Solved Performing SFC/SCANNOW yields inconsistent result

[angelbeats96]

Hello, I'm getting weird outcomes from sfc/scannow where I get clean results as well as getting "unable to fix corrupted files" results in no specific patterns. Whenever I run sfc/scannow between restarts I get either clean or corrupted results with no consecutive results for both of them.

To summarize the events leading up to this point:
- I've performed 20 "important" windows updates that came out on 12th of May
- Two days later, my computer froze for some unknown reason and as a result, I force restart by pressing the reset button
- Afterwards running sfc/scannow shows that there are corrupted files however it wasn't fixed
- I tried running sfc/scannow in safe mode though the result was same
- Ultimately, I used system restore to the point before I installed those updates
- Between restarts I'm still getting corrupted results though it's not consistent as I either get a clean result or a corrupt result
- Neither of them shows up consecutively

I'm not sure if the problem was caused by the update or force restart but it seems like the former is out of option as I still get corrupted results even after restoring to the point where the updates hasn't been installed yet.
In addition, I haven't performed sfc/scannow for the last week or so which it also doesn't rule out if the problem was caused by something else installing the updates or force restarting.

Taking a peek at the log shows different files corrupted where I'm also worried if there are bunch of files that has been corrupted and the sfc/scannow doesn't show all of them at once. I've attached the sfcdetails.txt so please have a look at it.

Am I in big trouble? The system runs fine with no sign of any changes but I'm paranoid about the whole corrupted results being still shown.

Thank you and I really appreciate your help.

 

[GokAy]

You say you have restored system to a previous state so not sure if this applies to you.

KB3022345 cause corruption in 2 files, and there are 2 options you can take:
- Uninstall the update
- Use the fix http://www.sevenforums.com/windows-...update-kb3022345-causing-corrupt-files-3.html Post #24

Check to see if you have the update and deal with it as above.

Unfortunately I can't help with these kind of troubles, I am sure someone will reply.

 

[angelbeats96]

KB3022345 cause corruption in 2 files, and there are 2 options you can take:
- Uninstall the update
- Use the fix http://www.sevenforums.com/windows-...update-kb3022345-causing-corrupt-files-3.html Post #24

Thanks for the reply though that update is one of the recent updates released on 12th of May.

I've restored to the point where the recent updates (including KB3022345) hasn't been installed yet so I don't think they're not the one who's causing this problem.

 

[AddRAM]

Yep, these updates are wreaking havoc with sfc, you have to make an image when sfc comes up clean, then be careful with updates.

Members are being very good about posting which exact updates are causing the issue.

I hid about 8 or 10 updates and my sfc is coming up perfect every time.

I`ve hidden any update with a description that says " Resolves issues in windows"

 

[carwiz]

Have you done any malware scans? What AV are you using?

You might also run a Disk Check and see if it repairs any disk sectors. Perhaps you have a marginal (prone to errors) disk drive.

 

[angelbeats96]

Have you done any malware scans? What AV are you using?

You might also run a Disk Check and see if it repairs any disk sectors. Perhaps you have a marginal (prone to errors) disk drive.

I'm currently using Kaspersky Total security.

That being said, I've done the followings in order:
1) By following AddRAM's advice, I installed windows security updates only and hid the other ones (i.e the ones titled "Update for Windows 7 for x64-based Systems...")
2) I ran Malwarebytes and Kaspersky scans in safe mode (scanning C drive only). Both scans shows clean results with nothing detected
3) I also ran disk check on C drive and the results were clean where it found no problem
4) Straight after check disk I ran sfc/scannow three times in a row without restarts in between:
> First and second were clean
> Third one was not clean as it reported corrupted files but not able to fix it

So yes... The problem is still there where the results are inconsistent.

 

[DavidE]

With inconsistent results, you might want to run a memory test to eliminate that as a possible cause.
It takes a long time, best to let it run overnight.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[DavidE]

I would also run the HD manufacturers test utilities to more thoroughly test the HD.

