Solved Repairing corrupt files found by SFC

[Rob James]

Gentlemen, I'm a new member, so if this is posted in the wrong section please feel free to move it. I'd like to ask the help of a Member here, Tom982, but I can't figure out how to PM in this Forum. But help from anyone would be most graciously accepted.
So here's the problem in a nutshell, I'm unable to update my Win 7 64-bit to SP1. I have tried ALL the methods outlined on Microsoft's website. I've even downloaded the ISO Image of (KB976932) burned it to DVD and tried to update from the DVD in Safe Mode with Networking. Nothing works!
So from reading another post about this issue, on this Forum, I saw that Tom982 outlined a method to create a CBS.log on my desktop, because SFC reports that I DO have corrupt files that it can not fix. I've created that log and have rarred it up. I'll be attaching it to this post. I also attached the unrarred text file in case someone doesn't have WinRar.
I'm really at a loss as to how to fix this issue, I've been at it for days now, and was about to give up when I came across this website. Hopefully someone will answer the call, but I warn you this is a real tough one. Well seemingly so for me, and the CBS log is long. Still I hope someone will come to my rescue. Re-installation of Win 7 is not an option. Thanks for taking the time to read this.

Rob,

 

[ICIT2LOL]

Hello and welcome Rob now mate the rules are that usually one has to have a certain number of posts already to PM someone but just a by the by from me why is a clean install not an option?? because if you have the activation code for the Windows (you must have used an OEM copy or bought a key for Windows) on your machine you can get a legitimate ISO from Microsoft now for all Windows version and the beauty of that is that they come with SP1!!?

One way to find your key - if you have lost it is to read this and use Option and/or 2 both will give you the key that is tied to your board.

Edit Sorry forgot to link the tutorila and I am sure Brink could advise on what to do as well he is brilliant.
Product Key Number for Windows 7 - Find and See

 

[derekimo]

Gentlemen, I'm a new member, so if this is posted in the wrong section please feel free to move it. I'd like to ask the help of a Member here, Tom982, but I can't figure out how to PM in this Forum.

Welcome to the forum,

Yeah, as ICIT2LOL pointed out you need to have a little time and posts before you can PM.

I PM'ed Tom for you, he hasn't been here in a few weeks so it might not be right away.

 

[ICIT2LOL]

Well I thought I was right as Derek has pointed out but I would like to know what the go is with the clean install??

 

[torchwood]

Hi Rob,
If your specs are correct >> OFFLINE <<,
Then the only updates you will get them are from DVD/USB input.
Service pack 1 has specific requirements BEFORE it can be installed, including other updates
Access Denied
(ignore the tiltle above its a link to MS SP1 requrements)

You will also find a WindowsMain log on your system, its like the CBS but purely for SP1.
You CANNOT install updates in safe mode WMI/WU are NOT enabled, thats why the CBS is so large
Copy/paste the details (zip not rar please)

Roy

 

[Rob James]

Ok, to answer your questions, yes I could re-install Win 7 if I had to, I have my disc and activation code. That is not the issue. I should have said I don't want to re-install Windows because my offline computer is a Custom built machine that I built specifically for high-end Audio and Video Production. With all my software tweaked and integrated with all my Studio Hardware. It would be a nightmare to have to re-install everything and tweak it, so it's all running as one integrated machine again. That said, I will, if I have to............just don't want to! So I'm hoping to fix this.
I'm not a newbie to computers, I've built my own custom boxes for well over 20 years. So usually there is no problem I can't troubleshoot or repair. But this is new territory for me. When I built this machine I installed 16 gigs of RAM that turned out to be faulty. That RAM was returned to the Manufacturer for replacement. It corrupted data on a few of my Hard Drives that I am in the process of repairing. Consequently it seems to have corrupted Windows files on my C: Drive. I need to update my Win 7 64-bit, to SP1, to install a specific Video Editing add-on. So I connected my normally Offline computer to the net to update it, that's when I discovered I couldn't update Windows in the normal fashion. Which led me to discover, by reading error codes, that I had corrupted files that weren't allowing me to update Windows. This is what has brought me here to you, seeking help. Derekimo, thanks so much for PM'ing Tom for me, he seems to have the expertise I'm looking for. I really do appreciate you taking the time to contact him on my behalf. Your kind gesture has not gone unnoticed. Thank you so much!!

Rob,

 

[torchwood]

Hi Rob,
You can run these 2 progs, no internet required,
from an elevated command mode
sfc /scannow
chkdsk /f /r

Did you read the link, "access denied"
It lists the pre-requisite updates before SP1 can be installed, note if you view the WindowsMain log before you post it, it will report if they are missing.

Roy

 

[Rob James]

Roy, thank you for continuing to offer advice, it's appreciated. Yes, I'm familiar with sfc /scannow that's how I discovered I had corrupt files that it, could not fix. I'm very familiar with chkdsk as well. Yes, I read all the prerequisites in the link you gave, and followed those to a tee, windows is still not updating in the normal fashion. Next I'm going to try WSUS and see if that gets around whatever the hell is going on here. A virus check yielded no negative results, so I really don't understand what's going on here. But I'm certainly going to get to the bottom of this.

