[SOLVED] [7SP1 x64] Long term SFC corruption of iassdo.dll.mui

tns1 · Jan 16, 2018

SFC has always reported corruption of iassdo.dll.mui (and links). This has been referred to as the "Pretty Peacock" issue elsewhere. It was thought to be caused by a corrupt language pack. I see what looks like french and/or persian references in the files. It causes no problems, but I'd like to clean it up sfc and fully uninstall those language packs if possible. No joy so far.

Reports:

------------------------------------------------

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

C:\Windows\system32>

------------------------------------------------

SFCFix version 3.0.0.0 by niemiro.
Start time: 2018-01-16 12:42:04.417
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.

AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2018-01-16 12:42:57.426
----------------------EOF-----------------------

Logs folder:
Dropbox - CBS log

tns1 · Jan 19, 2018

Re: long term sfc corruption of iassdo.dll.mui

I cannot use DISM to do a /restorehealth (w7pro), but I did a /scanhealth. The resulting dism.log indicates several errors related to "panther logging", and several missing "oemXX.inf" files.

BrianDrab · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hello and welcome

Due to the precise nature of your corruption, you will receive help from a user named SleepyDude. He's one of our senior trainees here who's in his final phase of his studies and needs to gain some real world experience in specific areas of Windows Update. This means that he'll be assisting you, but that I will first need to double check and approve his fixes before he posts them to you. If anything this is a good thing for you because it means that you've got at least two of us watching over your thread, but it will unfortunately add a slight delay between each reply. I hope that you understand and can accept the need for us to train up new members in this way in order to carry on doing what we do here, however, if for any reason you object to this setup, I will happily take on your thread myself.

Thank you very much for your understanding. We'll be with you very shortly.

SleepyDude · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hi,

Lets take care of that problem and see what happens...

SFCFix Script

!!! WARNING !!! The following fix is only relevant for this system and no other, applying this fix on another computer will not work and most likely will cause problems...

Download SFCFix.exe (by Niemiro) and save it to the Desktop
Download the file SFCFIX.ZIP, attached below, and save this to your Desktop
On your Desktop, make sure you have the two files:

SFCFix.exe and

SFCFIX.zip
Drag the file SFCFIX.zip onto the file SFCFix.exe and release it
The SFCFix tool will process the script
Upon completion, a log file SFCFix.txt should be created on your Desktop
Open the SFCFix.txt log and copy & paste the contents to your post

tns1 · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

The zip you sent appears to contain x86 resources. This is an x64 version of 7pro, which I understand contains supports x86 as well. Just making sure this is the one you want.

SleepyDude · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hi,

The corruption reported on the logs is on the x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui

On a 64 bits OS is common to have files with the same name for x86 and x64 but different contents.

tns1 · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Problems with the zip? FYI I have compressed folders disabled on this PC and instead use 7z. 7z has no problem opening that zip.

SFCFix version 3.0.0.0 by niemiro.
Start time: 2018-01-20 09:31:28.544
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\T\Desktop\SFCFIX.zip [0]
Failed to extract zip archive. Failed to unzip in location 2 with error code 0x80004005.

Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2018-01-20 09:31:38.559
Script hash: 8/VaaaOLXXxtgFCNWvpNyJYS/MQ6iatcuwVrfcPz8+w=
----------------------EOF-----------------------

SleepyDude · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hi,

Please try this:
- delete SFCFIX.exe and also the SFCFix.zip from the Desktop
- Restart the Computer
- download a new copy of SFCFIX.exe and the attached SFCFIX.zip that is different from the other one
- apply the fix like you did before and post the resulting log

tns1 · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

It has the same problem. I could unzip it and run it from a cmd window, if you thought that would help.
Something I can tell you is that the iassdo file at that specific location on the PC is only 5K instead of the 47K in the fix file.

SFCFix version 3.0.0.0 by niemiro.
Start time: 2018-01-20 12:00:17.961
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\T\Desktop\SFCFix.zip [0]
Failed to extract zip archive. Failed to unzip in location 2 with error code 0x80004005.

Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2018-01-20 12:00:49.223
Script hash: 3maElLSKEzFAcNieo08EoaqU1bRyIDIgVBOk9J1abXo=
----------------------EOF-----------------------

tns1 · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Something I can tell you is that the iassdo file at that specific location on the PC is only 5K instead of the 47K in the fix file. Looking at that version in a hex editor shows it to be a jpg file. I renamed it to jpg, and it can be opened to show the infamous "Pretty Peacock" image. That same incorrect iassdo.dll.mui file also exists at C:\Windows\SysWOW64\en-US. There are a few other places where a iassdo.dll.mui file exists, but those are around 47k in size so they may be OK. You may not need this extra feedback, but I thought I would throw it out there.

