SFC found corrupt files after Windows update - never had any before

[dave1977nj]

The same thing happened to me also. Microsoft needs to get their shit together.

 

[Urthboundmisfit]

I also checked event viewer and found:

The Cryptographic Services service failed to initialize the Catalog Database. The ESENT error was: -1305.

It was timed stamped at same time as my uninstall of KB 3004394.

I had the same error, only 1 instance. Relevant info: https://www.virtualbox.org/ticket/13677

From what I can tell, the KB3004394 update does not install a catalog file on 64-bit windows 7. It does on Windows 8.1 (C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB3004394~31bf3856ad364e35~amd64~~6.3.1.0.cat), so VBox works fine there.

The result of the missing .cat file is that VBox (nor SysInternal's SigCheck.exe for that matter) is not able to verify the authenticity of c:\windows\system32\crypt32.dll and wintrust.dll. If we cannot find any valid signature for the files, we have to assume that they have been tampered with and are forced to abort application loading. These two dlls are important for validating other components, so there is absolutely no way we can ignore this.

Until Microsoft fixes the KB3004394 update on Windows 7, the only solution is to revert/uninstall it.

 

[whs]

The culprit is kb3004394. Do a system restore to the restore point that was created before the update and 'hide'
kb3004394 next time when the updates appear (which will be pretty soon after the restore).

 

[nine9s]

Even though I uninstalled the specific update, I decided to reinstall my last image. During its update, KB3004394 was no longer offered, but the same amount of Windows Security updates for x64 were offered. So I assume MicroSOft replaced the bad update with a different one (but if people cannot update with the bad one, I am not sure what will happen to people who did get the update and do not know to uninstall it.)

 

[whs]

Microsoft pulled the KB3004394 just a couple of hours ago from their servers.

 

[klettr]

I want to say thanks to all who found that bad update

my problem started about 20h ago, when PC lost internet connection. when i tried to run troubleshoot it failed with error 0x800706f7
so i did some google-doodle and found may solutions to fix it (like CMD run, which failed to fix a found error or form "services" to set cryptographic service to automatic ,but as it happend, mine was on auto...) , but at the end all of those failed.
Somehow i stumbled on this topic and so i found a solution for my problem, just uninstalling a KB3004394 and voila, everything works well now.

Thank you all again.:grouphug:

 

[nine9s]

I want to say thanks to all who found that bad update

my problem started about 20h ago, when PC lost internet connection. when i tried to run troubleshoot it failed with error 0x800706f7
so i did some google-doodle and found may solutions to fix it (like CMD run, which failed to fix a found error or form "services" to set cryptographic service to automatic ,but as it happend, mine was on auto...) , but at the end all of those failed.
Somehow i stumbled on this topic and so i found a solution for my problem, just uninstalling a KB3004394 and voila, everything works well now.

Thank you all again.:grouphug:

Usually you can get quick solutions to widespread problems, but this was new just yesterday, so nothing was out until later in the day. So I guess everyone was grasping for straws until the problem was isolated. I am glad I found solution from others in this thread.

Also, I guess it is a lesson not to update with Windows Updates until a day or two after they first appear. I always installed them as soon as I saw them, but I think I will wait a a day or two now, and search for each one to make sure no problems. Pain and will take time on large, in number, updates, but worth the time to prevent stuff like this.

 

[HoneycombAG]

Does this affect Windows 8 updates as well?

I saw a thing that said "KB3004394", and didn't realize my system was affected, does this have to do with why my system locks up 30 seconds into logging into my desktop?

 

[Urthboundmisfit]

Does this affect Windows 8 updates as well?

No. Win 8, 8.1 & Server 2012 are (supposedly) not affected by KB3004394 and are still available for those platforms on M$ servers:
View attachment 342876

 

[ohaiman]

I think this may be apart of my problem here. IE 11 stopped working for me. My last update included KB3004394.

Here's the error messages I get:

2014-12-13 12:27:26, Info CSI 000001fa [SR] Beginning Verify and Repair transaction
2014-12-13 12:27:26, Info CSI 000001fc [SR] Cannot repair member file [l:32{16}]"explorer.exe.mui" of Microsoft-Windows-explorer.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-13 12:27:27, Info CSI 000001fe [SR] Cannot repair member file [l:32{16}]"explorer.exe.mui" of Microsoft-Windows-explorer.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-13 12:27:27, Info CSI 000001ff [SR] This component was referenced by [l:266{133}]"Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.Windows Foundation Language Pack"


2014-12-13 12:28:37, Info CSI 0000031a [SR] Beginning Verify and Repair transaction
2014-12-13 12:28:37, Info CSI 0000031c [SR] Cannot repair member file [l:32{16}]"explorer.exe.mui" of Microsoft-Windows-explorer.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-13 12:28:37, Info CSI 0000031e [SR] Cannot repair member file [l:32{16}]"explorer.exe.mui" of Microsoft-Windows-explorer.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-13 12:28:37, Info CSI 0000031f [SR] This component was referenced by [l:266{133}]"Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.Windows Foundation Language Pack"

Do you guys think it's due to the bad windows update?

