Solved Corrupted System File SFC Can't Fix

[tjg79]

Hi,

System file checker revealed a corrupted file that it can't fix, because the source file in store is also corrupted. The corrupted file is slui.exe.

The text from the CBS.log file follows:

2014-07-30 20:03:10, Info CSI 0000016b [SR] Beginning Verify and Repair transaction
2014-07-30 20:03:10, Info CSI 0000016d [SR] Cannot repair member file [l:16{8}]"slui.exe" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-07-30 20:03:11, Info CSI 0000016f [SR] Cannot repair member file [l:16{8}]"slui.exe" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-07-30 20:03:11, Info CSI 00000170 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2014-07-30 20:03:11, Info CSI 00000173 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:16{8}]"slui.exe"; source file in store is also corrupted

Is it possible to copy this system file from the distribution CD to both the system folder and the source store directory?

Thanks for your assistance.

Regards

 

[Ztruker]

Open a Elevated Command Prompt like you did for sfc and run the following in sequence.

Dism /Online /Cleanup-Image /StartComponentCleanup

Dism /Online /Cleanup-Image /RestoreHealth

SFC /scannow (repeat 2-3 times if necessary till all errors are cleared)

 

[Layback Bear]

Here is a tutorial by by Brink that should be helpful.
Please read it completely first before completing it.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.ht


Are you getting any notices on your computer that you are having a activation problem for Windows 7?

Do you have all of Windows 7 Updates?

 

[tjg79]

Open a Elevated Command Prompt like you did for sfc and run the following in sequence.

Dism /Online /Cleanup-Image /StartComponentCleanup

Dism /Online /Cleanup-Image /RestoreHealth

SFC /scannow (repeat 2-3 times if necessary till all errors are cleared)

Thank you for the suggestion.

However, I get the following error 87 as seen in the text from the cmd prompt window copied below:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>Dism /Online /Cleanup-Image /StartComponentCleanup
Deployment Image Servicing and Management tool
Version: 6.1.7600.16385
Image Version: 6.1.7601.18489

Error: 87
The startcomponentcleanup option is not recognized in this context.
For more information, refer to the help.
The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
C:\Windows\system32>

Also, for the restore health command I also get error 87.

C:\Windows\system32>Dism /Online /Cleanup-Image /RestoreHealth
Deployment Image Servicing and Management tool
Version: 6.1.7600.16385
Image Version: 6.1.7601.18489

Error: 87
The restorehealth option is not recognized in this context.
For more information, refer to the help.
The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
C:\Windows\system32>

Am I doing something wrong?

Thanks for the assistance.

Regards

 

[tjg79]

Here is a tutorial by by Brink that should be helpful.
Please read it completely first before completing it.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.ht


Are you getting any notices on your computer that you are having a activation problem for Windows 7?

Do you have all of Windows 7 Updates?

Thank you for that information. I'll read it carefully.

Yes, I'm getting a pop-up window that suggests my Windows 7 Pro x64 is not genuine. When I click through the path to resolve the issue, I get the only option to buy Win 7 again. Microsoft Tech Support refuses to fix the issue unless I pay for paid support which I won't do. I'll reload the OS before I pay for support from MS.

Yes, my system is fully updated.

Thanks again for that link.

Regards

 

[Slartybart]

.....
Yes, I'm getting a pop-up window that suggests my Windows 7 Pro x64 is not genuine. When I click through the path to resolve the issue, I get the only option to buy Win 7 again. Microsoft Tech Support refuses to fix the issue unless I pay for paid support which I won't do. I'll reload the OS before I pay for support from MS.

Yes, my system is fully updated.
.....

What process are you clicking though to resolve the issue?

See: OPTION TWO in http://www.sevenforums.com/tutorials/3408-activate-windows-7-online.html
You'll need your Product License key - use the key from your product packaging or from the COA sticker on your machine.

Refer to the error codes at the end of the tutorial.

You might have to activate by phone. Call them and explain, I've never heard of the activation channel charging. They might decline to give you a new key, but...
http://www.sevenforums.com/tutorials/18715-activate-windows-7-phone.html

 

[Layback Bear]

Either you do or do not have a legal COA.
Do you have a legal COA for your computer and the operating system you have installed.

Please complete this Tutorial by Brink. It might shed some light on the problem.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

 

[Slartybart]

I'm confused:
http://www.sevenforums.com/performance-maintenance/339768-system-file-checker-errors-cbs-log.html

Maybe you're looking at this the wrong way.

See if a quick malware scan shows up anything: http://www.sevenforums.com/tutorials/339342-herdprotect-malware-detection.html
You don't need to analyze the output, please post a screen shot of the Scan results (if there are lots, just post the log in step 8.

 

[tjg79]

.....
Yes, I'm getting a pop-up window that suggests my Windows 7 Pro x64 is not genuine. When I click through the path to resolve the issue, I get the only option to buy Win 7 again. Microsoft Tech Support refuses to fix the issue unless I pay for paid support which I won't do. I'll reload the OS before I pay for support from MS.

