[SOLVED] Need Help With SFC-Corrupt Files

crf8j100 said:
AndyMutz said:
i found another thread about KB2761494 in the microsoft forums here: http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_update/sfc-scannow-foud-corrupt-files-after-updating/384bc395-42eb-4cab-b583-a1b1deb7a3e9
Click to expand...

Great find Andy. I, too, wonder if Microsoft will fix this issue, and when. I've tried to report this incident to Microsoft via their Support link, but it all leads me in a circle, and no where to email a support request. I would guess a support ticket would have a higher chance of being seen and acted on by a Microsoft engineer that could actually DO something about this issue, rather than post in their forums, although I've also done that.

Again, thanks, and I hope you're able to receive the help you require with your other issue. :thumbsup2:

Tony
Click to expand...

Hello again Tony & others.

The issue has already been reported to Microsoft. I have emails/contact details of several people within Microsoft who can get this sort of issue reported to the right person :)

I will make sure it gets investigated at the very least, as I don't see how this couldn't be a bug at this point, IMO. I have already send various emails + received a reply, but have no further details to share at the moment. It is just a case of collecting details for the investigation at this time.

Richard
 
WARNING: This fix has been created specifically for Bobster52. If you are not Bobster52, do not follow these instructions as you may cause serious harm to your computer. These instructions are NOT a fix for the issue in question, and are designed only to tidy up Bobster52's computer after previous fixing attempts made during research.

Download a copy of SFCFixScript.zip.zip attached to this post, and save it to your Desktop.

Then download a copy of SFCFix.exe from here: https://www.sysnative.com/forums/downloads/sfcfix/, and also save it to your Desktop.

Single click on SFCFixScript.zip and drag and drop it on top of SFCFix.exe. SFCFix will open and perform a fix for your CheckSUR.log corruption.

A logfile called SFCFix.txt will open (and be saved to your Desktop). Please copy and paste the report into your next reply.

Thank you!

Richard
 

Attachments

Hey Richard;
Happy Weekend :angel:....Just completed the SFCFix.exe and here are the results you requested....SFCFix version 1.1.0.1 by niemiro.


Start time: 2013-01-13 13:04:17.609
Using .zip script file at C:\Users\Bobby\Desktop\3000d1358074506-need-help-system-file-checker-corrupt-files-sfcfixscript.zip


TakePermissions::
Successfully took permissions for file or folder C:\Windows\Winsxs
TakePermissions:: directive completed successfully.


CreateDirectory::
Successfully created directory tree \\?\C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5.
CreateDirectory:: directive completed successfully.


RestorePermissions::
Successfully restored ownership for C:\Windows\Winsxs
Successfully restored permissions on C:\Windows\Winsxs
RestorePermissions:: directive completed successfully.


TakePermissions::
Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5
TakePermissions:: directive completed successfully.


CopyFiles::
Failed to copy file \\?\C:\Users\Bobby\AppData\Local\niemiro\Archive\Wdf01000.mof to \\?\C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5\Wdf01000.mof with error code 0x5.
Successfully copied file \\?\C:\Users\Bobby\AppData\Local\niemiro\Archive\Wdf01000Uninstall.mof to \\?\C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5\Wdf01000Uninstall.mof.
CopyFiles:: directive completed successfully.


RestorePermissions::
Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5
Successfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5
RestorePermissions:: directive completed successfully.


RegistryScript::
Successfully imported registry script.
RegistryScript:: directive completed successfully.


Successfully processed all directives.
SFCFix version 1.1.0.1 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2013-01-13 13:04:32.991
----------------------EOF-----------------------


Thanks again for "Hanging In There", and for all your help....I'm going to go ahead and clean up my desktop, (Remove all the apps. and folders from the previous fixes)...Let me know if theres anything else I need to do....And keep me in the loop if you hear anything from Microsoft about the "Update Fix"....Bobster52 :thumbsup2:
 
Hello again, Bobster52.

One final thing. Can you please confirm this file exists: C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5\Wdf01000.mof.

