Windows 10 Fall Creators (1709) Update Issues

John Mc · 10 Jan 2018

sorry for all the verbage but I first typed the dism command without the .exe and without spacing the parameters. It did complete successfully. Now on to chkdsk

John Mc · 10 Jan 2018

Chkdsk found nothing wrong on the c: drive which is a SSD. I had a problem with the event logger & managed to delete the log but here is a summary.
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd..
PS C:\WINDOWS> chkdsk
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
403456 file records processed.
File verification completed.
5437 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
491252 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
43899 data files processed.
CHKDSK is verifying Usn Journal...
39916936 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

243633335 KB total disk space.
136337128 KB in 201617 files.
128704 KB in 43900 indexes.
0 KB in bad sectors.
519991 KB in use by the system.
65536 KB occupied by the log file.
106647512 KB available on disk.

4096 bytes in each allocation unit.
60908333 total allocation units on disk.
26661878 allocation units available on disk.
PS C:\WINDOWS>

zbook · 10 Jan 2018

Please test all drives using this format:

C:\Windows\system32>chkdsk /x /f /r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: y
reboot

John Mc · 10 Jan 2018

4 logical processors, active mask: 15
RAM: 17051152384 bytes total

Crash Dump Analysis

Crash dumps are enabled on your computer. This system is not configured for complete or automatic crash dumps. For best results, configure your system to write out complete or automatic crash dumps. Select Tools->Crash Dump Configuration from the main menu to configure your system to write out complete memory dumps.

Crash dump directories:
C:\WINDOWS
C:\WINDOWS\Minidump

On Wed 1/10/2018 11:51:19 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\011018-4546-01.dmp
This was probably caused by the following module: rspcrash64.sys (rspCrash64+0x108B)
Bugcheck code: 0xDEADDEAD (0x0, 0x0, 0x19B223AB, 0x3C2A58ED)
Error: MANUALLY_INITIATED_CRASH1
file path: C:\WINDOWS\system32\drivers\rspcrash64.sys
product: WhoCrashed
company: Resplendence Software Projects Sp.
description: Resplendence WhoCrashed Crash Dump Test
Bug check description: This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.

On Wed 1/10/2018 11:51:19 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: rspcrash64.sys (rspCrash64+0x108B)
Bugcheck code: 0xDEADDEAD (0x0, 0x0, 0x19B223AB, 0x3C2A58ED)
Error: MANUALLY_INITIATED_CRASH1
file path: C:\WINDOWS\system32\drivers\rspcrash64.sys
product: WhoCrashed
company: Resplendence Software Projects Sp.
description: Resplendence WhoCrashed Crash Dump Test
Bug check description: This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.

Conclusion

2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.

Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

John Mc · 10 Jan 2018

i did that with my c: drive and it came back with nothing wrong so I am not going to do that again. I will however run chkdsk on my D drive. I am looking next to send the screen shots via dropbox. Bear with me as I am unfamiliar with that product.

John Mc · 10 Jan 2018

Dropbox - Screenshots

This is the link to the dropbox screenshots

John Mc · 10 Jan 2018

Here is the drive D: report

Windows PowerShellCopyright (C) 2016 Microsoft Corporation. All rights reserved.PS C:\WINDOWS\system32> chkdsk d: /x /f /rThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 34304 file records processed.File verification completed. 0 large file records processed. 0 bad file records processed.Stage 2: Examining file name linkage ... 41936 index entries processed.Index verification completed.CHKDSK is scanning unindexed files for reconnect to their original directory.Recovering orphaned file {D2E30~1 (6DA) into directory file C7.Recovering orphaned file {d2e30181-6499-4d6e-8f0a-96bf71e909e2}_OnDiskSnapshotProp (6DA) into directory file C7. 2 unindexed files scanned.Recovering orphaned file METADA~1 (6DC) into directory file C6.Recovering orphaned file metadata-2 (6DC) into directory file C6. 2 unindexed files recovered to original directory. 0 unindexed files recovered to lost and found.Stage 3: Examining security descriptors ...Security descriptor verification completed. 3817 data files processed.CHKDSK is verifying Usn Journal...Usn Journal verification completed.Stage 4: Looking for bad clusters in user file data ... 34288 files processed.File data verification completed.Stage 5: Looking for bad, free clusters ... 38624392 free clusters processed.Free space verification is complete.CHKDSK discovered free space marked as allocated in themaster file table (MFT) bitmap.Windows has made corrections to the file system.No further action is required. 312560608 KB total disk space. 157933688 KB in 30306 files. 19548 KB in 3818 indexes. 0 KB in bad sectors. 109800 KB in use by the system. 65536 KB occupied by the log file. 154497572 KB available on disk. 4096 bytes in each allocation unit. 78140152 total allocation units on disk. 38624393 allocation units available on disk.PS C:\WINDOWS\system32>

John Mc · 10 Jan 2018

Hi Zac,
Thiscompletes the set of tasks you set me.

zbook · 10 Jan 2018

1) For Ccleaner:
a) un-check memory dumps
b) un-check Windows log files
2) For system properties > performance > settings > performance options > advanced > virtual memory
a) click on change > post an image into the thread
3) For disk cleanup
a) un-check system created windows error reporting
4) For startup and recovery > system failure
a) un-check automatically restart
b) change write debugging information to automatic memory dump
5) For drive C: please repeat the chkdsk test using the switches /x /f /r
6) Uninstall Malwarebytes
7) View post #29 > please report the answers/progress with each question/step

Chkdsk /x /f /r D: report: Windows has made corrections to the file system.