Western Digital:
WD Support / Downloads / Other Products / Data Lifeguard Diagnostic for Windows

Seagate:
SeaTools | Seagate

 

[angelbeats96]

Alright good news everyone!!! Well... the corrupted file message is still there but the main problem is gone for good.

A week ago, a random disk check was performed on C drive after certain restart despite the fact that I didn't set it up to run. After successfully running it, when I ran sfc/scannow again I'm now getting one specific corrupted file.
Most importantly, the results are always consistent as I keep getting corrupted file message for every sfc/scannow I perform on any time and date (including restarts).

Up until now, I've tried running sfc/scannow on different occasions which the results were always the same: corrupted file message with one specific files being mentioned in the log. I have attached two different sfc/scannow logs so please have a look.
As for the culprit, this has been shown in the log for every sfc/scannow:

2015-05-24 01:22:01, Info CSI 00000d58 [SR] Cannot repair member file [l:26{13}]"opera.browser" of NetFx-ASPNET_REGBROWSER_FILES, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

2015-05-24 01:22:01, Info CSI 00000d59 [SR] Cannot repair member file [l:26{13}]"opera.browser" of NetFx-ASPNET_REGBROWSER_FILES, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

2015-05-24 01:22:01, Info CSI 00000d5a [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"

2015-05-24 01:22:01, Info CSI 00000d5c [SR] Repair complete

2015-05-24 01:22:01, Info CSI 00000d5d [SR] Committing transaction

2015-05-24 01:22:01, Info CSI 00000d61 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired

I have no idea what "opera.browser" is nor if it's one of the important Windows system files. A quick search in the google suggests that it's related to a browser called Opera but I'm not quite sure how this came up as a corrupted file.
Furthermore, I have no such browser installed in my system at the moment and I also can't remember if I've installed this before when I first built this system 5 years ago.

Overall I guess the main problem of inconsistent result is gone for good, which is a good news. Though what would be my next step as of right now? Do I manually find and delete this specific file? Is this a serious issue?

Once again help would be appreciated it.

With inconsistent results, you might want to run a memory test to eliminate that as a possible cause.
It takes a long time, best to let it run overnight.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

As I've mentioned above, the main problem has been fixed for now though I will run RAM test either way to make sure everything is okay.

 

[DavidE]

Go to Control Panel > Programs and Features.
Is Opera listed in your installed programs ?
If it is, uninstall it.

Something you downloaded and installed may have installed Opera (without you realizing it).
When installing ANYTHING, we now have to pay close attention to every screen to make sure things don't sneak in.
When installing, always use the Advanced installer option, and read everything carefully.
You often have to uncheck options so unwanted goodies don't get installed on the PC by the installer default setings.

 

[angelbeats96]

Go to Control Panel > Programs and Features.
Is Opera listed in your installed programs ?
If it is, uninstall it.

Something you downloaded and installed may have installed Opera (without you realizing it).
When installing ANYTHING, we now have to pay close attention to every screen to make sure things don't sneak in.
When installing, always use the Advanced installer option, and read everything carefully.
You often have to uncheck options so unwanted goodies don't get installed on the PC by the installer default setings.

It's not listed as one of the installed programs. I'm guessing I might have installed it a few years back and deleted it, though not 100%.

Yes I should pay more attention when I install something. I always go with "recommended" installation and that seems to install unwanted programs as well.

 

[angelbeats96]

Bumping the thread for solution.

 

[carwiz]

A week ago, a random disk check was performed on C drive after certain restart despite the fact that I didn't set it up to run.

This would indicate you have a failing disk. Windows will automatically setup a disk check at next boot when it senses a faulty disk. This should be a warning to you to start looking for a new drive.

 

[angelbeats96]

A week ago, a random disk check was performed on C drive after certain restart despite the fact that I didn't set it up to run.

This would indicate you have a failing disk. Windows will automatically setup a disk check at next boot when it senses a faulty disk. This should be a warning to you to start looking for a new drive.

Even if it only happened once only? And the fact that it never happened before?

