[SOLVED] SFCFix version 3.0.2.1 by niemiro has encountered an unhandled exception.

Leonchroí · Jul 1, 2024

Hi folks,

I have been trying to resolve this issue with windows 11 for a few days now. I have tried an in place reinstall using w windows 11 bootable usb. sfc /SCANNOW always results in:
Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

I've tried:
Dism /Online /Cleanup-Image /CheckHealth

Dism /Online /Cleanup-Image /ScanHealth

Dism /Online /Cleanup-Image /RestoreHealth

No issues with DISM and restore always works, I have also tried offline restore using a freshly mounted iso of windows 11 Pro:

Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:G:\sources\install.wim:6 /limitaccess

I'm at a complete loss as to what to do next outside of a clean installation of Windows. I've attached cbs log, really appreciate any advise given

Leonchroí · Jul 5, 2024

Any ideas before I do a clean install? :)

Leonchroí · Jul 5, 2024

Please let me know if I need to provide anything else?

Maxstar · Jul 6, 2024

Hi and welcome to Sysnative,

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
Right-click to run the tool as administrator. When the tool opens click Yes to disclaimer.
Note: Ensure that the Addition.txt check box is checked at the bottom of the form within the Optional Scan area.
Press the Scan button.
Please wait for the tool to finish. It will produce two logfiles called FRST.txt and Addition.txt in the same directory the tool is run from (which should be the desktop)
Post the logfiles FRST.txt and Addition.txt as attachment in your next reply.

Leonchroí · Jul 6, 2024

Hi Maxtar,

Many thanks for taking the time to look into this for me. I really appreciate it, please find attached the two requested files.

Maxstar · Jul 6, 2024

Hi,

Please remove all the Bitdefender software, just to rule out nothing has been blocked by their protection layers...

Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 27.0.1.274 - Bitdefender)
Bitdefender Antivirus Plus (HKLM\...\Bitdefender) (Version: 27.0.25.115 - Bitdefender)
Bitdefender VPN (HKLM\...\Bitdefender VPN) (Version: 27.0.3.39 - Bitdefender)

Leonchroí · Jul 6, 2024

No problem here are the files without Bitdefender installed.

Maxstar · Jul 6, 2024

There are still some remnants, so let's start with cleanup some things.

Start the

Farbar Recovery Scan Tool again.

Warning: This script was written specifically for this system. Do not run this script on another system.

Download the attachment fixlist.txt and save it to your desktop.
Right-click on FRST.exe and select "Run as administrator".
Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally.
When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
Post the logfile Fixlog.txt as attachment in your next reply.

Leonchroí · Jul 6, 2024

Here is the Fixlog.txt file as requested.

Maxstar · Jul 6, 2024

Great, please run the System File Checker again and post the result. If it fails attach a new copy of the CBS logs.

Code:

SFC /Scannow

Leonchroí · Jul 6, 2024

Failed unfortunately

Maxstar · Jul 6, 2024

The CBS does not reveal any useful information, so please run the System File Checker again with Process Monitor running.

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Run the System File Checker.
3. Stop the Process Monitor trace when SFC failed (sometimes you'll need to wait a bit longer to be sure everything is logged). You can simply do this by clicking the capture icon (CTRL +E) on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free and provide the link.

Leonchroí · Jul 6, 2024

I ran it twice to make sure I did it correctly, please let me know if these are okay?

Maxstar · Jul 6, 2024

Rich (BB code):

7/6/2024 1:51:24 PM    TiWorker.exe    CreateFile    C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0\02a - Windows PowerShell.lnk    ACCESS DENIED    Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM

Yeah! The second trace file is correct. Please run the following commands one at a time in an elevated prompt and copy and paste the result in your next post.

Code:

certutil -hashfile "C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0\02a - Windows PowerShell.lnk" SHA256
icacls C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0

Leonchroí · Jul 6, 2024

Rich (BB code):

PS C:\Users\uaon> certutil -hashfile "C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0\02a - Windows PowerShell.lnk" SHA256
SHA256 hash of C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0\02a - Windows PowerShell.lnk:
60b441d7515a3fa87f0387663b465400b36764bc5d56ed3393345da72e6c2559

CertUtil: -hashfile command completed successfully.
PS C:\Users\uaon> icacls C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0
C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.22621.1_none_194db5aa04aa3ef0 NT SERVICE\TrustedInstaller:(OI)(CI)(F)
                                                                                                                 BUILTIN\Administrators:(RX)
                                                                                                                 BUILTIN\Administrators:(OI)(CI)(IO)(GR,GE)
                                                                                                                 NT AUTHORITY\SYSTEM:(RX)
                                                                                                                 NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(GR,GE)
                                                                                                                 BUILTIN\Users:(RX)
                                                                                                                 BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                                                                                                                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                                                                                                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
                                                                                                                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(RX)
                                                                                                                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
PS C:\Users\uaon>

Maxstar · Jul 6, 2024

Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

Leonchroí · Jul 6, 2024

Maxstar said:
Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.

Please copy this file to your desktop.

Note: If you receive an error that this file is in-use, simply reboot your computer and try again.

Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.

If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

Attached the file

Maxstar · Jul 6, 2024

Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Leonchroí · Jul 6, 2024

done and attached

Maxstar · Jul 6, 2024

Please run the System File Checker again and post the result.

Code:

SFC /Scannow

[SOLVED] SFCFix version 3.0.2.1 by niemiro has encountered an unhandled exception.

Active member

Attachments

Active member

Active member

Attachments

Windows Update Moderator, Security Analyst

Active member

Attachments

Windows Update Moderator, Security Analyst

Active member

Attachments

Windows Update Moderator, Security Analyst

Attachments

Active member

Attachments

Windows Update Moderator, Security Analyst

Active member

Attachments

Windows Update Moderator, Security Analyst

Active member

Windows Update Moderator, Security Analyst

Active member

Windows Update Moderator, Security Analyst

Active member

Attachments

Windows Update Moderator, Security Analyst

Attachments

Active member

Attachments

Windows Update Moderator, Security Analyst