SFC/Corrupted Files

[seekermeister]

I ran sfc /scannow, and it said that it found some corrupted files that it could not repair. I went to the CBS.log to see what they are, but the log is so long that I don't know if I found all of them, but here is what I did find:

 Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002e6 [SR] Cannot repair member file [l:16{8}]"uDWM.dll" of Microsoft-Windows-DesktopWindowManager-uDWM, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-02-21 17:08:11, Info                  CSI    000002e7 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-d..pwindowmanager-udwm_31bf3856ad364e35_6.1.7600.16385_none_e4880f65da28f3d0\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002e8 [SR] Cannot repair member file [l:16{8}]"uDWM.dll" of Microsoft-Windows-DesktopWindowManager-uDWM, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-02-21 17:08:11, Info                  CSI    000002e9 [SR] This component was referenced by [l:190{95}]"Microsoft-Windows-DesktopWindowManager-uDWM-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.uDWM"
2010-02-21 17:08:11, Info                  CSI    000002ea Hashes for file member \??\C:\Windows\System32\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002eb Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-d..pwindowmanager-udwm_31bf3856ad364e35_6.1.7600.16385_none_e4880f65da28f3d0\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002ec [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:16{8}]"uDWM.dll"; source file in store is also corrupted

The obvious question is how to fix them?

 

[Night Hawk]

Are you having any problems with Windows in general? The "System File Checker" command there won't fix everything but minor problems with a system file or two damaged or missing.

For more involved problems with Windows a repair install or full fresh install may be required to correct the more severe problems. If this is an install just seen lately that went on incomplete a full a clean install would be a thought to clean things up. Or if you created a system image when 7 first went on you could restore that.

 

[whs]

Here is how you can deal with the CBS.log data in a more reasonable fashion: (an extract from my blog with credits to Brink who helped find the procedure)

SFC stores the results in the CBS.log which you find in C:\Windows\Logs\CBS\CBS.log. This is a massive file of approximately 5MB and if you care to see it all, you must send CBS.log to one of your own folders or the desktop from where you can double click on it. It will then open with Notepad. Note: You cannot open it inside the CBS folder. You will get an Access denied message.
But most likely you are only interested in the part that shows the corrupted files that were fixed – or not fixed. For that you need a significant data reduction. You do that as follows:
Open another elevated Command Prompt and paste this command into it:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

This will show all the files you want to see in the Command Prompt window.
Since that window is not very practical for a detailed study, you want to paste the content into a Notepad, Wordpad or Word file.
For that you right click on the Command Prompt window (any place is good) and click Select All. Then you right click anywhere in the window. Now this whole text is stored on the clipboard and you can paste it into a document file (e.g. Notepad) where you can analyze it.

A word of warning: If you have tweaked your system and modified system files, the System File Checker may undo your tweaks.

 

[seekermeister]

Night Hawk,

Understood, but I'm not inclined to go so far as reinstalling the OS at the moment. I ran SFC as simply a step in diagnosing a problem I posted about with a BSOD here:

http://www.sevenforums.com/crashes-debugging/65455-wdf1000-sys.html

 

[zigzag3143]

I ran sfc /scannow, and it said that it found some corrupted files that it could not repair. I went to the CBS.log to see what they are, but the log is so long that I don't know if I found all of them, but here is what I did find:

 Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002e6 [SR] Cannot repair member file [l:16{8}]"uDWM.dll" of Microsoft-Windows-DesktopWindowManager-uDWM, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-02-21 17:08:11, Info                  CSI    000002e7 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-d..pwindowmanager-udwm_31bf3856ad364e35_6.1.7600.16385_none_e4880f65da28f3d0\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002e8 [SR] Cannot repair member file [l:16{8}]"uDWM.dll" of Microsoft-Windows-DesktopWindowManager-uDWM, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-02-21 17:08:11, Info                  CSI    000002e9 [SR] This component was referenced by [l:190{95}]"Microsoft-Windows-DesktopWindowManager-uDWM-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.uDWM"
2010-02-21 17:08:11, Info                  CSI    000002ea Hashes for file member \??\C:\Windows\System32\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002eb Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-d..pwindowmanager-udwm_31bf3856ad364e35_6.1.7600.16385_none_e4880f65da28f3d0\uDWM.dll do not match actual file [l:16{8}]"uDWM.dll" :
  Found: {l:32 b:CSliVw9WHT8gOyhm0+PBSRLRE3LvS/IeW0laSkVna58=} Expected: {l:32 b:FM7Av19iX/g5qNebSmt8SsDLtwX9GXxrf/hhfGw+NP4=}
2010-02-21 17:08:11, Info                  CSI    000002ec [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:16{8}]"uDWM.dll"; source file in store is also corrupted

The obvious question is how to fix them?

Repair install, or restore from backup

 

[seekermeister]

whs,

That interesting, because I didn't have to move the CBS.log anywhere to view it. That string did produce a much longer list that I posted, but if I'm reading it correctly the majority are items that it did repair. It appears that the unrepaired items are the same as I posted above.

