Having Trouble Running "System File Checker (SFC)"!

I really need some help here, guys! What am I doing wrong? I'm unable to run System File Checker (SFC). It generates the following text no matter how I try to execute the command (paraphrasing):

• SFC is checking the integrity of your system files, this may take a few minutes....
• (pauses 2-3 seconds)
• SFC cannot run since System Recovery has repair(s) pending. Please restart the system to allow the repair(s) to complete.
• (returns control to command prompt)

I can get the exact wording if it would help. Anyway, I have one disk with two partitions, the 100MB boot partition, and a ~450GB system partition; the former is active. I've run the command using every possible switch(es). Since I'm running SPC BECAUSE Windows is not starting up fully, I obviously can't run it from within that Windows environment (Win7 Home Premium 64-bit), but I've run it from the Windows System Recovery command prompt and from a Windows retail installation DVD command prompt window. System Recovery previously stated that it believed the problem was from a driver or system file that was recently installed or became corrupt. After MANY, MANY repeated runs through System Recovery, it now says that it finds no problems and windows loads without problem - but nothing has (outwardly) changed whatsoever. I can't get to login screen, just blackness and the mouse cursor after win-logo screen. No waiting for hours or key-combination will do anything at that point.

So what am I doing wrong? One example of many incarnations of the command I have used would be: SFC /SCANNOW (or: SFC /SCANNOW /OFFWINDIR=D:\Windows /OFFBOOTDIR=C:\).

PLEASE HELP ME! I’m pulling my hair out as you read this sentence!

Thanks!

Hiyya John !

I knew someone was going to reply eventually, and I am not at all surprised that it was you that did so! I appreciate the reply! And, yes, untoward this situation very much is!


OK now, not to dispute nor disregard your recommended arsenal of software, but returning to my specific question - are you implying that SPC SHOULD HAVE worked under the conditions I mentioned, and therefore it’s your belief that SPC or one of it’s dependencies was damaged by malware or otherwise became corrupt, and that’s why it’s talking back at me in the way it is? I’m sort of weirded out that I can’t run the damn thing somehow, so I would actually welcome the notion. My remaining hope was based on pulling the HDD and hooking it up to another system via USB or preferably an available SATA port, and then executing SFC using a elevated cmd.exe window w/in the other system’s Windows 7 environment. I just have one concern about the whole idea; presently I only have a couple Win7 Pro and one Home version running, and my luck being what it is, they are all 32-bit, while the damaged system/drive is 64-bit. I don’t believe SFC “goes both ways” so to speak! I could be wrong though (Actually that’s just something I say - I’m never wrong!). Furthermore, there is no reason that I can dream up, which would have precluded it from working using my aforementioned technique(s), yet would allow it to work using this method. Can you (or anyone) offer some words of wisdom on these thoughts please!?

Now, to address your advise. CHKDSK: Done and doner. Ran it on day one of “problem” state, and it discovered nothing but one file that had a bad index, and was unrepairable. And since then I’ve run it again, and it says everything is spectacular now. You might want to take a look at my original post to get these and any other details I provided: System suddenly hangs on black screen w/mouse just prior to logon.

I have not run SUPERAntiSpyware (SAS) yet, I don’t know that they actually have a bootable version of their scanner available, but I will double check on that matter.

MBAM is installed on that system and was active up until the end. Again, I question if they have a boot-time version of their scanner. I've personally never used it if they do have such a monster. I’ll check their “other tools” section I suppose.


And ADW suffers from the same problem as the rest of them. Correct me if I’m wrong, but there appears to be a trend here! The solutions are effectively “strange loops”, They require me to load them within windows to fix windows which is just plain broke! Now if I had another 64-bit system running Windows 7, I think I could use it to scan the drive - with a big ol’ emphasis on the “if” part! I’m not sure if that was not communicated correctly on my part or an oversight on your side of the pond! Irregardless, I’m pretty much at the same place I was last night, or so it seems.

(And nope, despite your relentless promotion of Kaspersky, I do not use it presently. By the way, how exactly would I disable it, seeing as I’m unable to load windows!?...whoa, Deja Vu!)

Finally, regarding “Kaspersky’s recovery disk” I’m assuming it’s got various tools and anti-malware capabilities that execute from a WinPE framework, no? Are you suggesting it for the use of it’s anti-malware, or another purpose? I’m asking this whilst not knowing much about it. I’ll check it out momentarily...

Thanks for the post, maybe I’m missing something, but at least I’m holding onto some hope with the Kaspersky rescue disk for the moment! Any thoughts!?


(And by the way, I’ll drop you a PM later-on to talk a little more off-topic.)

I've run Kaspersky RD 10, using the most detailed powerful options available under settings (deep scan), and it located two trojans which were deleted successfully (although they've probably already unloaded their "payload" and done whatever damage they were intended to do, IMO.) Other than that one file that was called a “NotAVirus:PotentiallyIllegalSoftware”, which means it was some sort of key-generator or cracked program that was recognized as such. I removed that file, although I know what it was (nothing illegal) and located in a dormant deep sub-folder where I personal placed it many years ago. The point is that it seems unlikely related - again, IMO.

Kaspersky took 6 hours to scan <200GB!!! Geez! But I did use the 'registry explorer' s/w it included to look for obvious things that might cause the problem, and while I'm not an expert I pretty much know my way around the registry - and saw nothing suspicious.