Yes, my system is fully updated.
.....

What process are you clicking though to resolve the issue?

See: OPTION TWO in http://www.sevenforums.com/tutorials/3408-activate-windows-7-online.html
You'll need your Product License key - use the key from your product packaging or from the COA sticker on your machine.

Refer to the error codes at the end of the tutorial.

You might have to activate by phone. Call them and explain, I've never heard of the activation channel charging. They might decline to give you a new key, but...
http://www.sevenforums.com/tutorials/18715-activate-windows-7-phone.html

I've had four telephonic support calls with Microsoft Support where the tech took control of the desktop and reactivated my already activated Win 7. When I contacted the Microsoft activation team and explained the issue, they transferred the call to MS tech support each time. Additionally, MS tech support checked the system and ran a few utilities to include "sfc /scannow." I had run "sfc /scannow" several times without any issues before I contacted MS. The first Microsoft support tech, in addition to what I indicated, inspected the registry and deleted several registry keys pertaining to old antivirus programs, several folders in the programs directory and what he described as a malicious software key subsequent to his running "sfc /scannow" without issues. After the first MS tech support session, the problem reoccurred within a few hours, so I contact MS support again. When the second MS tech support rep ran "sfc /scannow" the system file checker indicated that there were corrupted files that it couldn't fix. The second MS tech support rep also ran some third party programs, because he suspected a malicious software was at play. There was no malicious software on the system. He didn't resolve the system file checker issue, because the support session ended when I lost contact the tech support rep. The third tech support rep repeated what was all ready tried before, but indicated that I would have to pay for paid support for him to run a special Microsoft utility to fix the system file checker issues. He also indicated that it was likely the activation pop-up window would happen again, but he didn't indicate why. The fourth MS tech support rep repeated most of what I already described and again insisted that I pay for paid support to run the utility to fix the system errors. He downloaded the text from the CBS.log file, but didn't reveal the specific information even after I specifically asked how to read the CBS.log file text. I pointed out that I suspected the system errors were likely a result of the actions of the first MS Support tech rep, because the system file checker didn't indicate any issues until it was run a few hours after his actions. Interestingly, the CBS.log file was deleted or cleaned of all history prior to the second MS Support tech reps actions. The fourth tech support session ended when I exceeded the number of profane words I was allowed. It was clear to me that Microsoft was trying to generate revenue for something that I felt was their responsibility to fix for free.

 

[tjg79]

Either you do or do not have a legal COA.
Do you have a legal COA for your computer and the operating system you have installed.

Please complete this Tutorial by Brink. It might shed some light on the problem.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

I've got a legal COA. MS Support tech reps verified it four times.

I think I have the problem isolated. I have a corrupted slui.exe file, both copies. This file controls activation. Although my system is already activated, I've been getting pop-up windows that indicate my copy of Win 7 is not genuine. The solution, as I see it, is to replace both copies of the corrupted file; one in the system and one in the store. The system file checker can't do it, because it relies on the store copy. If it would use the distribution CD for a store, I think it could fix the issue. Is there a way to have the system file checker restore files from the CD as was the way it was done with XP?

 

[tjg79]

I'm confused:
http://www.sevenforums.com/performance-maintenance/339768-system-file-checker-errors-cbs-log.html

Maybe you're looking at this the wrong way.

See if a quick malware scan shows up anything: http://www.sevenforums.com/tutorials/339342-herdprotect-malware-detection.html
You don't need to analyze the output, please post a screen shot of the Scan results (if there are lots, just post the log in step 8.

I don't think this is a malware issue. It may be due to some hdd failures (I'm running Intel Desktop RAID 5) and a few power outages. I'm on a APC 1500 Smart-UPS now. I highly suspect that any corrupted files are due to system crashes or possibly the actions of the first MS Support tech rep when he was deleting a few keys in my registry without backing up the registry first.

I'm running ESET Smart Security 7, Windows Defender, and SuperAntiSpyWarePro. Additionally, the second MS Support tech rep ran two third party programs: HitmanPro and RogueKiller. Both indicated no malicious software.

 

[Layback Bear]

If you post the COA log I requested we have members that can give guidance on what to do with missing or corrupted files and how to repair them.

Just a suggestion; your choice.

 

[tjg79]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE22
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-9CBQQ-CBRDX-4VBW4
Windows Product Key Hash: 4o79yMzf+5/lHKmwIiotxng2nPc=
Windows Product ID: 00371-OEM-9045181-41077
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {88569B0E-21CB-4760-A2CC-9595DA52037D}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{88569B0E-21CB-4760-A2CC-9595DA52037D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-4VBW4</PKey><PID>00371-OEM-9045181-41077</PID><PIDType>3</PIDType><SID>S-1-5-21-764048772-141219837-185285450</SID><SYSTEM><Manufacturer>INTEL_</Manufacturer><Model>DX58SO__</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>SOX5810J.86A.5600.2013.0729.2250</Version><SMBIOSVersion major="2" minor="5"/><Date>20130729000000.000000+000</Date></BIOS><HWID>92493107018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0014-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional 2007</Name><Ver>12</Ver><Val>1B16FCA35E8C714</Val><Hash>Ox0izo7MjcnLKUdV4ul5G/4OhBY=</Hash><Pid>81605-906-5273533-65430</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-451-841077-02-1033-7601.0000-2122014
Installation ID: 021892549173720063162803583281194772514004932426885526
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: 4VBW4
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 01-Aug-14 01:08:06
Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0000000000000800
Event Time Stamp: 7:30:2014 23:05
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
 
