do have a complete image backup of the drive, after this occurred, so it's no big deal...
... This seems it might be a problem with more than one AntiVirus/Suite. We all know what's gonna happen next Tuesday, right? ... Thousands? of users are gonna attempt the SP1 install off of Windows Update without uninstalling completely their AntiVirus "Stuff", and many of them will experience this.... Unless, of course, there is intervention somewhere!
| Removed SRTSP64.SYS, SRTSPX64.SYS, SYMEVENT64x86.SYS & Teefer2.sys: Still getting the Fatal Error
-
Wednesday, February 16, 2011 1:41 PM
have you completely removed Symantec or only renamed the drivers?| Removed SRTSP64.SYS, SRTSPX64.SYS, SYMEVENT64x86.SYS & Teefer2.sys: Still getting the Fatal Error
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Wednesday, February 16, 2011 2:42 PM
I'm not sure at this point if I've completely disabled Symantec ... I'm not sure I hit all the kernel drivers, yet... No, they are renamed and the registry names altered differently so that they will fail... I'm disabling them one-by-one, in the order listed ... When I do an LM debugger command in the Crash Dumps, they are not listed anymore. It's true that completely removing Symantec would be ideal, but I have not done that, yet ... or perhaps by now, I have indeed hit all the Symantec Stuff that has loaded ... Non-Kernel stuff might be running? I'm not sure I can get all of Symantec out without spending a deal of time checking carefully, right now ... I just work and come back to the machine, pound on it briefly, and let it go...
I'm triggering the dumps as soon as I see the error now, to see if that makes any difference. The dumps are also compressing smaller. Here's the latest one if you would be kind enough to take a look at it:
http://cid-a14b66c4136c1747.office.live.com/browse.aspx/CompleteDump0007
[link no longer valid, at the moment]
- Edited by Justa.User Saturday, February 19, 2011 10:50 PM
-
Wednesday, February 16, 2011 3:52 PMsorry, I'm out of ideas. Wait of a response of John and the Sp1 Team.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, February 17, 2011 7:36 PMJust tried to installa the released SP1 on my 64-bit system. Got the same error, no 3rd party antivirus (just security essentials).
-
Thursday, February 17, 2011 7:39 PMcan you also share the poqexec.log?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, February 17, 2011 7:52 PMSorry to hijack this but Andre, did you have a moment to look at my logs? I'm dying here.
-
Thursday, February 17, 2011 9:09 PM
Near the end of poqexec.log:
1cbcec8a2fab6c1: 0,0,0,CriticslPOQComplete;
1cbcec89cc49f8a: 74c,c0190003,87fe,0,MoveFile; \SystemRoor\WinSxS\Temp\PendingRenames\e4d8b7bbc6cecb01eec20500281bb013.amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e25_6.1.7601.17514_hu_hu_ab475e418d04fbb3.manifest, \SystemRoot\WinXsX\Backup\amd64_microsoft-windows-w...per-tcpip.resources_31bf3856ad364e25_6.1.7601.17514_hu_hu_ab475e418d04fbb3.manifest
In CBS.log I get an error:
Waiting for poqexec to complete...
SQM: Reporting poqexec status with status: 0xc0190003, failed file : (see above - amd64_microsoft-windows-w..per-tcpip etc)
...
Failure in poqexec.exe while processing updates. [HRESULT = 0x80071a2d - ERROR_TRANSACTION_NOT_ACTIVE]
-
Thursday, February 17, 2011 9:18 PM
Failure in poqexec.exe while processing updates. [HRESULT = 0x80071a2d - ERROR_TRANSACTION_NOT_ACTIVE]
you get a different issue.
//
// MessageId: ERROR_TRANSACTION_NOT_ACTIVE
//
// MessageText:
//
// The requested operation was made in the context of a transaction that is no longer active.
//
#define ERROR_TRANSACTION_NOT_ACTIVE 6701Lcan you share the complete cbs.log?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, February 18, 2011 4:13 AM
I had pretty much the same very frustrating problem :(
I fixed it by a crash course in DISM (that I didn't really want to have to attend ) :-
- Booting up repair or windows install DVD
- Choose langugae
- Start command prompt (Shift-F10)
- Run DISM command :- DISM /Image:<windrive:\> /Cleanup-Image /RevertPendingActions /ScratchDir:<dirname>
Before running this command I'd suggest reading up on DISM so you know what' going to happen.