Here is someone else's attempt to understand this exact problem. Too bad there was no follow-up post. I didn't try any of those suggestions, since I didn't want to break anything, and it is just an annoyance.
Iassdo.dll.mui link to pretty_peacock.jpeg

SleepyDude · Jan 20, 2018

Re: long term sfc corruption of iassdo.dll.mui

Thanks for the feedback.

Don't worry we will take care of that using a different approach... please wait a little bit.

SleepyDude · Jan 21, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hi,

Lets try with a different script.

- Download Tns1Fix.exe and save it to the Desktop
- right click the file and select Run As Administrator
- two command prompt windows will open, one is from SFCFix please follow the instructions presented
- when the script ends it will open the sfcfix.txt log, copy & paste the result to your post

tns1 · Jan 21, 2018

Re: long term sfc corruption of iassdo.dll.mui

Looking good so far!

SFCFix version 3.0.0.0 by niemiro.
Start time: 2018-01-21 10:41:38.368
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Windows\Temp\SFC\SFCScript.txt [0]

PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui

Successfully copied file C:\Windows\TEMP\SFC\files\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui to C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui.

Successfully restored ownership for C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui
Successfully restored permissions on C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui
PowerCopy:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2018-01-21 10:41:39.008
Script hash: LD4SWxUBmLB9WW+yc41i8J3AR+DYgKCBhDfA0AYG4nI=
----------------------EOF-----------------------

SleepyDude · Jan 21, 2018

Re: long term sfc corruption of iassdo.dll.mui

Hi,

It worked as expected. Please run SFC /scannow again and post the result.

tns1 · Jan 21, 2018

Fantastic! The legit instances of the file pretty_peacock.jpg are ok, and not corrupted as that other poster reported.
Any speculation as to what caused this, such as malware, buggy sw, power failure corruption, or language pack issue?

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>

tns1 · Jan 21, 2018

Re: long term sfc corruption of iassdo.dll.mui

I spoke too soon....

The iassdo.dll.mui files have been fixed, but on further inspection, two instances of the resource file Pretty_Peacock.jpg, have indeed been replaced by iassdo.dll.mui, just as described in that other post I referenced. These two:
C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_73a679f8be493c8c
C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026

It appears that the jpg files have been linked in some way to the iassdo file(s). This isn't a tablet pc, and I don't believe it uses any tablet features (the feature box is unchecked and service disabled) so I could probably live with this, but it still needs to be understood.

SleepyDude · Jan 21, 2018

Please run another sfc /scannow

tns1 · Jan 21, 2018

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>

SleepyDude · Jan 21, 2018

I discuss this with Brian and if SFC doesn't detect any problem them all is good.

Trying to answer your question, a faulty update hard-linked these files incorrectly together (Pretty_Peacock.jpg & iassdo.dll.mui). SFC did its job and replaced the files correctly.

tns1 · Jan 21, 2018

I am glad that sfc is happy and the mui files are restored, but the hardlinks that were incorrectly created have not gone away, they have just moved around a bit.

Using a PS script to list the linkage of the two pretty_peacock.jpg files I found show each to be hardlinked to iassdo.dll.mui.
PS dir 'C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026' -recurse -force | ?{$_.LinkType} | select FullName,LinkType,Target | Out-File c:\t\out.txt -width 700

C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Pretty_Peacock.jpg
HardLink {
C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui,
C:\Windows\SysWOW64\en-US\iassdo.dll.mui,
C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_73a679f8be493c8c\Pretty_Peacock.jpg
}

C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_73a679f8be493c8c\Pretty_Peacock.jpg
HardLink {
C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e86c80b89a3f77b7\iassdo.dll.mui,
C:\Windows\SysWOW64\en-US\iassdo.dll.mui,
C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Pretty_Peacock.jpg
}

Not only are there multiple hardlinks between these different file types (no other resources in that directory have multiple links), but there are links between x64 and x32 versions. Mainly it seems wrong for a jpg to masquerade as a mui file or visa versa.

If this is something that can't easily be fixed and/or is relatively harmless, that's fine I'll live with it until I need a clean install.

[SOLVED] [7SP1 x64] Long term SFC corruption of iassdo.dll.mui

Active member

Active member

Emeritus

Windows Update Moderator, Security Analyst

Attachments

Active member

Windows Update Moderator, Security Analyst

Active member

Windows Update Moderator, Security Analyst

Attachments

Active member

Active member

Windows Update Moderator, Security Analyst

Windows Update Moderator, Security Analyst

Active member

Windows Update Moderator, Security Analyst

Active member

Active member

Windows Update Moderator, Security Analyst

Active member

Windows Update Moderator, Security Analyst

Active member