HWID Data-->
HWID Hash Current: MAAAAAMAAAABAAEAAQACAAAAAQABAAEACrYw0tpjQ0ZsQ7K6xFcOLJyfvSCmnuqC
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC INTEL DX58SO 
FACP INTEL DX58SO 
HPET INTEL DX58SO 
MCFG INTEL DX58SO 
WDDT INTEL DX58SO 
ASF! INTEL DX58SO 
SSDT INTEL SSDT PM
DMAR INTEL DX58SO 
WDTT INTEL DX58SO 
ASPT INTEL PerfTune

 

[tjg79]

If the system file checker reliably checks the slui.exe file each time, then the slui.exe file was not corrupted until after MS Support tech reps reactivated my already activated Windows 7 Pro x64. Interestingly, I haven't had a activation window pop up indicating my Windows 7 is not genuine for the past 24 hours. The system was reactivated by MS Support four times. The slui.exe file was likely corrupted during these actions. I think that my issue now is only the corrupted slui.exe file.

 

[Layback Bear]

What I see is this. I will try to find somebody that can give more help on these kinds of maters.
Post #13 log.

Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration

File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003

I went back to the ranch and requested for some help.
Hang in there it might take a while. They come from all over the globe. It's a time zone thing.

 

[tjg79]

I saw that as well. I think that is why MS Support was fixated on a malicious software issue.

I think my last clean install was about May 2013. I've upgraded some hardware that likely required a validation from Microsoft since then. I've upgraded my processor from an i7-920 to an i7-930 and I upgraded memory from 6GB to 12GB.

I had a crash a few months ago that took me multiple reboots to resolve. I can't recall what caused the crash. It was either some problems related to parity errors on my RAID 5 likely from a power failure or a power failure. I've had both and I got tired of doing a full erase on my RAID 5 one drive at a time and rebuilding to clean up damage from power failures, so I added a Smart-UPS to resolve that issue. I recall during two of those reboots seeing white text on the lower portion of a black screen that my windows wasn't genuine. But, that issue was momentary and didn't reoccur after the crash damage was resolved. I started getting the activation pop-up on Monday when one of my dual monitors failed and I switched the cable from the secondary monitor to be the new primary (only) monitor until I can recap my failed monitor. The system file checker was reporting no issues until after MS Support forced the reactivation. Perhaps the slui.exe file got corrupted when the system was reactivated when the system was reporting the system was activated, but with non-genuine Windows 7.

Thanks for the assistance.

Regards

 

[Slartybart]

Thanks tjg,

Sounds like you have a valid beef with MS, although they did help you four time without charge.
Are you certain that you spoke with MS?

What number did you call?

There are a lot of scams out there that pretend to be MS or MS authorized... I just want to make sure you're talking to the right people.

Your description tells me a few things, but then it changes. MS stated a malicious object was on your system - you say it can't be because you have scanned your machine. I don't know, I haven't seen any logs...

You also state that there might be or were disc errors due to a power surge or outage. Have you run the Seagate SeaTools on the drive?

Please follow the instructions in this tutorial:
http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html

SURT carries cabs with it, I'm not sure it has the cab with slui or if it will fix it if it does. but give it a shot.

If the compressed cab is too large for the forum, deleted the oldest persisted cabs one by one until it can be uploaded.

Other than what Layback Bear already posted re: software licensing UI - the OWM System builder license looks valid.
SFC already flagged slui as corrupt, so it's not surprising that MGAdiag reports a similar issue.

 

[Layback Bear]

Thank you Slartybart for coming to help. It is early in the mourning for you also.

Very good idea. One never knows.

There are a lot of scams out there that pretend to be MS or MS authorized... I just want to make sure you're talking to the right people.

@Bill
Could Raid 5 have anything to do with this?

 

[Golden]

Recreate the Licensing Store
1) Click Start button.
2) Type: CMD.exe into the 'Search programs and files' field
3) Right-Click on CMD.exe and select Run as Administrator
4) Type: net stop sppsvc (It may ask you if you are sure, select yes)
Note: the Software Protection service may not be running, this is ok.
5) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
6) Type: rename tokens.dat tokens.bar
7) Type: cd %windir%\system32
8) Type: net start sppsvc
9) Type: slui.exe
10) After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.

Run MGADiag again, and post the report

 

[Layback Bear]

Thank you also Colin for the help.

The forum has secret weapons hiding at the ranch and a couple have showed up to help.

I will sit back and watch.