 

[seekermeister]

Repair install, or restore from backup

Okay, it may come to that, but how about just a System Restore? That would be a lot faster and easier for a procrastinating loafer.

 

[whs]

I didn't have to move the CBS.log anywhere to view it

Hmm, interesting. I always had this "access denied" problem when I wanted to open it at it's original location. But on occasion I will try it on my new laptop.

 

[zigzag3143]

Repair install, or restore from backup

Okay, it may come to that, but how about just a System Restore? That would be a lot faster and easier for a procrastinating loafer.

Lazy I know Im still running 7100 and it expires in a week. If you have a backup to restore from use it. You may not know when the problems started sneaking in.

One way to find out is to look in event viewer.


Let us know if you need help


Ken

 

[seekermeister]

Lazy I know Im still running 7100 and it expires in a week. If you have a backup to restore from use it. You may not know when the problems started sneaking in.

One way to find out is to look in event viewer.


Let us know if you need help


Ken

If this is some kind of creeping crud, it might be in the backup images also. I have found the Event Viewer somewhat clumsy with the changes since XP, but I'll try anyway.

 

[Night Hawk]

With the extent of the problems and the "not knowing" about any backups the solution is... "Take No Chances"! and go for broke with a clean install fresh. Once an installation becomes too far polluted with errors it's time for a wipe and start over fresh!

Since you are unable to find root cause for the BSODs you may have been infected with a rootkit form of malware being revealed lately! That will require a drive wipe to get rid of the malware. Microsoft says rootkit caused Windows blue screens

 

[Frostmourne]

This isn't difficult - the dynamic link library in the log in the first post is a transparency component of DWM. Uninstall your current drivers with driver sweeper and install new ones that are WDDM 1.1 certified.

 

[seekermeister]

This isn't difficult - the dynamic link library in the log in the first post is a transparency component of DWM. Uninstall your current drivers with driver sweeper and install new ones that are WDDM 1.1 certified.

Uninstall what? As I recall, Driver Sweeper is only designed to remove video drivers, chipset drivers and a couple of others that I can't remember at the moment, but isn't DWM a OS function?

 

[Frostmourne]

This isn't difficult - the dynamic link library in the log in the first post is a transparency component of DWM. Uninstall your current drivers with driver sweeper and install new ones that are WDDM 1.1 certified.

Uninstall what? As I recall, Driver Sweeper is only designed to remove video drivers, chipset drivers and a couple of others that I can't remember at the moment, but isnn't DWM a OS function?

DWM relies on your GPU - get new drivers for them and use Driver Sweeper to clean up the debris.

 

[Night Hawk]

I would advise running a good security sweep of the system perhaps with an online scanner even to see if the problems are stemming from what you haven't been looking for. Secunia has one free of charge at OSI - Consumer - Products

I've been putting 7 through the mill for the last year from beta to retail and have yet to see any blue screen! Have had a few lockups and hard boots even a memory dump or two without any BSODs! Just the same you may want to start looking at other then driver related sources in case you did get winged by something like the rootkit flosting around.

 

[seekermeister]

DWM relies on your GPU - get new drivers for them and use Driver Sweeper to clean up the debris.

Forgive me if I'm being dense, but to be clear on what you are saying, you are talking about the video driver...yes? I have the latest installed, but if it has corrupted, I will reinstall it as suggested.

 

[Frostmourne]

DWM relies on your GPU - get new drivers for them and use Driver Sweeper to clean up the debris.

Forgive me if I'm being dense, but to be clear on what you are saying, you are talking about the video driver...yes? I have the latest installed, but if it has corrupted, I will reinstall it as suggested.

Yes, the CBS log points to a DWM error, reinstall the GPU drivers. I would also scan with Sophos Anti-Rootkit, as Night Hawk has pointed out.

 

[Night Hawk]

I had to point that possibility out since there have been a few alerts about those lately for not only BSODs but unexplained system restart problems on 7 machines as well. The Microsoft Security Response Center (MSRC)

 

[seekermeister]

I know that this is a bit of a tangent, but before reinstalling the video driver, I thought it would be good to replace the video card also, because the Vcore 1 voltage is only 1.14v, instead of 1.39volts as set. However, the card that I tried to use was worse, because it wouldn't boot with it, and I got some BIOS beeps, which seem strange (AMI 1 long, 3 shorts), because when I looked it up, it says that it is about a fault in memory above 64MB.

Thinking that I might have dislodged a RAM stick, I reinstalled them and swapped positions, but that had no effect. When I went back to the original video card there were no more beeps and it booted. I undersand that the card that I tried to use is no good, but why would that produce a memory error?

 

[karlsnooks]

cbs.log is an accumulative file. Before I run SFC I always:
Run CMD.EXE as administrator.
Cd \windows\logs\cbs
del cbs.log
exit