The tool reported that it didn't successfully create it, but I have seen a few cases where it reported that, and actually did create it. I am still trying to figure out the location of that bug.

Anyway, if the file above does exist, you are free to go until such time as I can provide more details on KB.

If the file does not exist, you will need one final script to make sure it gets put back.

It has been a pleasure to work with you.

Richard
 
Some more good news for all involved. I have now successfully reproduced this issue on a computer in my house. I can now try out potential fixes really fast, and it doesn't matter if they go wrong and break something, or worry about keeping the number of steps to a minimum. I am free to experiment and test until I get to the very bottom of this :)

Richard
 
Hey Richard:
Did You Get my Private Message???
N-E-Way...I checked the winsxs folder and only found 2 files with mof after the kernellibrary, one was this file---amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5--but had no \Wdf01000.mof after it...The other is a different mof file... IMade copies of both...Tell me what you think????









Well The Looks Of The Files I sent you I think I'll Need Another Fix..???
 

Attachments

I did get your message, thank you, and I will respond as soon as I can. Thanks a lot for it :)

Thanks for uploading those files. They actually look perfect. When I did this: "\Wdf01000.mof", I meant the files contained within the folder, not as part of the folder name. Sorry for being unclear.

Basically, you should have two folders:

amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94.zip\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5

and

amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_de7c1326d3b45.zip\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_de7c1326d3b45cb9

each of which should contain just two files,

Wdf01000.mof
and Wdf01000Uninstall.mof.

And this is exactly what I see on your computer :)

The tidy up is complete, and with no need for a second script.

Until such time as I can provide further details on a permanent fix for the bugged update, you are free to go :)

Richard
 
Hey Richard; One quick last post...

The reason I was assuming the one file actually did'nt get replaced was because the size of the Wdf01000.mof file replaced in the SFCFix, dated 1/13/2013, was stated as 0kb --
Where-as the other mof file, the Wdf01000.mof file already present, dated 9/18/2006, the size was stated as 4kb --
While both Wdfo1000Uninstall.mof files contained a size stated as 1kb---

Would'nt the size designation of 0kb indicate that there was no data contained in the folder, making it just an empty folder, and thusly not actually having been replaced by SFCFix ????

I will attach the 2 files to this post for you to open, to see what I'm talking about, and I know how busy you are, so when you have a chance, get back with me and let me know your thoughts on this size thing...

Once again, as always, thank you so much for everything you've done...It has been my great pleasure having had an opportunity to work with you on this...
Bobster52
 

Attachments

Hello again :)

WARNING: This fix has been created specifically for Bobster52. If you are not Bobster52, do not follow these instructions as you may cause serious harm to your computer. These instructions are NOT a fix for the issue in question, and are designed only to tidy up Bobster52's computer after previous fixing attempts made during research.

Download all of the files attached to this post, and save them to your Desktop.

Then download a copy of SFCFix.exe from here: https://www.sysnative.com/forums/downloads/sfcfix/, and also save it to your Desktop.

Single click on Script1.txt and drag and drop it on top of SFCFix.exe. SFCFix will open and perform a fix.

Then please open Files.zip, and manually copy Wdf01000.mof into C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_dc45512ad6c94be5

Finally, drop Script2.txt on SFCFix.exe.

If yo were unable to copy the file into the above folder, please let me know, and we will use the manual/non-SFCFix method.

Thank you!

Richard
 

Attachments

Hey Richard;
You Da Man!!!!!!!!!!!
Followed your directions and it appears to have fixed everything, Now both mof files have a stated size of 4kb...will include a copy of the files for your inspection...:s4: Thanks again, for all your help, and good luck next week...Bobster52
 

Attachments

Bobster52 said:
Hey Richard;
You Da Man!!!!!!!!!!!
Followed your directions and it appears to have fixed everything, Now both mof files have a stated size of 4kb...will include a copy of the files for your inspection...:s4: Thanks again, for all your help, and good luck next week...Bobster52
Click to expand...