- Proposed As Answer by SpatialDude Saturday, February 19, 2011 1:12 AM
-
Friday, February 18, 2011 8:36 AM
I don't have a cbs.log anymore. It was *huge* so I deletet it...
But, the problem I get is exactly the same as Swooshy... I'm not shure that the error in the poqexec.log is relevant... I deleted that file to, and I get a new one, but it's empty.
-
Friday, February 18, 2011 1:14 PMinstall the Sp1 again and share all logs from the CBS folder, all setupapi logs and the new poqexec.log
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, February 18, 2011 1:32 PM
I also had the same problem installing SP1 on a Win7 x64 system that had most of the language packs installed and Sohphos Endpoint Security and Control 9.5 running.
Halfway through applying update operations it got stuck with error C000009A.
I have already reinstalled Windows 7 from an ISO including SP1 though, so I cannot provide further diagnostics here.
- Proposed As Answer by SpatialDude Friday, February 18, 2011 11:28 PM
- Unproposed As Answer by SpatialDude Saturday, February 19, 2011 1:12 AM
-
Friday, February 18, 2011 3:21 PM
this reverts the pending actions and rolls back the SP1 installation.I had pretty much the same very frustrating problem :(
I fixed it by a crash course in DISM (that I didn't really want to have to attend ) :-
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, February 18, 2011 11:27 PM
this reverts the pending actions and rolls back the SP1 installation.I had pretty much the same very frustrating problem :(
I fixed it by a crash course in DISM (that I didn't really want to have to attend ) :-
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
I found that it did not roll back SP1.The problem appears to be that SP1 installs correctly and the final actions are to uninstall the superceeded language packs. This is part that seems to cause the problem.
Reverting the pending actions has the effect of leaving the old language packs installed and marking them "Superceeded".
Afer rebooting the SP1 completes installation and appears to be there and working properly.
-
Saturday, February 19, 2011 1:05 AM
Hello SpatialDude:
Thank you so much for the info on DISM ... I will be attempting it on my secondary hard drive copy to see if I can get my Win7x64 back, this weekend... I had all the Language Packs installed...
... It appears that the POQE is in this strange state after it's first running, before it registers the error... Subsequent runs don't create a CBS Log and only indicate that the Executor started in the POQE Log ... It runs based on some demonic set of circumstances which don't really amount to anything, but rolling thru the updates and stopping where it first had, before ... I even manually deleted the Language Key Value it complained about with the same result, as if I did nothing, not even advancing to the next update operation ... I stripped out my AntiVirus` Low Level Drivers and got the same result essentially, as if nothing happened (there was a difference seen via the display, in how the operations proceeded and the the Crash Dump Compression Size, indicating less memory being used, though). It might be a very simple fix to kicking the POQE into working correctly (like erasing/renaming some file)....
I do have my original backup after the incident occurred, to revisit the situation if new information/evidence surfaces.
I'll post back here with my results.
Results:
Using DISM was a success ... It took about 10 minutes or so in WinRE, then I rebooted. Several minutes during the boot-up, then an Auto-Shutdown (Restart) and another several minutes, then into Win7 SP1 ... I'm not sure about the additional language situation yet, but it's not a big deal for me. I had to do a lot of shoring up to get things working as before, with all the changes I made and the month of down-time.
... Once again, thanks!
-
Sunday, February 20, 2011 12:32 PM
Hi all, I've been fighting similar issues for the last few days and thanks to other contributions here got Win7 SP1 installed overnight by removing all but the system default language pack. My error was fatal error C000009A on 120954 of 353297 as it updated the registry after rebooting.
My recommended install routine to others is:
1) Check System Restore is enabled and healthy. (I've had two failed installs and system restore bought my machine back perfectly.)
2) Uninstall lnaguage packs. (This takes time!)
3) Run relevant system Update Readiness Tool from http://www.microsoft.com/downloads/en/results.aspx?freetext=kb947821+2010&displaylang=en&stype=s_basic. (This takes time, but not too much time.)
4) Run sfc /scannow from an Administrator elevated command prompt. (This takes time!)
5) Install service pack. (This is best left overnight, once you have clicked on next after system prep!)
We have just gone from Symantec Endpoint Protection 11, SEM, to Forefront EndPoint Protection, FEP. I have no issues running the service pack with FEP or Windows Security Essentials, WSE, and disabling FPE real-time scanning didn't appear to speed things up. Given my past experiences with Symantec products I would recommend a complete uninstall of these first, and then re-install after SP1 completes.