 

[whs]

Absolutely. The KB3004394 threw all kinds of monkey wrenches into paeples systems. There is a new KB ending with 4777 which is supposed to fix it.

 

[NoelDP]

Those files aren't part of the update (at least not in the win8.1versions) and shouldn't be affected by the update.
Have you installed KB3024777 yet? - or uninstalled KB3004394??
If not - do one or the other (you can't do both!)

 

[ohaiman]

Those files aren't part of the update (at least not in the win8.1versions) and shouldn't be affected by the update.
Have you installed KB3024777 yet? - or uninstalled KB3004394??
If not - do one or the other (you can't do both!)

Yeah I don't see KB30044394 to delete so I guess it was written over by KB3024777.

https://i.imgur.com/PqCYmIY.jpg

My Internet Explorer won't load up for some reason. Not sure how it became screwed up at this point. I tried reinstalling it but that didn't work. I than deleted it and it installed IE 8 back on my windows once I restarted which worked fine, and than I tried updating it up to IE 11 and it says it was successful but it still doesn't work for some reason. Everything else seems to be working fine. I forgot to create a recent backup/restore point so I can't go back a day or two and restore.

 

[NoelDP]

PLease start a NEW thread in the Updates & Activation section and post the results of this...

Please follow the Windows Update Posting Instructions and post the requested data

If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)

 

[Urthboundmisfit]

FWIW, you're in good hands with "Dr." NoelDP (IMHO) follow his instrux & you'll be fine.

 

[hairycactus]

C:\Windows\winsxs\Temp\PendingRenames

...I think it has to do with "C:\Windows\winsxs\Temp\PendingRenames": This folder contained over 2000 items shortly after running the sfc /scannow command. I vaguely remember reading about a bug in Win 7's sfc "scavenge" process which sometimes does not clean up after itself resulting in "Windows Resource Protection found corrupt files but was unable" message.

My "C:\Windows\winsxs\Temp\PendingRenames" has 1792 files.

I can't find where this thread might have shifted to. What's the resolution (if any) ?

Since the week of 09 Dec 2014, I have experienced the exact same list of problems posted by OP (ie. sfc /scannow suddenly says unrepairable corrupt files, but all the CBS logs indicate 0 repairs performed & also do not say which files are corrupt, regardless of how many times sfc /scannow is run).

However, as of 21 Dec 2014, sfc /scannow suddenly showed no integrity violations, although I hadn't done anything unusual (other than backing up my data files to external HDD). Neither have I performed any Windows Update — the most recent was manually carried out on 06 Dec 2014 (ie. before the 09 Dec Black Tuesday).

My C:\Windows\winsxs\Temp\PendingRenames currently has 30,716 files (700MB in size), dating from 09 Dec 2014 night to 25 Dec 2014. Since my last sfc /scannow was done on 23 Dec 2014 (result: no integrity violations), I wonder if these "PendingRenames" files are generated by sfc /scannow ? Also, I don't suppose 30,716 pending files (& perhaps increasing every days ?) are normal. What should I do with them ?

Note:- I do not have 09 Dec 2014's KB3004394 (the pulled update) &/or KB3024777 (the hotfix) installed, because my Windows Update is turned off by default.

However, my OS is behaving as if it has KB3004394 installed. For instance, in addition to the issues described in this thread, all my Microsoft admin tools (eg. Task Manager, Event Viewer, Registry Edit, cmd.exe, etc.) have become "Unknown Publisher"; System denied access to catroot2 & Shadow Volume; System denied access to some system folders & some registry main keys; every little action prompts the UAC; can't uninstall/ repair programs; can't carry out successful system restore; bootup failure; system files & hardware drivers suddenly became corrupt or missing; some 3rd-party programs start to behave strangely or fail; can't copy most files to external HDD w/o losing file properties, etc. etc.

Meanwhile, chkdsk reveals no bad sectors or errors. My system is also verified clean by Malwarebytes & Avira anti-virus. Funnily enough, my system now has 24/7 real-time protection because I can no longer disable Avira's real-time protection since 09 Dec 2014 (reason: system is denied access to the folder concerned, & neither System or Administrator is allowed to change the permissions).

 

[NoelDP]

1700 files in PendingRenames isn't unusual - but 30,000??

I suppose I may expect it if there's been a failed attempt to install SP1, or a failed repair install - but I can't think of anything else that might generate that sort of number

is it consistent over reboots? do the dates on the files change at all?

 

[Pauly]

Could repeatedly running sfc scan in between bad update 09/12 and fix update 21/12 cause file count to rise ??

 

[NoelDP]

That's why I asked about the dates - The 1700-odd on my machine are timed at the last boot.

 

[nine9s]

Could repeatedly running sfc scan in between bad update 09/12 and fix update 21/12 cause file count to rise ??

Mine clears after a boot or two, after running SFC, to 0 files.