Error 4448 WOF =(

[DodgyDavros7]

Hello All,

I have read many stories here of others having a very similar issue.

I have been using my older computer again recently as my laptop bit the dust.

Recently I've been having progressively more and more problems with this Windows 10 system.

In place windows overtop/repair install errors at end.

Initially explorer search stopped working, then update issues and a lot of the system32 etc files security access and ownership. I'm sure some through my own fault.

So Scansfc reports unreparable errors. I will include the CBS.log

when running DISM in its many forms including trying to repair the lip from a thumb disk i have no luck. "dism.exe /online /Cleanup-Image /StartComponentCleanup /source:j:\sources\install.esd" J being my thumbdrive.

If I run the PS "Repair-WindowsImage -Online -ScanHealth" I get "The WOF driver encountered a corruption in the compressed file's Resource Table."

I downloaded SFCFix and ran it. Unfortunately I stuffed up and stopped it half way initially and no it crashes out with the "Something has gone horribly wrong" error.

Ran "component scanner" and it was the only thing so far not reporting any errors.

I have installed Farbar and have included its reports as well

SO

I have saved and included all the logs that some kind soul may be able to assist me with.
Cheers from Australia.

So last question before I upload my logs. Is it safe to do so? Being publicly posted, can the info be used to hack me etc?

 

[xrobwx71]

If you are referring to any logs our analysis software or any, we have requested will not have any personally identifiable information that can be used against you for any purpose much less hacking. It is safe.

 

[DodgyDavros7]

Hello,
Nope my concern in no way was to wards your software nor lovely helpers. I just saw how much was in my CBS file and it was in regards to scrapers.
So here are my files. I hope they a re the correct ones and of course would be great-full anyone cam help me.
Cheers
-D

 

[DodgyDavros7]

Are these files sufficient?

 

[ET_Explorer]

Are these files sufficient?

No, they are not.

 

[DR M]

Hi, DodgyDavros.

Welcome to Sysnative Forums.

We can do some maintenance, based on the FRST logs you posted, and see how it goes. If the corruptions can't be repaired, then, an expert from the Updates Forum must be check in and take over.

Until we finish, do not download/install or uninstall anything, unless I instruct you to do so.

1. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
AVG Driver Updater (HKLM-x32\...\{A0B8EE75-9B84-40D6-AA60-B640337B27D9}) (Version: 2.2.2 - AVG Netherlands B.V) Hidden
CustomCLSID: HKU\S-1-5-21-2730259381-1963947084-3979236562-1001_Classes\CLSID\{274e6f72-6456-504e-2700-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers6-x32: [IconLayout] -> {19F500E0-9964-11cf-B63D-08002B317C03} => Layout.dll -> No File
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`29hfm [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
AlternateDataStreams: C:\Users\Lenny\Downloads\FiddlerSetup.5.0.20245.10105-latest.exe:MBAM.Zone.Identifier [60]
AlternateDataStreams: C:\Users\Lenny\Downloads\FurMark_2.4.3.0_Win64_Setup.exe:MBAM.Zone.Identifier [64]
AlternateDataStreams: C:\Users\Lenny\Downloads\GPU-Z.2.60.0.exe:MBAM.Zone.Identifier [64]
AlternateDataStreams: C:\Users\Lenny\Downloads\LuminarNeoSetup.exe:MBAM.Zone.Identifier [50]
AlternateDataStreams: C:\Users\Public\Downloads\CrystalDiskInfo9_5_0.exe:MBAM.Zone.Identifier [60]
AlternateDataStreams: C:\Users\Public\Downloads\CrystalDiskMark8_0_6.exe:MBAM.Zone.Identifier [60]
AlternateDataStreams: C:\Users\Public\Downloads\epm_free_installer.17308082594859b589.exe:MBAM.Zone.Identifier [174]
AlternateDataStreams: C:\Users\Public\Downloads\Focusrite-Control-2.exe:MBAM.Zone.Identifier [165]
AlternateDataStreams: C:\Users\Public\Downloads\GFX Memory Speed Benchmark 1.1 Setup Win32.exe:MBAM.Zone.Identifier [259]
AlternateDataStreams: C:\Users\Public\Downloads\SpotifySetup.exe:MBAM.Zone.Identifier [115]
AlternateDataStreams: C:\Users\Public\Downloads\SteamSetup.exe:MBAM.Zone.Identifier [147]
AlternateDataStreams: C:\Users\Public\Downloads\UserBenchmarkInstaller (2).exe:MBAM.Zone.Identifier [155]
AlternateDataStreams: C:\Users\Public\Downloads\UserBenchmarkInstaller.exe:MBAM.Zone.Identifier [163]
AlternateDataStreams: C:\Users\Public\Downloads\VirtualBox-7.1.4-165100-Win.exe:MBAM.Zone.Identifier [157]
AlternateDataStreams: C:\Users\Public\Downloads\winrar-x64-701.exe:MBAM.Zone.Identifier [167]
SearchScopes: HKU\S-1-5-21-2730259381-1963947084-3979236562-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={E0B95A8C-7129-48CD-91B0-FA179E5134D5}&mid=a6be41d69ce247ccb85dd1533b3e98f8-694565628abf4b2a5f0797d958c7d4077e47c815&lang=en&ds=AVG&coid=avgtbavg&cmpid=0516tb&pr=fr&d=2015-12-25 16:19:27&v=4.2.9.726&pid=wtu&sg=&sap=dsp&q={searchTerms}
HKLM\...\StartupApproved\Run32: => "AVG_UI"
HKU\S-1-5-21-2730259381-1963947084-3979236562-1001\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"
HKU\S-1-5-21-2730259381-1963947084-3979236562-1001\...\Run: [GoogleDriveSync] => "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart (No File)
Task: {61B0EEA1-6D75-4330-BA6B-5C10289CC062} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {885B3FE6-131E-410F-A550-0AC6C80A1986} - System32\Tasks\AVGPCTuneUp_Task_BkGndMaintenance => C:\Program Files (x86)\AVG\AVG PC TuneUp\tuscanx.exe  $(Arg0) (No File)
Task: {66D4EC18-6935-4407-A5AC-FD583E37C700} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe  signup (No File) <==== ATTENTION
Task: {7C5588AE-BB06-41A3-8706-F2825D140A8B} - System32\Tasks\MacType_SC => C:\Program Files\MacType\MacTray.exe  (No File)
Task: {4891064E-9868-4217-BA27-3CDF9904CC98} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-2730259381-1963947084-3979236562-1004 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  /reporting (No File)
Task: {AA3520D6-86F8-4412-A222-BDD1F1595609} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2730259381-1963947084-3979236562-1004 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  (No File)
Task: C:\WINDOWS\Tasks\MacType_SC.job => C:\Program Files\MacType\MacTray.exe
S3 EuGdiDrv; \SystemRoot\system32\EuGdiDrv.sys [X]
CMD: DISM /online /Cleanup-Image /StartComponentCleanup
EmptyTemp:
End::

• Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Post the log in your next reply.

2. Uninstall programs

Java 8 Update 171: it's outdated and therefore a security risk
AVG Driver Updater: AVG is no longer installed


3. Do you recognize these files?

C:\Users\Lenny\dir
C:\Users\Lenny\die
C:\Users\Lenny\Documents\hjh.ff


In your next reply, please post:

1. The fixlog.txt
2. If uninstalling the 2 programs ran smoothly
3. A reply about the aforementioned files

 

[DodgyDavros7]

Thank You so much for your support.

I had to copy and save the FRST data you sent to a textfile and I named it "fixlist.txt". This seemed to work when I ran FSRT64 as admin.

It then rebooted but I got a windows pre-logon red screen saying unable to repair and undoing changes.

I was previously having issues with windows constantly trying to do an update.
I have now suspended updates for 7 days option.

I had a look at the fixlog.txt and it said it errored out when trying to do the DISM component cleanup. It said:

"Error: 0x800f0806

The operation could not be completed due to pending operations."

I tried to run the DISM command from the logs "DISM /online /Cleanup-Image /StartComponentCleanup" as admin in cmd and powershell but it seemed to just sit their with no feedback although the window wasn't frozen so I closed them after a few minutes.

I have as you suggested successfully uninstalled "Java 8 Update 171", and "AVG Driver Updater"

regarding the three mystery files, the first two are 0 byte and the 3rd is small and old and unknown. It might have been part of "SketchUp" which I haven't nor intend to use in years. I haven't deleted them but I but am happy to do so.

I ran sfc /scannow at the end. It got to 100% and seemed to complete, but I got the following msg "
Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag."

I will zip and send the latest CBS.log as well as the FRST64 fixlog.txt

I thank you so much for your help. It is very much appreciated.
Cheers from kangaroo land.

 

[DodgyDavros7]

Update:

I was able to run DISM component cleanup to 100% but it finished stating 5 errors.
"
PS C:\WINDOWS\system32> DISM /online /Cleanup-Image /StartComponentCleanup

Deployment Image Servicing and Management tool
Version: 10.0.19041.3636

Image Version: 10.0.19045.5247

[==========================100.0%==========================]

Error: 5

Access is denied.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log"

I have included the DISM log if it can help.

Cheers and Thanks

 

[DR M]

Hi, DD7.

Have you tried the DISM command above (DISM /online /Cleanup-Image /StartComponentCleanup) as Administrator?

To do that:

Type cmd in the Search bar.
Right-click on Command prompt or Command prompt (Admin) in the search results.
Select Run as administrator.
In the window opened copy and paste the following:

DISM /online /Cleanup-Image /StartComponentCleanup

Press Enter.