Hope this helps others. Good luck.
(PS my MVP is for unified communications and Lync, desktop OS is not my expertise so feel free to correct me as needed.)
@russelljfkirk
Grey Convergence: The knowledge to enable secure communications and collaboration.- Proposed As Answer by Russell JF KirkMVP Sunday, February 20, 2011 1:47 PM
-
Sunday, February 20, 2011 2:45 PM
I Russels solution is the best one, but not much help after the error occurs.
I tried the DISM variant, and I got the system up and running. I did not seem entirely stable, though, so I reinstalled the OS ( Windows 7 with SP1 included).
Bevare of language packs!!!! :)
-
Sunday, February 20, 2011 5:25 PM
My recommended install routine to others is:
1) Check System Restore is enabled and healthy. (I've had two failed installs and system restore bought my machine back perfectly.)
Under 1) I would put:
a) Increase the default amount of storage space allowed for Restore Points (RPs) ... I think mine was something around 8 GB with a typical RP taking a little under 4 GB? ... I bumped mine up after all of this, to 80 GB (on a 500 GB Drive). Use your own discretion, here. Also, if you are Dual/Multi Booting, make sure you protect your Win7 drive/partition from an earlier OS (like WinXP SP3) blowing away past Win7 RPs:
http://social.answers.microsoft.com/Forums/en-US/w7performance/thread/e4dac242-73e1-49fb-8ac9-6f8d14789c76
http://support.microsoft.com/kb/926185
Well done, Russell.
-
Sunday, February 20, 2011 5:42 PM
Hi SpatialDude & Justa.User,
Thank you very much for your contributions.
In my case,
- Lenovo ThinkPad W701, Core i7-920XM, 16GB RAM, C: drive free space over 100GB
- Windows 7 Ultimate x64, IE8, all Langauage Packs installed, Norton Internet Security 2011 running
and I'd encountered "Fatal Error C000009A applying update operation 118721 of 336196 (\Registry\Machine" in applying SP1.
Although I also used DISM, I might choose a wrong option at restarting PC (I chose Normal startup instead of Recovery startup) so that I encountered another C000009A error 116393 of 335590 in the second auto-restart after DISM.
At last SP1 was rolled back and my PC was back to Win 7 no-SP1. But this is not a problm for me because anyway I can use my stable PC now. ;-)
Thanks again,Hi John E,
I did not generate kernel/memory dumps in my troubleshooting but I keep CBS.log/poqexec.log of the 1st/2nd error.
If needed, I will share the zipped file in SkyDrive. Just let me know if you are interesed in.
Regards, -
Sunday, February 20, 2011 6:13 PM
I [think] Russel[l']s solution is the best one, but not much help after the error occurs.
I tried the DISM variant, and I got the system up and running. I[t] did not seem entirely stable, though, so I reinstalled the OS ( Windows 7 with SP1 included).
Be[w]are of language packs!!!! :)
... Glad you found a solution & well said!
Russell's post represents the best Preventive Solution to follow thusfar, but the DISM Post (by SpatialDude) directly answers the initial post to this thread. Both are definitely useful!
... Yes, the system coming up after the DISM "burps" quite a bit ... I think most of my hardware drivers re-established themselves in the process...
One indication that the DISM solution might work, is the output that you may see in the POQExec.Log (in my case):
1cbbac7fcd028b5: 0, 0, 0, 0, StartTime ;
1cbbac802bed6a4: 0, 0, 0, 0, CriticalPOQComplete ;
1cbbac7fccb65f4: 74c, c000009a, 1d0bb, 0, DeleteKeyValue ;\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-d..roperties.resources_31bf3856ad364e35_sk-sk_8e57ec8a6ce2b595\6.1, 6.1.7600.16385
1cbbac856697485: 0, 0, 0, 0, EndTime ;See the "CriticalPOQComplete" line before the Fatal Error entry? I imagine that's an indication that the critical pending operations have completed and it's finishing/cleaning things up...
I would also suggest invoking the following DISM command[s] before the actual one:
DISM.Exe /Image:<windrive:\> /Get-Packages
where <windrive:\> is the actual target drive (i.e., C:\ in my case in WinRE). This will list the pending packages (warning, can be long!). It wouldn't be a bad idea to then execute the command again, redirecting output to a file and saving it for later...
And I agree with your comment about the Language Packs. That appears to be where the actual problem is (as Russell's post also suggests).
.png){kind=spacer}