Yep, all correct now :)

I still have no more news to share r.e. a permanent fix. Microsoft received my message, and promised to investigate, but I haven't heard back as of yet. We must play the waiting game for a few more days yet. TBH, they won't provide the fix through Windows Update until next Patch Tuesday, although they might provide it through support.microsoft.com before then.

Actually, I am pretty sure that I can now fix the problem myself, but it will break Windows Update instead, which I think is worse :p

I do believe that it comes down to that missing -MOF component, but if I re-create that -MOF component, and everything else to do with that component (a LOT of registry data + several files + winsxs folder), I am 95% sure it will come down to requiring a new .cat file, the only portion of a component I cannot create myself. This will effectively be seen as correct, but with a missing .cat file. This will fix SFC, but Windows Update will fail with error code 0x800B0100 due to the missing .cat file.
 
Hey Richard;
Thanks for the updated reply, and all the work you've done...I will wait to hear from you before pulling that update out of hiding and reinstalling it....Working on another project at the moment...Had a trojan wipe out The MSMPeng.exe file for Windows Defender, removed the virus, restored the MSASCui.exe and the Base Filtering Engine back into the Services Folder, (using an app. from ESET called Services Restore), but am still trying to figure out how to replace the Startup File for Defender in the MSCONFIG folder...N-E-Way.....Back to the Forums...
Thanks again Richard....Bobster52
 
Bobster52 said:
Hey Richard;
Thanks for the updated reply, and all the work you've done...I will wait to hear from you before pulling that update out of hiding and reinstalling it....Working on another project at the moment...Had a trojan wipe out The MSMPeng.exe file for Windows Defender, removed the virus, restored the MSASCui.exe and the Base Filtering Engine back into the Services Folder, (using an app. from ESET called Services Restore), but am still trying to figure out how to replace the Startup File for Defender in the MSCONFIG folder...N-E-Way.....Back to the Forums...
Thanks again Richard....Bobster52
Click to expand...

No problem.

Do you want our Security Forum to help you? It wouldn't be me helping you, most likely Corrine. But she can help you to get Windows Defender back up and running, and check to make sure there are no other remnants of the malware/sneaky hidden things the normal tools missed and are still active, and then provide you guidelines for preventing re-infection. Would that be helpful? I would ask you to create a new thread in the Security Forum, rather than here though, just to keep the two topics separate.

Thank you!

Richard
 
Hey Richard;
Thanks for the advise, I will now go open a thread in the security forum and see what Corrine has to say, thanks again....Bobster52

BTW--Defender does start and run when I start windows from the Services Control Panel, but am still missing the MSMPeng.exe file....So Don't know if it will Update Definitions properly...
 
Hi, Bobster, niemiro, et. al....I, too, am a member of that ever-growing community that is cursed by the endless sfc-wbem-wdf01000 loop/trap. I suspected one of those Windows Updates(on 12/13/2012), so, I uninstalled all of them(also uninstalled IE8 nd IE9), but being the dreamer that I am, I reinstalled ALL of them, including KB2761494. My spooky old Vista computer is working...and has always been flaky/spooky, so I, too, will leave KB2761494 in place while continuing to monitor this forum for more news and revelations about this strange phenomena while my CBS.log grows and grows. Surely Microsoft will "fix" a problem that they caused....won't they, won't they?!? Love the brilliance, tenacity and clear/comprehensive verbage displayed on this thread. Huge thanks, you guys!!!
Cheers,
Burk
 
Hmmmmm. This is still a problem, isn't it?

I had hoped that it would be fixed in the last patch Tuesday (12th February 2013 - a little while ago, I have been really busy).

But from what I can see, it hasn't been :(

I certainly did report the problem to my contact in Microsoft, and I received a nice preliminary email back saying that my report had been routed to the team responsible for the update in question. But it appears that somewhere the message got lost. Looks like I might need to give them another little nudge :p

I can see that this isn't a particularly critical issue, but I still do believe it is one they should fix.

Unfortunately, I do not believe that I am able to create a fix - if my initial diagnosis was correct, I would require Microsoft's Digital Signature to complete the fix, and that is something I do of course not have access to.

I will see what I can do to get this issue resolved.