Code:

ffffe382`04abe898  fffff808`7e1e1eb0Unable to load image \SystemRoot\system32\DRIVERS\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys
*** ERROR: Module load completed but symbols could not be loaded for farflt.sys
 farflt+0x11eb0
ffffe382`04abe8a0  ffff928e`34c19e40
ffffe382`04abe8a8  fffff808`7df0adef NTFS!NtfsInitializeTopLevelIrp+0x3f
ffffe382`04abe8b0  ffffbc0c`546a0400
ffffe382`04abe8b8  fffff808`004c004a
ffffe382`04abe8c0  fffff808`813848c0Unable to load image \SystemRoot\System32\Drivers\MbamChameleon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MbamChameleon.sys
*** ERROR: Module load completed but symbols could not be loaded for MbamChameleon.sys
 MbamChameleon+0x248c0

John Mc · 11 Jan 2018

Hi Zac,
The update process now reaches 90% before it conks out using the ISO file – previously it aborted at 57%.
I have now rerun the CHKDSK of drive C: and amended the Ccleaner and disk clean as requested.
I have uninstalled Malware Bytes.
I have removed the screen shots from my dropbox and will repopulate with fresh ones.
I am going to run the update once more so I have a fresh set of logfiles
In answer to your original series of questions here is the information.
The 30 crashes were not crashes but restarts.
I had a problem where my Av 500 powerline adaptors were loosing contact with the router and dropping the connection. I discovered that I needed to instigate a script to constantly send a ping to keep them active.
It was when I did this that I found that the scheduler was broken and that I had a serious problem with updates.

1) No crashes just restarts
a) No hang-ups or coloured screens
b) The computer is two years old
c) No hardware replaced
d) Yes there were problems upgrading to 1703 and I got a technician to do this for me
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd..
PS C:\WINDOWS> cd..
PS C:\> sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
PS C:\> dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.
PS C:\>

Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...

403456 file records processed. File verification completed.

5437 large file records processed.

0 bad file records processed.
Stage 2: Examining file name linkage ...

491252 index entries processed. Index verification completed.

0 unindexed files scanned.

0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Security descriptor verification completed.

43899 data files processed. CHKDSK is verifying Usn Journal...

39916936 USN bytes processed. Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

243633335 KB total disk space.
136337128 KB in 201617 files.
128704 KB in 43900 indexes.
0 KB in bad sectors.
519991 KB in use by the system.
65536 KB occupied by the log file.
106647512 KB available on disk.

4096 bytes in each allocation unit.
60908333 total allocation units on disk.
26661878 allocation units available on disk.

Chkdsk was executed in read/write mode.

Checking file system on D:
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...

34304 file records processed. File verification completed.

0 large file records processed.

0 bad file records processed.
Stage 2: Examining file name linkage ...

41936 index entries processed. Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
Recovering orphaned file {D2E30~1 (6DA) into directory file C7.
Recovering orphaned file {d2e30181-6499-4d6e-8f0a-96bf71e909e2}_OnDiskSnapshotProp (6DA) into directory file C7.

2 unindexed files scanned. Recovering orphaned file METADA~1 (6DC) into directory file C6.
Recovering orphaned file metadata-2 (6DC) into directory file C6.
2 unindexed files recovered to original directory.

0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 32 unused index entries from index $SII of file 0x9.
Cleaning up 32 unused index entries from index $SDH of file 0x9.
Cleaning up 32 unused security descriptors.
Security descriptor verification completed.

3817 data files processed. CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...

34288 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...

38624392 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

Windows has made corrections to the file system.
No further action is required.

312560608 KB total disk space.
157933688 KB in 30306 files.
19548 KB in 3818 indexes.
0 KB in bad sectors.
109800 KB in use by the system.
65536 KB occupied by the log file.
154497572 KB available on disk.

4096 bytes in each allocation unit.
78140152 total allocation units on disk.
38624393 allocation units available on disk.

The zip file is attached with logs.
The screenshots are in dropbox.
There is no encryption software.
There are no other AV programs other than Windows defender
Here is the link to the screenshots on dropbox
Dropbox - Screenshots

Windows 10 Fall Creators (1709) Update Issues

Final error log zip