Bugcheck code 0x00000109 after chitka/Adobe Flash HD virus removal

[Jeffesmi]

Hello,

I was going to submit a BSOD, but upon searching the forum, I found a similar incident:

http://www.sevenforums.com/bsod-hel...-error-0x00000109-driver-verifier-issues.html

Recommendations on this incident included doing a memory check, a CHKDSK /F /R and a SFC /scannow. The memory check did not show up an issue, but CHKDSK /F /R showed up with the following issue:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 5/29/2013 6:17:33 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: DECO-TIM2011.Deco-Sign.local
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
206848 file records processed.

File verification completed.
Index entries referencing file 34772 will not be validated
because this file contains too many file names.
Index entries referencing file 37182 will not be validated
because this file contains too many file names.
Index entries referencing file 37453 will not be validated
because this file contains too many file names.
Index entries referencing file 37495 will not be validated
because this file contains too many file names.
Index entries referencing file 46544 will not be validated
because this file contains too many file names.
Index entries referencing file 46643 will not be validated
because this file contains too many file names.
Index entries referencing file 46807 will not be validated
because this file contains too many file names.
Index entries referencing file 46809 will not be validated
because this file contains too many file names.
Index entries referencing file 46843 will not be validated
because this file contains too many file names.
Index entries referencing file 46887 will not be validated
because this file contains too many file names.
2959 large file records processed.

0 bad file records processed.

2 EA records processed.

139 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
262214 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
206848 file SDs/SIDs processed.

Security descriptor verification completed.
27684 data files processed.

CHKDSK is verifying Usn Journal...
35733088 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
206832 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
58595761 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

302179327 KB total disk space.
67396684 KB in 119005 files.
79816 KB in 27685 indexes.
0 KB in bad sectors.
319783 KB in use by the system.
65536 KB occupied by the log file.
234383044 KB available on disk.

4096 bytes in each allocation unit.
75544831 total allocation units on disk.
58595761 allocation units available on disk.

Internal Info:
00 28 03 00 0d 3d 02 00 e0 47 04 00 00 00 00 00 .(...=...G......
67 02 00 00 8b 00 00 00 00 00 00 00 00 00 00 00 g...............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

SFC /scannow showed up the following problems:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

I have attached the CBS.log file. Should I still go about collecting the BSOD information or try to address these issues first? I'm unsure how to track back file number to a file name in the CHKDSK log file and the one reference I was able to find for a tool to do this doesn't seem to exist anymore. As for the SFC /scannow, I'm not sure how to proceed. The basic BSOD information is:

On Tue 5/28/2013 9:11:57 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\052813-12916-01.dmp
This was probably caused by the following module: nt_fffff80000b95000.sys (0xFFFFF80000B96BB0)
Bugcheck code: 0x109 (0xA3A039D896076583, 0xB3B7465EE885A181, 0xFFFFF80000B96BB0, 0x6)
Error: CRITICAL_STRUCTURE_CORRUPTION
Bug check description: This indicates that the kernel has detected critical kernel code or data corruption.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_fffff80000b95000.sys .
Google query: nt_fffff80000b95000.sys CRITICAL_STRUCTURE_CORRUPTION

This was gathered by WhoCrashed utility.

Thanks,

Jeff

 

[VistaKing]

jeffesmi

Do you still have the virus ? When you restart the PC and tap F8 on the keyboard do you see Repair Your Computer inside Advanced Boot Options ?

 

[Jeffesmi]

As far as I can tell the virus is completely removed. I found a specific removal procedure and did the entire thing. I do not see any of the events that let me know there was a virus on the computer at this time. My best guess is that something has been corrupted. I have not tried startup repair because the system starts fine. It runs anywhere from 5 minutes to a couple of hours before it BSODs and restarts. I'll have to be onsite for a startup repair and that could be a couple of days before I'm there. Do you think running startup repair is worth the effort?

 

[VistaKing]

If possible upload the dmp files . Tutorial below

:ar: http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

:ADDED:

I sent a PM to tom982 to take a look at your CBS log .

 

[Jeffesmi]

Also, of note, the file listed in the dump report nt_fffff80000b95000.sys does not appear to exist on the computer and is not referenced in the registry. I'm hoping that there is a way to track back the file number in the chkdsk output to an actual file. Maybe the file(s) listed in chkdsk output is the file(s) that is giving me problems:

Index entries referencing file 37495 will not be validated <== How do you trace this back to an actual file name?
because this file contains too many file names.

 

[VistaKing]

If you take a look at the Post #4 and take a look at the tutorial to upload the dmp files and other files needed to troubleshoot your issue . Someone will take a look at your dmp files .

