[SOLVED] Need Help With SFC-Corrupt Files

[tom982]

Hello David,

I would also like to express my gratitude for you kindly providing Richard with the information that he needs! With your help, together we might just be able to work out how to solve this problem for future cases :)

Tom

 

[niemiro]

Thank you so much again, David.

I have received the files, and will fully analyse them as soon as I can. However, @Bobster52, it may take me a couple of days to get through all of it.

Thank you again, to you both.

Richard

 

[Bobster52]

Yes;
Thanks again David, and you also Tom, and you also Richard For everything you do, and take as much time as you need, I'm not going anywhere...:smile:

 

[Bobster52]

Hey; Richard...
Something new just poped up...Don't know what to make of it...While doing my weekly maintence, i just ran SFC after doing my Defrag, as expected when it got done it said it found corrupt files, repaired them and the system files repair changes would take place after the next reboot...Whats strange, is that after that, Command Prompt posted this message that has never showed up before---

C:\Windows\system32>7B296FBO-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0666666666666

Don't Know what it means, but thought it might be something you could use....I also included a copy of that CBS Log....Thanks again Richard, and have a good weekend...Bobster52:lightbulb:

 

[crf8j100]

Hi, I'm new to your forum and may have the same general problem. I had never performed sfc /scannow before McAfee was trying to fix my computer from it not booting after implementing their latest McAfee update. Their tech support said I had to fix the errors found by sfc before they would assist me further. Since that time, I've uninstalled McAfee and am using Microsoft Security Essentials and Firewall. I want to go back to McAfee since I have a free subscription with my cable company, and feel McAfee is a better product than Security Essentials.

The sfc said it found problems that would be fixed on the next reboot, but after reboot, the problems persist. Like David's CBS log, I have corrupted files in:
C:\Windows\system32\wbem\Wdf01000Uninstall.mof and Wdf01000.mof as in the attached CBS.zip file.

Here is my SystemLook Log:

SystemLook 30.07.11 by jpshortstuff
Log created at 21:41 on 07/01/2013 by Tony
Administrator - Elevation successful

========== filefind ==========

Searching for "Wdf01000.mof"
C:\Windows\System32\wbem\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_8026b5a71e6bdaaf\Wdf01000.mof    --a---- 4052 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 7FD159DACD1A39669F2177A727FB16D2
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000.mof    --a---- 4052 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 7FD159DACD1A39669F2177A727FB16D2
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.18703_none_765626621de95100\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.23004_none_76e09d7f37063a8a\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.22806_none_78c93ba5342a8968\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91

Searching for "Wdf01000Uninstall.mof"
C:\Windows\System32\wbem\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_8026b5a71e6bdaaf\Wdf01000Uninstall.mof    --a---- 118 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 25395AE03FAC845654C0FA5F89D2BA06
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000Uninstall.mof    --a---- 118 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 25395AE03FAC845654C0FA5F89D2BA06
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.18703_none_765626621de95100\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.23004_none_76e09d7f37063a8a\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.22806_none_78c93ba5342a8968\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565

-= EOF =-

Any help in fixing this? I never had an IE8, I went directly to IE9 from IE7. I did uninstall IE9 and reinstall it, thinking that may have been an issue, but after uninstalling IE9 and running sfc /scannow, the problems were still there. I would have given more information as requested above of David in SkyDrive, but Microsoft will not accept my username/password even after repeatedly requesting it to be reset, receiving the email and applying the new password. I've requested e-mail help from them to resolve this issue.

I've also ran System Update Readiness, and here is that log:

=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 14.0
2012-02-29 12:21

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257    
(f)    CSI Manifest Missing    0x00000002    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02    

Summary:
Seconds executed: 3258
 Found 2 errors
  CSI Manifest Missing Total count: 1
  CSI Payload File Missing Total count: 1

Unavailable repair files:
    winsxs\manifests\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest



=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 17.0
2013-01-07 11:48

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257    

Summary:
Seconds executed: 3218
 Found 1 errors
  CSI Payload File Missing Total count: 1

It seems there is a problem and maybe this is an easier fix? Thanks a lot for your time.

Tony

 

[niemiro]

Hello cf8j100, and welcome to Sysnative :)

I will give both you and Bobster52 a full run-down as soon as I can. However, for the time being, I have created a new thread here for you: https://www.sysnative.com/forums/wi...stem-file-checker-corrupt-files-crf8j100.html

Could you please do me a favour and keep all of your communications with me on your issue in that thread, to separate them in my mind?

