System File Checker Aberrant Behaviour

In the past I've always used System File Checker ("SFC" - in this form, at an elevated Command Prompt, C:\Windows\System32>sfc /scannow) before making, and immediately after restoring, any system image backup of my C: drive using the ShadowProtect program. Reason: to ensure that there were no corrupt system files contained in the backup or created during the restore process.

My system is Win7 x64 Ultimate and Office 2010 (32-bit) with all the latest Win/Office updates EXCEPT Win7 Updates pertaining to checking your system for compatability for an upgrade to Win10 and Office updates relating to Office programs which are simply not installed on my system, such as Visio. These updates have been excluded and deliberating hidden so that they are not reoffered in subsequent Winsows/Office updates, at least with the same KB number.

As you will be aware, when SFC is working properly, and it finds no corrupt system files, it reports that there were "no integrity violations". However, when corrupt system files are found, it reports in one of two ways: either that "Windows Resource Protection found corrupt files and successfully repaired them" or that "Windows Resource Protection found corrupt files but was unable to fix some of them". In both cases you are referred to the CBS.Log file for details of the corrupt files. That file is exceedingly lengthy and difficult to decipher and, additionally, the procedure provided by Windows technical support for replacing the bad files once you have located them is both tedious and convoluted. It is far simpler just to replace a faulty backup with an earlier good backup, and this has been my practice in the past, although one I have only ever had to follow twice previously.

Lately, SFC has been misbehaving, and I suspect that it may itself be corrupt. Win7 currently seems to be working perfectly at its usual speed and all my application programs, including all components of Office 2010 Business Edition (Word, Excel, Outlook, OneNote and PowerPoint) are also functioning properly. Yet if I invoke SFC it NOW ALWAYS reports that it has found corrupt files. The first time you run it, SFC reports corrupts files, either with successful repair but equally sometimes with an inability to fix some of them. If you run SFC a second time, either immediately after the first time or even several hours later, it reports the opposite finding. Running SFC a third time reverts to the first finding, and so on and so on. Thus: found & fixed, next time found and not fixed, next time found and fixed, next time found and not fixed, etcetera etcetera. This behaviour is consistent whether or not I am also running other programs simultaneously with SFC or just SFC on its own and whether or not I have disabled my sole virus checker, ESET Smart Security.

The Windows\System32 folder contains 3 files which appear to relate to SFC, namely sfc.exe, sfc.dll and sfc_os.dll, and I have thought about replacing these with copies from a (previously successfully restored) backup. However, the Windows OS will not allow me to move them, rename them or delete them even if I am logged in as The Administrator rather than as an ordinary user albeit with administrator privileges. The OS message delivered is that I need permission from the "TrustedInstaller" to perform any of these actions. So that prevents me from replacing them with copies extracted from an earlier backup.

So my request for assistance comes down to 4 questions:

1. Do you think that I'm on the right track in suspecting that SFC is itself corrupt and its relevant files need replacing?

2. If so, have I located the correct files to be replaced?

3. Short of booting into another operating system and from there deleting and replacing the files, is there a simpler way of achieving this exercise?

4. Can anyone suggest another reason behind, and a way of fixing, the current aberrant behaviour of SFC?

Hi Andrew,
SFC was "corrupted to a degree by KB 3022345, try unistalling it. rerun sfc.

I would also advise you to run the SURT tool from this link
http://www.microsoft.com/downloads/d...3-d2c47c6fcffc
(X64)

BUT
according to your post X64 ultimate and 32 bit Office thats not possible as far as i know.
and that may be why your having a problem.

Roy

Thank you for your reply, torchwood.
KB3022345 has never been installed on my system-don't know why since it is not an update I have elected to hide. But KB3068708 (3022345's alleged replacement) was installed. Uninstalling it did not fix the problem. I then consulted Wilders Security Forums here List of Windows 7 telemetry updates to avoid | Wilders Security Forums and uninstalled two more KBs, 2952664 & 2990214. That seems to have worked but I will check again in a few days b4 marking the thread as Solved. Not sure why you suggested running SURT as that appears to apply to Win10. Can you elaborate?

Thanks Layback Bear.

I ran SFC again this morning immediately after booting my computer at the start of the day.
No problems found.

I am not sure which of the 3 uninstalled KBs I referred to in my response to Roy (torchwood) did the trick but certainly the combination seems to be working.

I really have to thank Roy once again because not only did he set me on the path to resolution by suggesting that the problem lay not with the SFC program files themselves but rather with other KB updates breaking those files, he introduced me to the whole worrying field of Microsoft's covert retrieval (stealing) of my data through its telemetry updates. This is something I can now be prepared to deal with in the future.

Well, I've now run sfc /scannow at least half a dozen times, twice after successfully restoring system image backups of my C:drive and there are no more findings of corrupt (system) files. So, it seems my problem is indeed solved.