 

[Jeffesmi]

Here it is. Please note that upon completion of the SF tool, I got the following error:

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.IO.FileNotFoundException: Could not find file 'C:\Windows\msinfo32.nfo'.
File name: 'C:\Windows\msinfo32.nfo'
at Microsoft.VisualBasic.FileIO.FileSystem.CopyOrMoveFile(CopyOrMove operation, String sourceFileName, String destinationFileName, Boolean overwrite, UIOptionInternal showUI, UICancelOption onUserCancel)
at Microsoft.VisualBasic.FileIO.FileSystem.CopyFile(String sourceFileName, String destinationFileName, UIOption showUI, UICancelOption onUserCancel)
at Microsoft.VisualBasic.MyServices.FileSystemProxy.CopyFile(String sourceFileName, String destinationFileName, UIOption showUI, UICancelOption onUserCancel)
at SF_Diagnostic_Tool.Form1.Button1_Click(Object sender, EventArgs e)
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4984 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
----------------------------------------
SF Diagnostic Tool
Assembly Version: 5.0.0.6
Win32 Version: 5.0.0.6
CodeBase: file:///C:/Users/tim/Downloads/SF_Diagnostic_Tool.exe
----------------------------------------
Microsoft.VisualBasic
Assembly Version: 8.0.0.0
Win32 Version: 8.0.50727.4927 (NetFXspW7.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
----------------------------------------
System
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4985 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4986 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4985 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Runtime.Remoting
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

Thanks,

Jeff

 

[Jeffesmi]

It's 2am here, and I'm exhausted. Thanks for looking at this. This is one of those new class of machines that don't come with an actual Windows installation disk, rather a restore partition. Whose brilliant idea was that?!?! I'll call HP to see about ordering a real OEM Windows 7 Install disk in case it is needed. Unfortunately, this machine has some customization including an application that is running in Windows XP Virtual Mode that took hours and hours to get tweaked so it would work correctly. I've got to fix this thing one way or another.

Thanks,

Jeff

 

[tom982]

Hi Jeff, welcome to SevenForums!

Your CBS log shows the following files are not corrupt, but missing:

2013-05-28 17:31:43, Info                  CSI    00000335 [SR] Repairing 6 components
2013-05-28 17:31:43, Info                  CSI    00000336 [SR] Beginning Verify and Repair transaction
2013-05-28 17:31:43, Info                  CSI    00000337 [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office.Resources, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:43, Info                  CSI    00000338 [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:43, Info                  CSI    00000339 [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033a [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033b [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033c [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000033d [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office.Resources, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:44, Info                  CSI    0000033e [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:44, Info                  CSI    0000033f [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000340 [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000341 [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000342 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000343 [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000344 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000345 [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000346 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000347 [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000348 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000349 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034a [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034b [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034c [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034d [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034e [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034f [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000350 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000351 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000352 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000353 Repair results created:

I'm going to be late for work at this rate, so I'll have to post a fix for this when I get back


Tom

 

[tom982]

Also, just noticed the manifest error in your CBS log. Can you download and install the System Update Readiness Tool please:

Download System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [May 2013] from Official Microsoft Download Center

When finished, post the log:

C:\Windows\Logs\CBS\CheckSUR.persist.log

Tom

 

[Jeffesmi]

Here is the requested log. Also, for the missing office_??.bin files, I have the installation file for Microsoft office on the computer. How would I fix these? Just uninstall and re-install office, or would I have to extract the files to a specific location?

Thanks,

Jeff

 

[tom982]

Hi Jeff,

While the files are named office_**.bin, they aren't actually to do with Office and are actually Windows files, so reinstalling Office won't do a thing I'm afraid. This, however, will


SFCFix Script


Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
3. Save any open documents and close all open windows.
4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
6. SFCFix will now process the script.
7. Upon completion, a files should be created on your Desktop: SFCFix.txt.
8. Copy (Ctrl + C) and Paste (Ctrl + V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/16537616/Fixes/SFCFix/Scripts/Jeffesmi/SFCFix.zip


After you have run this fix, I would also like you to run the System Update Readiness Tool again, as well as another sfc /scannow command, then zip up your CBS folder and post it here please


C:\Windows\Logs\CBS

Tom

 

[Jeffesmi]

I tried the above actions and got this error:

C:\Users\tim\Desktop\SFCFix.exe

The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

I've included a jpg screen shot of the message. I've also included the first two event viewer errors about this issue.

Thanks,

Jeff

 

[tom982]

Hi Jeff,

Thanks for the screenshot, it is very helpful. Can you install the C++ 2005 redistributable:


Download Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) from Official Microsoft Download Centre


Then try again please.


Tom

 

[Jeffesmi]

Did not work

Hi Tom,

I installed VC++ 2005 on the system and got the same error message as above. The screenshot message is exactly the same and the event viewer messages are the same except times and location run from. I noticed that Visual C++ 2010 x86 & x64, Visual Studio 2010 Tools for Office Runtime x64, .Net Framework 4 Extended and .NET Framework 4 Client Profile were installed. I uninstalled ALL versions of C++ and the .NET components above. I then reinstalled Just the C++ you listed, rebooted, and ran SFCFix. The SFCFix program errored out exactly the same. I then reinstalled all of the components I removed:

Visual C++ 2010 x86
Visual C++ 2010 x64
Visual Studio 2010 Tools for Office Runtime x64
Microsoft .NET Framework 4 Client Profile (dotNetFx40_client)
Microsoft .NET Framework 4 Extended (dotNetFx40_Full_x86)

I tried running SFCFix again with the same results. I am going to rerun the System Update Rediness Tool and post the results in case you need them. What else should I do?