Richard
 
Thanks for your tenacity, Richard. :thumbsup2: After running Advanced System Care from IOBit.com with all of the check marks set in Expert Mode, I discovered that it reinstalled KB2761494 as part of "Vulnerability Fix" even though I have that fix hidden in my Microsoft Updates. Nevertheless, I had zero errors before that happened and then the old sfc errors returned:thud:.

Fortunately I was able to remove KB276194, and my system is running sfc error free once again :dance:. Too bad Microsoft lost your message :bored2:. I hate running my system without all of the updates, so hopefully your contacts at Microsoft will get on the ball and soon fix it once and for all :roll eyes (sarcasti.

Tony
 
Hi, nie....Thanks for keeping the pressure up! I can only imagine that it will be difficult to find a M'soft millionaire(on paper) that has any concern about problems they have created for the users who helped make them millionaires, unless they are forced to "care".

Although I still can't figure out whether or not KB2761494 fixes anything in Net Framework 1.1, I uninstalled 1.1 as well as KB2761494. My Vista computer has been running with "no integrity" problems since then. Additionally(and possibly coincidentally) it boots up much faster, plus there have been no more "internet explorer is not responding" problems.

A request for advice when you have time, please....I can't find any info that advises whether or not it is "safe" to clear this 50MB CBS.log file and the "best way" to do it. If you have any thoughts, please advise(also please excuse my request if it is totally dumb). Thanks!

Burk
 
Niemiro, I have what appears to be the same issue, see linked cbs.log

ftp://cnets.net/users/deek/cbs.log

I did several SFC's...cleared the cbs.lob and ran one sfc...that is the attached log

Did M$ every come up with a fix? Can you help...I am hesitant to do the same things you had Burk do without your blessing.
 
Deek said:
Niemiro, I have what appears to be the same issue, see linked cbs.log

ftp://cnets.net/users/deek/cbs.log

I did several SFC's...cleared the cbs.lob and ran one sfc...that is the attached log

Did M$ every come up with a fix? Can you help...I am hesitant to do the same things you had Burk do without your blessing.
Click to expand...

Hello Deek, and welcome to Sysnative :)

We have contacted Microsoft about this issue...twice. However, no fix in either of the last two patch Tuesdays (including today's). I am no longer sure whether it has been shoved into the Will Not Fix pile or will be rolled into the next update for WDF, whenever that happens to be (seems much less likely for various technical reasons - really, the original update needs to be re-released and reissued, not a separate update made (although that could also be made to work, it isn't technically as neat))

However, I do understand the issue much better now than I did when this thread was active. I now understand it not to be an issue, and would advise simply ignoring the SFC errors. They will not cause any harm, and it is better to have the update installed IMO.

However, you have an entirely unrelated IE issue too which you might want to fix. Again, I don't *think* it causes any harm, but unlike the other problem which is really just a detection problem, this is a much less well understood strange issue between IE8 and IE9, and I would probably advise fixing. To do so:

niemiro said:
First, please download a copy of IE9 from here: http://windows.microsoft.com/en-US/i...wide-languages
Please do not attempt to install it, just keep it handy for later on in the fix.

If you have a lot of favorites which you don't want to risk losing, I suggest that you back them up first. This can be done by pressing and releasing the Alt key on the left hand side of your keyboard. Then select the File menu, followed by Import and Export, Export to a file > Next > Tick both Favorites and Cookies > Next > Next > Next (you may specify another location if you wish) > Next (again, you may specify another location if you wish) > Finish.

Then, please uninstall Internet Explorer 9, following the instructions here: http://windows.microsoft.com/en-US/w...net-explorer-9

Then, please uninstall Internet Explorer 8, following the instructions for "Windows Vista and Windows Server 2008" here: How do I remove Internet Explorer from Windows as a troubleshooting step?

Finally, please re-install Internet Explorer 9 using the pre-downloaded installer.
Click to expand...

After that, re-run SFC (it will still error due to the first corruption), send me a new CBS.log, and I will quickly check it out for you.

Good luck!

Richard
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top