I've attached the check disk log (first result)... Although it mentions "one of the disks" it says that my C drive was scanned so I'm guessing my C drive (SSD) is the one having this problem?

 

[carwiz]

It is possible that auto-chkdsk was caused an anomaly but it's proof that Windows caught an NTFS error. These are normally caused by turning off the PC without using Windows "Shutdown" or by an electrical power interruption. Either of these should have placed a Kernel Power entry into the Event Log.

I noticed Opera showing up in one of the chkdsk logs so I wonder how you "deleted" it. Did you use Window's Uninstall or simply try to delete files? There may have been a component of Opera running at the time that wouldn't have been deleted and it caused a file error attempting some operation.

Another cause could be that you have not installed SP1 to Windows. It contained some critical updates to the HAL and the NTFS components of Windows. This is a must have!

Then there's the disk itself. I would check with the OEM and see if there's been a firmware update for it.

 

[NoelDP]

The error in the SFC log has nothing to do with KB3022345 - instead it's this...

2015-05-16 11:47:24, Info                  CSI    00000d4b [SR] Repairing 1 components
2015-05-16 11:47:24, Info                  CSI    00000d4c [SR] Beginning Verify and Repair transaction
2015-05-16 11:47:24, Info                  CSI    00000d4e [SR] Cannot repair member file [l:18{9}]"p1033.ngr" of Microsoft-Windows-SpeechRecognizerENU.ale, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

- from the 'latest' log in your first post

...or this

2015-05-24 01:22:01, Info                  CSI    00000d56 [SR] Repairing 1 components
2015-05-24 01:22:01, Info                  CSI    00000d57 [SR] Beginning Verify and Repair transaction
2015-05-24 01:22:01, Info                  CSI    00000d58 [SR] Cannot repair member file [l:26{13}]"opera.browser" of NetFx-ASPNET_REGBROWSER_FILES, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

from the second log in post #9


I wasn't aware that there were files in the ASP system directed at specific browsers! - but it'spart of the OS and nothing to do with any potential/actual install of Opera.

I'll post a fix for that last in a short while.

 

[NoelDP]

I've uploaded a file - a96aa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\a96aa
hit the enter key - if you get a 'Not Found' error try
DIR D:\a96aa
or
DIR E:\a96aa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\a96aa <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[angelbeats96]

It is possible that auto-chkdsk was caused...

Yes there were random hang which I had to restart by using reset button. I've mentioned this in my previous posts which, changed my initial problem to having this one.

Unfortunately I have no idea how I deleted/uninstalled Opera as it was long time ago.

I've uploaded a file - a96aa.zip - to my OneDrive at Noel's OneDrive
Please download and save it...

Thank you very much for the solution.

Just before I go on, I've made a "change" before seeing your post and as a result, I'm not sure if I should proceed with your solution or not.

Last night, I ran and installed Windows hotfix (KB947821) on two instances: one where I accidentally pressed "cancel" during installation and the other one being successfully installed. I can see two logs being displayed in the update history with one showing "failed" and the other one showing "successful".
Afterwards I ran sfc/scaannow and all of the sudden I'm not getting corrupted result instead I'm getting "... did not find any integrity violations." result. I ran the scan three times in a row as well as ran it between restarts/shut down which, all of them yielded same clean result. I've attached a log for these results.

All in all, I was about to post this news in the following days as I was planning to run sfc/scannow on multiple occasions to make sure if I get the original inconsistent result/consistent opera result or not.

With that being said do I go on with your fix? There's also an restore point before I installed the hotfix if necessary.

 

[NoelDP]

Interesting!
Please post the CheckSUR.log file and CheckSUR.Persist.log file from the C:\Windows\Logs\CBS folder.

 

[angelbeats96]

Interesting!
Please post the CheckSUR.log file and CheckSUR.Persist.log file from the C:\Windows\Logs\CBS folder.

I'm still running sfc/scannow time to time and all results are clean... Though I'm skeptical about corrupted opera files being gone for good.