Rob,

 

[Rob James]

Well I'm starting to suspect, a hitherto undiscovered virus, because something is very odd here. I'll outline my reasoning below.
I ran WSUS update as a last ditch effort to upgrade my existing install to SP1. It ran through it's process with very few warnings, and did update some things. But it did NOT update to SP1. I can produce that log if anyone is interested? The two warnings in the log were, "download of mkiosf failed" and "Integrity database .. \client\md\hashes-wsus.txt not found."
Once I noticed that it hadn't updated to SP1 I tried to run the Windows Updater. I let it run for over 2 hours. It installed one small update (KB3163589) then it tried to install "Malicious Spyware Removal Tool" and failed on multiple attempts. This is why I started to suspect a virus.
Next I re-booted, and was greeted with the "You are running an out of date version of Win 7" would you like to update to Win 10 or Win 7 SP1. I chose update to Win 7 SP1. Upon re-boot it takes my Browser to Microsoft's "Update to Win 7 SP1 page", from there I choose download (KB976932) It thanks me for downloading, but NOTHING ACTUALLY DOWNLOADED!! So now I'm really starting to suspect a virus.
So I installed Firefox and went to the same site, and the download was successful. So I ran (KB976932). Now here's where it gets really weird. It says it's computing space for the install, but when it's finished, it wants to direct the install to my H:\Symbols\ How weird is that? Very suspicious if you ask me.
So what I'd like to try, is to direct it to the proper folder and see if that works. Does anyone know where this update is supposed to go? Other than that I'm out of ideas. I've never come across anything like this, ever. If anyone else has, please let me know.
BTW, I have tried the Stand Alone Update Tool too, to no avail. It seems to me something in my computer is determined to stop the update to SP1.

@Roy, chkdsk /f /r reports C: The Volume is clean, but it said that drive is locked (whatever that means) and has to perform the operation on re-boot.
sfc /scannow reports corrupt files it can not fix, details in CBS.log above.

 

[torchwood]

Hi Rob,
Think your suspsicions are correct, locked drives are a common feature of certain virus's.
Doing some checking back shortly.

Roy

 

[torchwood]

Hi Rob,
Update

In my UNeducated opinon you have been badly infected.
I am NOT a security cleaning expert.
For a more expert analysis and clean up would you mind opening a thread at BleepingComputers,
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help - Virus, Trojan, Spyware, and Malware Removal Logs
They are very good but overworked.

XREF this thread as well, the more info the better.

Roy

 

[Rob James]

Thanks for your feedback Roy. This is one really sophisticated virus, because even virus scans don't find it. Here's some of the things I tried, since my last post, and resulting error codes.
I tried deleting all the contents of C:Windows/SoftwareDistribution folder, as per MS's site. Those deleted once. Then I ran the Windows Update. Didn't work. Now I can't even delete those contents anymore.

Then I tried running SP1 update from a DVD I burnt of the ISO from Microsoft's website. "A system error prevented the service pack from installing. Please download and run the"Check for System Update Readiness Tool." Here's the error code.
Error: ERROR_SXS_COMPONENT_STORE_CORRUPT(0X80073712)
Of course I downloaded that Service Pack and tried to install it, but that failed too.
This is the error code for the failed (KB947821) Code 80073712
Man, this is driving me insane.........and you want to open up another ticket at BleepingComputers??
I guess I'm this far down the rabbit hole now,......I might as well continue.
Thanks for your help!

 

[Rob James]

SOLVED**
I fixed this by inserting my Win 7 CD and choosing Upgrade. It repaired all my Windows files while keeping my Programs in place. (I didn't know you could do that.........my bad) Anyways, all the corrupt files are fixed, I'm now able to update Windows in the normal fashion, and I have SP1 installed.
Thanks to all of you who offered assistance. Sorry to have wasted your time on something I could have fixed on my own, had I known the solution was there. Now I know!!!
For any who are curious, it wasn't a virus it was corrupted files from installing faulty RAM. Thanks God, I back-up everything in Triplicate.
Anyways, safe journeys............and I'll see you guys next time catastrophe strikes!!

 

[ICIT2LOL]

Well done Rob it doesn't surprise me you have got it fixed that way because stranger things happen at sea. For example my main Ivy Bridge desktop dropped all the USB ports a while ago and the culprit - the Samsung Magician software uninstalled it and back came the ports after a coupe of months trying everything - and more recently solved a heap of slowness and annoying bugs by just replacing the CMOS BIOS battery - again something that doesn't come straight to mind

At least you have been backing up and yes I use this for doing my backups because you can set it to do it at regular times ie weekly so am always up to date Imaging with free Macrium

You might be interested in this too it will speed up and make the machine more efficient if you don't mind losing some of the "bling" like transparency (you don'y have to lose that necessarily) I use it on all my machines
Optimize Windows 7