Thanks,

Jeff

 

[Jeffesmi]

I'm uploading the SFDiagnostics zip and the CheckSUR.persist.log in case they will be helpful. I reran both.

Thanks,

J

 

[tom982]

Hi Jeff,

Sorry for the late reply, I'm away for the long weekend and haven't found much time to get online but I've got a few minutes now so I wanted to pop in quickly.

Can you try installing this update for the C++ 2005 redistributable:

MS11-025: Description of the security update for Visual C++ 2005 SP1 Redistributable Package: June 14, 2011

Then repeat the SFCFix instructions please.

Tom

 

[Jeffesmi]

I downloaded the x86 version of the listed update to update the x86 version of C++ that the earlier link led me to and had the same problem. For grins as I noted that both the x86 and x64 versions of C++ 2010 were installed, I downloaded the newest x64 update to C++ 2005, "Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update" and I was then able to run the fix. Below is the resultant log file. Just to see the results, I'm going to launch SFC /scannow and assuming it errors out, I will post the log files in case anything has changed.

SFCFix version 1.5.5.0 by niemiro.
Start time: 2013-06-06 04:29:53.555
Using .zip script file at C:\Users\tim\Desktop\SFCFix.zip




PowerCopy::
Successfully  took permissions for file or folder  C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_044b40f52e1f47e1
Successfully  took permissions for file or folder  C:\Windows\winsxs\amd64_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_8e76e0a23a969708
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_a82ca57175c1d6ab
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_16.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_24.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_32.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_48.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_16.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_24.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_32.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_48.bin
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\ncpa.cpl
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\netshell.dll
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\NetworkConnectionsFolder.ptxml
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e
Successfully  took permissions for file or folder  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\pnidui.dll

Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_044b40f52e1f47e1\offFilt.dll.mui  to  \\?\C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_044b40f52e1f47e1\offFilt.dll.mui.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\amd64_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_8e76e0a23a969708\offfilt.dll  to  \\?\C:\Windows\winsxs\amd64_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_8e76e0a23a969708\offfilt.dll.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_a82ca57175c1d6ab\offFilt.dll.mui  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_a82ca57175c1d6ab\offFilt.dll.mui.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2\offfilt.dll  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2\offfilt.dll.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_16.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_16.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_24.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_24.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_32.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_32.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_48.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_48.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_16.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_16.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_24.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_24.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_32.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_32.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_48.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_48.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\ncpa.cpl  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\ncpa.cpl.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\netshell.dll  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\netshell.dll.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\NetworkConnectionsFolder.ptxml  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\NetworkConnectionsFolder.ptxml.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_16.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_16.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_24.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_24.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_32.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_32.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_48.bin  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\office_48.bin.
Successfully  copied file  \\?\C:\Users\tim\AppData\Local\niemiro\Archive\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\pnidui.dll  to  \\?\C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\pnidui.dll.

Successfully  restored ownership for  C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_044b40f52e1f47e1
Successfully  restored permissions on  C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_044b40f52e1f47e1
Successfully  restored ownership for  C:\Windows\winsxs\amd64_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_8e76e0a23a969708
Successfully  restored permissions on  C:\Windows\winsxs\amd64_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_8e76e0a23a969708
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_a82ca57175c1d6ab
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_en-us_a82ca57175c1d6ab
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_16.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_16.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_24.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_24.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_32.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_32.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_48.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\bench_48.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_16.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_16.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_24.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_24.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_32.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_32.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_48.bin
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\house_48.bin
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\ncpa.cpl
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\ncpa.cpl
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\netshell.dll
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\netshell.dll
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\NetworkConnectionsFolder.ptxml
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\NetworkConnectionsFolder.ptxml
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e
Successfully  restored ownership for  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\pnidui.dll
Successfully  restored permissions on  C:\Windows\winsxs\x86_microsoft-windows-netshell_31bf3856ad364e35_6.1.7600.16385_none_d559c0f66f5e5e9e\pnidui.dll
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 1.5.5.0 by niemiro has completed.
Currently storing 17 datablocks.
Finish time: 2013-06-06 04:29:56.571
----------------------EOF-----------------------

 

[Jeffesmi]

The CBS.LOG file from the SFC /scannow is attached. Here is the message from the run:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

 

[Jeffesmi]

I really think sleep is overrated, so I started looking into the chkdsk problem. I downloaded "Runtime's DiskExplorer for NTFS" and followed the directions from the post: Locating a file on an NTFS partition via the file number given by chkdsk... - Ars Technica OpenForum . It identified the first file 34772 as aepic.dll which resides in c:\windows\winsxs\windows-a..rience-program-data_31bf3856ad364e35_6.1.7601.17514_none_cf8e57a399a81456 . I would be tempted to make a copy of this file, delete the original and then rename the file to original name, but if I remember correctly you were working in the winsxs directory with your script and I don't want to mess anything up. I didn't identify the remaining files as the computer decided to reboot as I was collecting this information and I find myself at 2am in the morning again... so so tired. Hope this helps.

Thanks,

Jeff