sfc /scannow always find corrupt file and repaired it after 3~

SolidLove · 06 Sep 2015

Guys, thanks for the help but here I would like ask a help for my problem. Let me explain it.

At first it begins after I uninstalled some games with revo unninstaller I uninstall it using logs from install monitoring feature of revo uninstaller. but then I realize my wifi icon at the taskbar doesnt show the signal strength when I am connected to the internet.

And so I restored my computer using system restore which is failed and show errors after reboot saying that the restoration was failed to replace files at c:\windows. I try it using older restore point and end up the same but then I read about clean boot and it works I was able to restore it succesfully and my wifi taskbar icon now showing the signal strength.

But it still let me wonder if my system is at a good state so I read more and learn about sfc /scannow.
I tried it 4 times or more and it always results in "find corrupt files and successfully repaired them" (need reboot). I give the link for my cbs log file hope you guys can help me.

https://drive.google.com/file/d/0B59...ew?usp=sharing

GokAy · 06 Sep 2015

SolidLove, try re-starting the PC in between sfc scans. Run sfc 3 times in this fashion (sfc scan - restart x3).

Code:

Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.

SolidLove · 07 Sep 2015

GokAy said:

SolidLove, try re-starting the PC in between sfc scans. Run sfc 3 times in this fashion (sfc scan - restart x3).

Code:

Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.

I do restart my PC between scannow and I have already did it 4 times. Do you mean I need to do it 3 more times?
What is the cause of my problem?

GokAy · 07 Sep 2015

No, it means it is time I PM our sfc/cbs expert to let him know about your case. Lets see what he will say.

NoelDP · 07 Sep 2015

The error message quoted in post #2 is common - and simply means that the system needs to reboot to complete the repair, as a rule (which is why I always ask for a reboot prior to posting a log - at least for the first log!)

However, if it appears every time, then there is something wrong somewhere...
I think I see what's happening - the file replacements are scheduled to be done at shutdown, but for whatever reason, the system can't actually find the required instruction file.
This could be because one of the problem files is one that controls the process.

Here's the list of problem files at it currently stands...

Code:

	Line 23018: 2015-09-07 03:04:37, Info                  CSI    00000317 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:26{13}]"systemcpl.dll" from store
	Line 23021: 2015-09-07 03:04:38, Info                  CSI    00000319 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"user32.dll" from store
	Line 23024: 2015-09-07 03:04:38, Info                  CSI    0000031b [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"winver.exe" from store
	Line 23027: 2015-09-07 03:04:38, Info                  CSI    0000031d [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:26{13}]"systemcpl.dll" from store
	Line 23030: 2015-09-07 03:04:38, Info                  CSI    0000031f [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"sppwmi.dll" from store
	Line 23033: 2015-09-07 03:04:38, Info                  CSI    00000321 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"winlogon.exe" from store
	Line 23036: 2015-09-07 03:04:38, Info                  CSI    00000323 [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:18{9}]"slwga.dll" from store
	Line 23039: 2015-09-07 03:04:38, Info                  CSI    00000325 [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"winver.exe" from store
	Line 23042: 2015-09-07 03:04:38, Info                  CSI    00000327 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"slwga.dll" from store
	Line 23045: 2015-09-07 03:04:38, Info                  CSI    00000329 [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"sppwmi.dll" from store

It does have to be said that ALL of these files are ones critical to the Software Protection and Activation system - which could well imply that the installed OS is counterfeit and has been badly hacked in an attempt to get it to pass activation/validation requirements.

I'll post a fix protocol anyhow - because this one intrigues me - and we'll see how it works

Back once I manage to get my head around what needs doing!

GokAy · 07 Sep 2015

Thank you Noel for taking your time to look into this :) I will watch how the thread will evolve especially reading your comment.

Layback Bear · 07 Sep 2015

Because it intrigues Noel I will also be learking.

SolidLove · 07 Sep 2015

Wow the system has been hacked? That creeps me out, I'm about to use it for programming stuff so that's the reason I check my system is okay.
Even my friend with a pirated OS did not find any integrity violation when doing sfc /analyzenow.
So this has nothing to do with pirated OS huh?

NoelDP · 09 Sep 2015

It's too early to say what caused it - but it's definitely suspicious that 10 of the 13 affected components are from the Software Protection scheme - and the other three were from IE.

Please post the C:\windows\windowsupdate.log file.

SolidLove · 09 Sep 2015

No solutions yet? You guys still trying to figure this out?

I can't wait too long for this, I might just reinstall my OS if there is no help.

couple of days ago I saw weird things too I guess like I opened facebook and suddenly the log in email was fill with number@facebook.com which I never write or log in with it. Is this means that I have been completely hacked?

Here is my WindowsUpdate.log file