I ran Bitdefender, (which is very slow compared to Kaspersky) and it came up empty handed, 100% clean!

The problem still persists, unchanged!

ICIT2LOL said:

I would if it were my machine be very suspicious that it loops through SFC if
that is what I am reading it as and why I suggested the scanners.

I just wanted to be sure were on the same page here, when you say "loops through", I think you understand me, that it basically starts to look like it's working for about a three seconds, then it gives the message about recovery having pending repairs, and goes back to the command prompt. It's probably just the wording, but I wanted to be clear that there was not any actual "looping", like loss of control to the program where it endlessly runs or anything like that.

ICIT2LOL said:

Now I think SAS and MBAM do have portable versions but have not tried those.

I searched the manufacturer's websites, and personally couldn't locate them. That's really the only place I would D/L it from. I probably looked right past it, so I'm not saying it's not there, only that "these ol' eyes" Couldn't locate them!

ICIT2LOL said:

Now unless I have it terribly wrong too isn't the SFC a x86 system tool? if so
it should run via a 64bit machine

I'm not sure, it's on both systems but I can't compare them according to size even since the one may be corrupted or infected. You're probably right (good call if so!), but that thought in turn leads me to wonder about another potential problem. I don't know the specifics of how SFC works, most importantly how it decides where to locate clean versions of the system files it is analyzing so that it can compare them to the system files your checking and to use for replacing those that are damaged. Windows keeps a separate copy of all these files for such purposes, so there would be a copy of the 64-bit system files on the bad system drive and a copy of 32-bit files on the 32-bit version of windows that is running on the system I hook the bad drive up to. When SFC looks for a fresh copy of a 64-bit file I would expect it goes to the ACTIVELY RUNNING SYSTEM'S system file cashe (like using "%windir%/<whatever>" - but that points to the 32-bit backed-up system files! Maybe I'm wrong, but do you follow my logic at least? If I happen to be right, I may get x86 files written over a great deal of my 64-bit system files! Even if SFC only uses the backed up system files for replacing "damaged" files without using them for comparison purposes, it might overwrite any files that are found to be damaged with the wrong version.

It could be that the /OFFWINDIR switch changes both the windows system disk that is scanned AND where it derives fresh copies from. But then it doesn't make sense that for other people having system file issues where a malware has damaged both the system file AND the backup copy on the system disk, since SFC will just copy the damaged version normally, they are told to run SFC from a command prompt in WinPE off the Windows installation DVD for their version of Windows (where the files are easily found undamaged by SFC). This seems to support my hypothesis. It MAY, or I should say I HOPE it does, check to see if the versions match either when SFC is first run or for each file possibly. Good programming habits suggest that it would do so, but not all windows programs/commands do. I honestly don't know...

By the way, did you get a chance to read my other post (URL above)? It addresses how the problem occurred (long story short, Windows updates were set to prompt me first, and one day after many months of not restarting the computer it didn't prompt me but just decided to close everything and restart to update! 64 updates later and Windows started this!)

What da'ya think?

Thanks for the help! I greatly appreciate any I can get right now!:)

KRD probably took so long because I selected all the maximum search parameters available from settings. But maybe you've taken that into account already and there is data corruption or rotten sectors!

I'll try the program/application that you've linked to. I trust it too is a bootable version, or so it seems from it's name. Thanks for the link and the idea to try the more sophisticated disk scan!

I read through the other post you mentioned, and it's interestingly close to my problem! Differences are clearly present (obviously). CHKDSK has run several times and works fine for me, and my SFC does not "freeze", and finally, my windows logo screen doesn't freeze, the black screen following it does, but with the mouse interrupt still fully functional. While I am amazed at the similarities, I've also noticed these subtle differences between many other posts that hang (or take a tremendous amount of time) at either the logo, black screen w/ or w/o mouse, the logon screen, or just after logon. I'm not sure how closely that is tied to the error's cause (especially if it's something random that's damaged). Because I've seen some that are identical to mine BUT are quickly fixed with “last known good config”, or “safe mode + restart”. Just food for thought!

I've attached what may very well be a pertinent log file, especially in light of the fact that the update was the last thing that windows did before this problem started. It only has a little bit of useful data logged towards the end (last 25%) of the file. There is at least one error condition listed, I think I found another error in there as well, but then a few lines refer to the first error as "FATAL". While I don't know all the details of what the information necessarily mean, at least enough to make it useful for me to interpret much from it, the last section of each line is a comment that is pretty readable by the average person. I know there's a line before that that lists where the entry originated (e.g.: AU=Automatic Updater) Most of the numbers are IDs like the process ID is one of them I believe, and so on. Then obviously the date is the first column and the time follows that. So this is a very short time-span, and if you recall I had 64 updates on that day (9/20/15) So only the info from like the last five or so recorded, as I understand it anyway. But, Perhaps you're already well versed in the update log, in which case I'm simply stating a bunch of superfluous information!

Please see if you can make out anything from the file. I going to try to locate the update file(s) it's referring to, especially the erroneous one! But, REALLY, what I'll do with that knowledge I'm unsure, since if the file exists What does that mean or what can I do with it? Pretty much nothing. And if it's absent what does that tell me? Did it not D/L? Did it download and then it has already been used and deleted? Has it been erased by Windows because of the error it detected? I really wouldn't know much more than I do now!

I'll let you know how the drive check goes...