Solved sfc scan errors?

[ICIT2LOL]

Bit OT but we have a test match out here right now - who do you barrack for?

 

[Alexey2912]

SA.......but they would have to fight hard

 

[Alexey2912]

Even after 3x, sfc and chkdsk, still the same......shall later go for a reinstall.

Thanks all.

 

[AddRAM]

It doesn`t matter if you reinstall, the corrupt files are coming from a windows update.

As I said before, leave it alone until CKing can help you.

There is no sense doing it all over again, everyone who has ever installed and updated W7 has had this problem, there are literally thousands of threads here.

One time I actually did an install, made an image, installed some updates, ran sfc, if it was good I made a new image and so on until I found the offending updates/s, it took me nearly a week, but I created a list of updates not to install. But on subsequent new machines I got sick and tired of scanning through updates.

And a lot of that time was also spent looking for offending W10 updates, so once the W10 upgrade nightmare was over I stopped adding to my list, so who knows if another update has come along to give W7 corrupt system files.

When I get a minute I`ll pull up that list.

 

[Alexey2912]

Thanks, I appreciate your advice and shall wait till CKing is available.


BTW, is CKing a mod......

 

[AddRAM]

No, he`s just a proud member like us

 

[Alexey2912]

Thanks for the info about him....

 

[CKing123]

Hi

Sorry for the delay.

Although parsing the log in sfcdetails.txt makes the log much easier to read, it removes some information I need to get the correct files. Could you run SFC again, and attach the C:\Windows\logs\CBS\CBS.log log?

-CKing

 

[Alexey2912]

Hi,

Thanks, no issues appreciate your expert assistance.

Regards.

Alex.




PS: How do I attach it, won't accept 7zip, and the file size is more than 2 MB, it's 11 MB.....:huh:

 

[CKing123]

Hi

If the file is too big, could you attach it to a service like OneDrive, ShareSpace, etc and just provide a share link?

-CKing

 

[Alexey2912]

Installed Winzip, with it its less than 1 MB from original 11 MB, strange 7 zip compression wasn't good..:huh:

Here you go pro...

Thanks again!

 

[CKing123]

From what I can tell, SFC seems to have repaired the files:

2016-11-04 01:20:51, Info                  CSI    000001ef [SR] Beginning Verify and Repair transaction
2016-11-04 01:20:51, Info                  CSI    000001f0 Hashes for file member \??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
  Found: {l:32 b:MaTgSnjJJ3/gHVuObWQCls+YbKKWUb8sBukwsC9lLU0=} Expected: {l:32 b:1Zax9s1qdMRSS497i+x+GLlMBqmAQgskRLJcjMKnoGM=}
2016-11-04 01:20:51, Info                  CSI    000001f1 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\system32\drivers\en-US"\[l:28{14}]"usbhub.sys.mui" from store
2016-11-04 01:20:51, Info                  CSI    000001f2 WARNING: File [l:28{14}]"usbhub.sys.mui" in [l:74{37}]"\??\C:\Windows\system32\drivers\en-US" switching ownership
    Old: usbport.inf.Resources, Version = 6.1.7601.23403, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: usb.inf.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2016-11-04 01:20:51, Info                  CSI    000001f3 Hashes for file member \??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
  Found: {l:32 b:1Zax9s1qdMRSS497i+x+GLlMBqmAQgskRLJcjMKnoGM=} Expected: {l:32 b:MaTgSnjJJ3/gHVuObWQCls+YbKKWUb8sBukwsC9lLU0=}
2016-11-04 01:20:51, Info                  CSI    000001f4 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\system32\drivers\en-US"\[l:28{14}]"usbhub.sys.mui" from store
2016-11-04 01:20:52, Info                  CSI    000001f5 WARNING: File [l:28{14}]"usbhub.sys.mui" in [l:74{37}]"\??\C:\Windows\system32\drivers\en-US" switching ownership
    Old: usb.inf.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: usbport.inf.Resources, Version = 6.1.7601.23403, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2016-11-04 01:20:52, Info                  CSI    000001f6 Repair results created:
POQ 98 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\5f26d5c50f36d201672a0000a80eb00e._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\8074d5c50f36d201682a0000a80eb00e.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\aea9e1c50f36d201692a0000a80eb00e.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
    3: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\b71ae4c50f36d2016a2a0000a80eb00e.$$_system32_drivers_dc1b782427b5ee1b.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms"
    4: Move File: Source = [l:242{121}]"\SystemRoot\WinSxS\Temp\PendingRenames\2b2ce5c50f36d2016b2a0000a80eb00e.$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms", Destination = [l:154{77}]"\SystemRoot\WinSxS\FileMaps\$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms"
    5: Hard Link File: Source = [l:220{110}]"\SystemRoot\WinSxS\x86_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_28f4b82971b7afde\usbhub.sys.mui", Destination = [l:104{52}]"\??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui"
    6: Hard Link File: Source = [l:228{114}]"\SystemRoot\WinSxS\x86_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_f0a768a61e2fbabf\usbhub.sys.mui", Destination = [l:104{52}]"\??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui"

POQ 98 ends.
2016-11-04 01:20:52, Info                  CSI    000001f7 [SR] Repair complete

However, in the original log, SFC also tried to repair these files before. Instead, could you restart your computer and run SFC again? Does it still say it has repaired some files?

-CKing

 

[Alexey2912]

Correct, it does say.

 

[Alexey2912]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\XPS>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log

C:\Users\XPS>findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop
\sfcdetails.txt"

C:\Users\XPS>findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop
\sfcdetails.txt"

C:\Users\XPS>

 

[CKing123]

Hi

I will be off for the evening so I will look into this tomorrow

-CKing

 

[Alexey2912]

Hi, no issues, appreciate you taking out the time to look into it.

Take care, have a great evening!

Alex.

 

[AddRAM]

Alexey, you shouldn`t have to install any extra compression tools with W7, just right click on the file and choose send to compressed file.

 

[Alexey2912]

Thanks, AddRaM for explaining, learning, wished had known it earlier!

 

[CKing123]

Looking closely at the log again, I noticed something peculiar. Basically, the file is not corrupt. Instead, SFC first checks against an older verion of the file, 6.1.7600.16385 (RTM version). However, since the file is a newer version, it marks it as corrupt and repairs it. It then compares it against the newer version, 6.1.7601.23403, and because it replaced it with an older version, it marks the file as corrupt and repairs it.

Seems to be a bug with the way SFC is checking superseded version of the file. I will take a look at this when I get home, but the file itself is not corrupt

-CKing

 

[Alexey2912]

Thanks again CKing.

Could that be the reason, for macrium restore, pausing for 12-15 mins before starting restoring the backup?

Regards,

Have a great day!