Solved sfc /scannow run from Installation Disk

[rickburton]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\SysWOW64
C:\Windows\SysWOW64 CREATOR OWNEROI)(CI)(IO)(F)
NT AUTHORITY\SYSTEMOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(F)
BUILTIN\UsersOI)(CI)(RX)
NT SERVICE\TrustedInstallerCI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

 

[NoelDP]

Hmm -- there's some odd permissions there...
Here's my output (Win7 Pro x64)...

C:\Windows\system32>icacls c:\windows\syswow64
c:\windows\syswow64 NT SERVICE\TrustedInstaller:(F)
                    NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                    NT AUTHORITY\SYSTEM:(M)
                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                    BUILTIN\Administrators:(M)
                    BUILTIN\Administrators:(OI)(CI)(IO)(F)
                    BUILTIN\Users:(RX)
                    BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                    CREATOR OWNER:(OI)(CI)(IO)(F)

I need to check a few things before I start messing with anything - but I don't think it should cause a problem if you want to leave things as they are.

 

[rickburton]

OK that sounds good. Thanks again to all that helped. Very much appreciated!

 

[rickburton]

No corrupt files. Everything seems to be working fine. Permissions are still the same on the syswow64 folder. Is that something I should try to fix or just leave it the way it is? Thanks again!

 

[NoelDP]

With a bit of luck it should be fairly simple to fix...

Open an Elevated Command Prompt and run the following commands.

TAKEOWN /F C:\Windows\SysWOW64 /A
ICACLS C:\Windows\SysWOW64 /remove Administrators
ICACLS C:\Windows\SysWOW64 /grant Administrators:(M)
ICACLS C:\Windows\SysWOW64 /grant Administrators:(OI)(CI)(IO)(F)
ICACLS C:\Windows\SysWOW64 /remove "NT AUTHORITY\SYSTEM"
ICACLS C:\Windows\SysWOW64 /grant "NT AUTHORITY\SYSTEM":(M)
ICACLS C:\Windows\SysWOW64 /grant "NT AUTHORITY\SYSTEM":(OI)(CI)(IO)(F)
ICACLS C:\Windows\SysWOW64 /remove Users
ICACLS C:\Windows\SysWOW64 /grant Users:(OI)(CI)(IO)(GR,GE)
ICACLS C:\Windows\SysWOW64 /grant Users:(RX)
ICACLS C:\Windows\SysWOW64 /remove "NT SERVICE\TrustedInstaller"
ICACLS C:\Windows\SysWOW64 /grant "NT SERVICE\TrustedInstaller":(F)
ICACLS C:\Windows\SysWOW64 /grant "NT SERVICE\TrustedInstaller":(OI)(CI)(IO)(F)
ICACLS C:\Windows\SysWOW64
ICACLS C:\Windows\SysWOW64 /setowner "NT SERVICE\TrustedInstaller"
 
.

Post the results, and reboot

 

[rickburton]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>TAKEOWN /F C:\Windows\SysWOW64 /A

SUCCESS: The file (or folder): "C:\Windows\SysWOW64" now owned by the administra
tors group.

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /remove Administrators
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant AdministratorsM)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant AdministratorsOI)(CI)(IO
)(F)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /remove "NT AUTHORITY\SYSTEM"
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant "NT AUTHORITY\SYSTEM"M)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant "NT AUTHORITY\SYSTEM"OI)
(CI)(IO)(F)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /remove Users
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant UsersOI)(CI)(IO)(GR,GE)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant UsersRX)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /remove "NT SERVICE\TrustedInstal
ler"
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant "NT SERVICE\TrustedInstall
er"F)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /grant "NT SERVICE\TrustedInstall
er"OI)(CI)(IO)(F)
processed file: C:\Windows\SysWOW64
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64
C:\Windows\SysWOW64 NT SERVICE\TrustedInstallerF)
BUILTIN\UsersRX)
NT AUTHORITY\SYSTEMM)
BUILTIN\AdministratorsM)
NT SERVICE\TrustedInstallerOI)(CI)(IO)(F)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\SysWOW64 /setowner "NT SERVICE\TrustedInst
aller"
C:\Windows\SysWOW64: Access is denied.
Successfully processed 0 files; Failed processing 1 files

C:\Windows\system32>

 

[NoelDP]

Hmm - don't know why that last command failed?
Try it manually from Windows Explorer...

Open Explorer, and navigate to the Windows folder.
Find the SysWOW64 folder entry and Right-click on it - select Properties
In the popup, select the Security tab
Click on the Advanced button
Click on the Owner tab (it should show Administrators as the owner)
Click on the Edit... button and accept the UAC warnings if any
Click on the 'Other users or groups...' button

In the entry box, type
NT SERVICE\TrustedInstaller
and click on 'Check Names' - the entry should be corrected to simply TrustedInstaller, and underlined.

Click OK once
now put a tick in the 'Replace owner on subcontainers.. box, and click OK out to Explorer.

Do you get any error messages?

 

[rickburton]

Everything went just like you said and no errors.

 

[NoelDP]

Interesting that the CMD interface failed, but the GUI one succeeded - you should be good to go now.
Keep an ye on the next few Windows update installs, as if there are any problems, that where it's likely to show up first.

 

[rickburton]

OK I will. Thanks again Noel, you have been one extremely helpful person! I appreciate you and all the techs on this site for all the help you do here! It's guys like you that make life a little easier for guys like me.

 

[NoelDP]

You're welcome - and good luck.

 

[rickburton]

Keep an ye on the next few Windows update installs, as if there are any problems, that where it's likely to show up first.

Just had an Ah-Ha moment. When I took a good copy of the corrupt file from the wife's computer, I took ownership of the same folder and file. For the last two days I've been having trouble with windows updates on her machine. She has the same 64 bit W7 OS. I should be able to fix it with all the information you've given me or at least check it out.