The errors in the CheckSUR.log are easy enough to fix, but I don't think they are related to your other issue, which is identical to both David's and Bobster52's. Unfortunately, I have not yet been able to find a fix, and there is no guarantee I ever will.

However, I do have a better understanding of the issue than ever before. I am able to reliably change which components are involved (i.e. which versions of Wdf01000.mof and Wdf01000Uninstall.mof conflict), but have been as of yet unable to completely fix the issue. There are definite similarities and parculiarities between the two registry hives I have seen, and I would like to see yours too if I get the chance, but I have been as of yet unable to point a finger at any particular difference as the cause.

Richard

 

[Bobster52]

Hi Tony, and welcome to Sysnative;
Thanks for posting your information... I see that Richard has created a new thread for you specifically...Check there, for any communications...Thanks again....Bobster52 :thumbs_up:

And...Thanks again Richard for the post...

 

[crf8j100]

Thanks, Richard. I've got access to SkyDrive now and will attach what you requested earlier to the new thread you started.

Appreciate the help!

Tony

 

[niemiro]

Hello again Bobster52 :)

(please wait for further, and separate, instructions, crf8j100)

I am now seeing this issue all over the place, and on more computers than just the three here. It appears to be caused by a bug in KB2685811.

The Windows Vista version of the update is not currently available on the standard catalog. Whether it was never put up in the first place, or has been pulled from the catalog, I do not know. Whilst I await further clarification from Microsoft, can you please uninstall KB2685811: Remove an update

and let me know if that resolves your problem.

Thank you,

Richard

 

[Bobster52]

Hey Richard;
Looked through my "Installed Update" folder and to my suprise, It did'nt contain the update KB2685811...So went online and looked up KB2685811 at the Microsoft website...No help...Went back and looked in the "Installed Update" folder again and found update KB2761494 with the same discription, installed on 12/11/2012, the same date I uninstalled IE9 and IE8, and reinstalled IE9, also the same day I joined Sysnative...So I went back to the Microsoft website for KB2761494 and this is what I found Cumulative Windows Driver Framework version 1.11 update for Windows Vista and for Windows Server 2008 ...Seems that KB2761494 is a cumuliative update containing KB2685813
KB2685811
KB971286...Maybe they bundled they for Vista 64-Bit, don't know.....
Not sure if removing all those will further screw up the system....But what the hell, I'm gonna uninstall KB2761494....Will get back with ya, as soon as I'm done with that and run a SFC....Keep your fingers crossed....Thanks again Bobster

 

[niemiro]

Hey Richard;
Looked through my "Installed Update" folder and to my suprise, It did'nt contain the update KB2685811...So went online and looked up KB2685811 at the Microsoft website...No help...Went back and looked in the "Installed Update" folder again and found update KB2761494 with the same discription, installed on 12/11/2012, the same date I uninstalled IE9 and IE8, and reinstalled IE9, also the same day I joined Sysnative...So I went back to the Microsoft website for KB2761494 and this is what I found Cumulative Windows Driver Framework version 1.11 update for Windows Vista and for Windows Server 2008 ...Seems that KB2761494 is a cumuliative update containing KB2685813
KB2685811
KB971286...Maybe they bundled they for Vista 64-Bit, don't know.....
Not sure if removing all those will further screw up the system....But what the hell, I'm gonna uninstall KB2761494....Will get back with ya, as soon as I'm done with that and run a SFC....Keep your fingers crossed....Thanks again Bobster

Thanks for the info about that cumulative update. I will see if I can find anything relevant from extracting + analysing it. Good luck!

Otherwise, I have actually just thought up another "best yet" explanation for this (I know, I know, you've heard "best yet" three times now! I'm sorry ). I won't go into full details here, but basically, this problem arises because these mof files have a duel "ownership" by ..._microsoft-windows-wdf-kernellibrary_... and ..._microsoft-windows-wdf-kernellibrary-mof_..., and the hashes for the same file by those two owners do not match. SFC then gets all confused. There are a couple of ways this can go.

Firstly, either the hashes are meant to match, or they aren't. If they aren't, then we need to identify why SFC is becoming confused, and what corruption is making it confused. Otherwise, we must make the hashes match. Now, just modifying the hashes to force a match is not a good idea, and will just break the chain further down (i.e. it is likely to push the problem off SFC and onto Windows Update).

I now think, however, the problem is that in the latest cumulative update, the .mof files were updated. The hashes for ..._microsoft-windows-wdf-kernellibrary_... were updated, but the hashes for ..._microsoft-windows-wdf-kernellibrary-mof_... were not, by accident. SFC would then try to match against two different versions of the files, which will never match. Therefore, the trick is to create a whole other version key in ..._microsoft-windows-wdf-kernellibrary-mof_... (several places in the registry), with the correct hashes, to fix what should have been there. SFC will then be matching the correct hashes for the correct file, and all will be well.

