[SOLVED] need to fix OS from an sfcfix log

Alright, follow the instructions below please.

88fYBWt.png
Replacing the COMPONENTS Hive
Follow the instructions below to replace the COMPONENTS Hive.
  • Download the attached COMPONENTS.zip file, and save it on your Desktop;
  • Right-click on it, and select Extract all.... Once done, the folder with the COMPONENTS file will open. This will be your new COMPONENTS Hive.
  • Navigate to the C:\Windows\System32\config folder;
  • In it, find the COMPONENTS file and rename it to COMPONENTS_bak;
    Note: If you receive a message saying that the file is in use, restart your computer and try again.
  • Once done, copy the new COMPONENTS file I sent you in the C;\Windows\System32\config folder;
COMPONENTS.zip
 
Nope, we are done with SURT for now (until something else comes up), we're working on getting a clear CBS.log from SFC.

EndqYRa.png
System File Checker (SFC)
Follow the instructions below to run a SFC scan on your system and to provide the CBS log in your next reply;
  • On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select
    Spcusrh.png
    Run as Administrator
  • On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
  • On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
  • Enter the command below and press on Enter;
    Code: 
    sfc /scannow
    Note: There's a space between "sfc" and "/scannow";
  • Once the scan is complete, enter the command below and press on Enter
    Code: 
    copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
  • A file called cbs.txt will have appeared on your Desktop. Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;
Note: Please note that the CBS.log is volatile, which means that if you don't upload it after the SFC scan is completed, it won't have the information from the scan anymore. So archive it and upload it as soon as you can.
 
cbs.log is gigantic.
I did a sfcfix and there are the results

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-10-10 12:03:03.713
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 0
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 1
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 37 datablocks.
Finish time: 2015-10-10 12:06:03.815
----------------------EOF-----------------------
 
If you want, you can rename the CBS.log to CBS_old.log and run SFC again, it'll create a new one.
 
One file that needs to be replaced.
Code: 
2015-10-10 12:25:26, Info                  CSI    00000358 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_11.2.9600.16428_en-us_96146216ccc71f7a\vbscript.dll.mui do not match actual file [l:32{16}]"vbscript.dll.mui" :
  Found: {l:32 b:jIsSnbRS0k2bZTwCG2SgYxR2okSRG4h4GZGwIQZpMTk=} Expected: {l:32 b:MDtOmLo2L9xF6qi3COsP/YTCoGIpX3nTarIRbBYqE1s=}
2015-10-10 12:25:26, Info                  CSI    00000359 [SR] Cannot repair member file [l:32{16}]"vbscript.dll.mui" of Microsoft-Windows-Scripting-VBScript.Resources, Version = 11.2.9600.16428, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
Follow the instructions below please.

myjIXnC.png
SFCFix - Fix Time

WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly.

Follow the instructions below to download and execute a SFCFix fix, and provide the log.
  • Download SFCFix and move the executable on your Desktop;
  • Download the attached SFCFix.zip and move the archive to your Desktop;
    Note: Make sure that the file is named SFCFix.zip, do not rename it.
  • Save any work you have open, and close every programs;
  • Drag the SFCFix.zip archive file over the SFCFix.exe executable and release it;
    mMabJGT.gif
  • SFCFix will launch, let it complete;
  • Once done, a file will appear on your Desktop, called SFCFix.txt;
  • Open the file, then copy and paste its content in your next reply;
SFCFix.zip
 
If you ran the SFCFix above to replace the file, run SFC again and give me the log please.
 
It's impossible to fix the key as it is since neither I or my instructor have it in our VMs sadly. Now, is that computer able to search, download and install Windows Updates? If so, it shouldn't get in the way.
 
It's not that simple. We need to trace back the actual KB that added that Registry key, and if we cannot uninstall it, we'll need to manually remove every references to that KB in the Registry. Like I said, it's possible that this key won't cause any issue, as long as you are able to search, download and install Windows Updates, you'll be fine.
 
Ok. thanks. The package that was in the installed programs list had the same version number as the checksur log error. The mystery is why I'm still getting the error. BTW, checksur error blocks updates from succesding, si unfortunately it's not a non-issue.
 
I'll attempt to install both packages on one of my VM tonight (assuming that I can install them and don't get prompted "This update doesn't apply to your system") and see if I can find the key from there.
 
I installed the KB2467174 and it's still doing the same error.
Click to expand...

Where did you find the download for it? I can't seem to find it, looks like it's been removed from the web completely.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top