It makes sense, and in actual fact, it makes much more sense technically when looking at the gory registry details than this hand-wavy explanation. However, then again, the last three fixes also made sense, and they didn't exactly work.

Richard

 

[Bobster52]

Richard; :thumbsup2:
WOOOOOOOOOOOHOOOOOOOOOOOOOOOOO!!!!!!!!!!!!! Thank You, Thank You, Thank You....................................:dance::dance::rofl12::rofl12:......................................It Worked!!!!!!!!!!!!!!!!!I Love YOU GUYS!!!!Your The Best!!!!
N-E-Way, sorry could'nt contain myself :s9: ...I went ahead and removed the update, rebooted and ran a SFC after I cleared the CBS folder....SFC finished, and reported "Did Not Find Any Integurity Violations"...System Update of course said I had one important update, "KB2761494"...So I put it in Updates "Hidden " folder...Made a fresh copy of the CBS Log and will include it with this post....And now....Soooooooooo..Questions---Do you think there will be any consiquencises from removing the the other 2 updates??? Do you think you still want to create a whole other version key in ..._microsoft-windows-wdf-kernellibrary-mof_... (several places in the registry), with the correct hashes, to fix what should have been there???? And lastley, What do we need to do to "Clean - Up" and "Put - Back", from the 3 fixes weve already done???
Wow---I'm so happy SFC did'nt find any corrupt files....Richard, And Everyone That Worked on This, Really, Thank you so much, From the bottom of my Heart for hanging in there, You don't know how much I appreciate it...Thanks again, Bobster52

 

[crf8j100]

Terrific news, Bobster52! :dance: I'll continue waiting in the sidelines for my fix which may or may not match yours. Waiting for the next instructions from Richard in my thread. :bored2:

Excellent job, Richard! :thumbsup2: You're the best! :grin1:

 

[Bobster52]

Richard;
Could'nt sleep, thought of another question....While SFC found no corrupt files the last time I ran it, when I opened the CBS log I sent you it showed that repairs had been made??? Last night I ran SFC again, and again it found no corrupt files, however when I Looked at the CBS log, It again showed repairs had been made....Can you please explain this so I can understand whats going on??? (When you have the time)...And let me know about the other 3 questions...Thanks so very much again...Bobster52....


Afterthought....Thanks for the post Tony, hope you get your fix soon...

 

[crf8j100]

Hey Bobster52,

Good find regarding Microsoft update KB2761494. Backing that out and following Richards other advice in my thread has my sfc /scannow with no integrity violations, too. All of the work you and Richard did, simplified my work to one page. :smile9: All that seems left is what to do about update KB2761494. Like yours, mine is hidden, too, to prevent it from coming up all the time to update again. I guess we'll leave it in Richard and his teams capable hands to let us know what to do next.

Thanks for starting this thread that helped with the solution to my issue. :thumbsup2:

Tony

 

[niemiro]

Hello again :)

I am really glad that it the uninstall did the trick. I am still discussing with Microsoft, and will keep you in the loop, but I am currently awaiting initial issue verification, and have nothing more to post at this time.

I shall answer your questions now and post a fix separately for clarity. Please let me know if I have missed any.

C:\Windows\system32>7B296FBO-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0666666666666

The honest answer is that I do not know what this refers to. I am interested, and have some vague ideas, but I do not know for sure. I do not think I am able to make much of this, unfortunately, but thank you very much for posting it (it is exclusion of the small details which means I might miss something - but from this, I cannot make much sense, I am afraid).

Do you think there will be any consiquencises from removing the the other 2 updates???

You are losing the benefits of all three updates by uninstall this update. This is not an ideal situation, and I hope for it to be temporary only. My hope is that discussions with Microsoft will go well and they will be able to figure out a generic solution I could not, provide a Customer Support hotfix, or re-release the update. I are currently awaiting the end of this discussion before I proceed further with you.

Do you think you still want to create a whole other version key in ..._microsoft-windows-wdf-kernellibrary-mof_... (several places in the registry), with the correct hashes, to fix what should have been there????

No, I do not. That only applies when the update is installed. It is trying to create a fix for no integrity violations + update installed. So...since we have now uninstalled the update, it does not apply. My hope is that a no integrity violations + update installed fix will now come from Microsoft.

And lastley, What do we need to do to "Clean - Up" and "Put - Back", from the 3 fixes weve already done???

Just a little tidying. I will put this into a separate post for clarity. I aim to do get this to you tonight, if at all possible. I think it will take the form of a single SFCFix script, although I will confirm that in my next post.

While SFC found no corrupt files the last time I ran it, when I opened the CBS log I sent you it showed that repairs had been made??? Last night I ran SFC again, and again it found no corrupt files, however when I Looked at the CBS log, It again showed repairs had been made....Can you please explain this so I can understand whats going on??? (When you have the time)

An excellent question :) Nice to see you taking a look over the logs. Fortunately, there is a nice explanation.

CBS.log stores the results of many SFC runs, including all previous SFC runs. This is why it keeps growing in size.

If you look at the dates on the left, you will see that all SFC reported corruptions originate from several days ago. Well, we know there were corruptions several days ago. This is nothing revolutionary.

What is important is whether the very final run of SFC reports errors. You can safely ignore all of these historic runs of SFC and any errors in them, as long as we have fixed them in the final run.

So slide down to the very bottom of the log, and search upwards for the term "[SR]". This will take you to the very bottom of the final SFC run. SFC summarises errors found at the end of the log (well, simplistically). If there are no errors shown in the bottom screen of the very final log, there is nothing to worry about, only historic data. This is the important thing. No errors. :)

I hope this helps.

Richard

 

[Bobster52]

Hey Richard;
Thanks for taking the time to answer all those questions, certainly puts everything into perspective, I appreciate that....Let me know when I can delete the folders from the desktop from everything we did, and whenever you can get me the SFCFix script and instructions for running it, will be fine...I know how busy you are....Thanks again for everything.....Bobster52 :r1:

 

[JackW/SFCHeadache]

Hello again :)

I am really glad that it the uninstall did the trick. I am still discussing with Microsoft, and will keep you in the loop, but I am currently awaiting initial issue verification, and have nothing more to post at this time.

Hi: Just joined the forum so I could jump in here and also express my thanks for all the work and investigation being done on this problem which I also seem to be suffering with (same operating system, curious new SFC behavior and involved files after recent updates). At this stage--beyond this forum--information seems very hard to come by. I suspect this is a widespread, yet under-reported issue...as few with affected systems may run SFC, and fewer still will run it a second time to find that it re-detects the same files (after reporting successful repair)...and will continue to do so on subsequent runs.

I wondered about the batch of Microsoft updates in question, because one distributed on that date initially failed to install for me, though it eventually went through. Before coming here, I had removed and reinstalled it, thinking it the source of corruption. To no avail, so it's interesting to see that a different update in that same round is probably the culprit. By the way, around the same time of developing the SFC issue, my computer also displayed the first 'Blue Screen of Death' I've ever seen in its multi-year history when re-booting to perform a disc check of the main drive... Fortunately, no further trouble on that front, and operation seems stable. For now I will ignore the SFC snag, leave all updates in place and await word on any potential fix procedure or update (even if Microsoft doesn't address it; I hope they will).

Once again, thanks for all the help from the forum. The web is a lonely place when you think your system is frakked like no one else's!


Staying tuned,

Jack

 

[AndyMutz]

hi there,

i just registered here, because i had the same problem with sfc /scannow and i found the culprit (KB2761494) myself, after going through the cbs.log and installing update after update on a fresh vista sp2 installation. then later i found this thread here :)
anyway, it seems to me, that niemiro has a great knowledge about windows errors and i hope, maybe he can help me with another error (i will open a new thread for that, as it has nothing to do with KB2761494).
also, i found another thread about KB2761494 in the microsoft forums here: http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_update/sfc-scannow-foud-corrupt-files-after-updating/384bc395-42eb-4cab-b583-a1b1deb7a3e9

i wonder if microsoft are going to fix it, i can imagine that a corrupt sfc state will sooner or later cause problems with future updates.

-andy-

 

[crf8j100]

i found another thread about KB2761494 in the microsoft forums here: http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_update/sfc-scannow-foud-corrupt-files-after-updating/384bc395-42eb-4cab-b583-a1b1deb7a3e9

Great find Andy. I, too, wonder if Microsoft will fix this issue, and when. I've tried to report this incident to Microsoft via their Support link, but it all leads me in a circle, and no where to email a support request. I would guess a support ticket would have a higher chance of being seen and acted on by a Microsoft engineer that could actually DO something about this issue, rather than post in their forums, although I've also done that.

Again, thanks, and I hope you're able to receive the help you require with your other issue. :thumbsup2:

Tony