[SOLVED] [Win7Pro] SFC contains corrupted files that even SFCFix could not fix

BrianDrab · Apr 5, 2017

Bad memory can cause all sorts of weird stuff. Although everything looks good with the results of the chkdsk scan, when time permits can you run a chkdsk repair to be absolutely sure? It won't take long to run but will involve a reboot.

Step#1 - ChkDsk Repair
1. Click your Start Orb in the lower left of your computer and type cmd in the search box.
2. Once the cmd program is found, right-click on it with your mouse and select Run as administrator as shown below.

3. Answer Yes when asked to allow.
4. You should now have a black window open that you can type in to.
5. Please type chkdsk /R and then press enter. Note: There is a space after the command chkdsk and before the forward slash
6. You will get a prompt telling you chkdsk cannot run because the volume is in use. Answer Y and hit enter to schedule the run at next boot.
7. Reboot your computer and chkdsk will run. Let it complete please.
8. Right-click ListChkdskResult.exe and select Run as administrator (Allow if prompted)and a text file will open (and also be saved on the desktop as ListChkdskResult.txt).
Please copy the contents of this file and paste into your next post.

Platinum Lucario · Apr 5, 2017

Alrighty, here's the output of ListChkdskResult.txt:

Code:

ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013

------< Log generate on 6/04/2017 10:48:10 AM >------
Category: 0
Computer Name: Wendy-HP
Event Code: 1001
Record Number: 5402348
Source Name: Microsoft-Windows-Wininit
Time Written: 04-05-2017 @ 17:34:41
Event Type: Information
User: 
Message: 

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows .

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
Cleaning up instance tags for file 0x21ab7.
  227072 file records processed.                                         

File verification completed.
  1093 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  45 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  293182 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  227072 file SDs/SIDs processed.                                        

Cleaning up 1231 unused index entries from index $SII of file 0x9.
Cleaning up 1231 unused index entries from index $SDH of file 0x9.
Cleaning up 1231 unused security descriptors.
Security descriptor verification completed.
  33056 data files processed.                                           

CHKDSK is verifying Usn Journal...
  33634512 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  227056 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  60245930 free clusters processed.                                        

Free space verification is complete.
Windows has made corrections to the file system.

 476098559 KB total disk space.
 234636208 KB in 184502 files.
    133188 KB in 33057 indexes.
         0 KB in bad sectors.
    345439 KB in use by the system.
     65536 KB occupied by the log file.
 240983724 KB available on disk.

      4096 bytes in each allocation unit.
 119024639 total allocation units on disk.
  60245931 allocation units available on disk.

Internal Info:
00 77 03 00 e2 51 03 00 29 37 06 00 00 00 00 00  .w...Q..)7......
9a 03 00 00 2d 00 00 00 00 00 00 00 00 00 00 00  ....-...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

-----------------------------------------------------------------------
Category: 0
Computer Name: Wendy-HP
Event Code: 26212
Record Number: 5402331
Source Name: Chkdsk
Time Written: 04-05-2017 @ 15:42:33
Event Type: Information
User: 
Message: Chkdsk was executed in read-only mode on a volume snapshot.  

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows .

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
Cleaning up instance tags for file 0x21ab7.
  227072 file records processed.                                         

File verification completed.
  1093 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  45 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 3)...
  293188 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 3)...
  227072 file SDs/SIDs processed.                                        

Cleaning up 1231 unused index entries from index $SII of file 0x9.
Cleaning up 1231 unused index entries from index $SDH of file 0x9.
Cleaning up 1231 unused security descriptors.
Security descriptor verification completed.
  33059 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37548136 USN bytes processed.                                            

Usn Journal verification completed.
Windows has checked the file system and found no problems.

 476098559 KB total disk space.
 235167184 KB in 184490 files.
    133188 KB in 33060 indexes.
         0 KB in bad sectors.
    349027 KB in use by the system.
     65536 KB occupied by the log file.
 240449160 KB available on disk.

      4096 bytes in each allocation unit.
 119024639 total allocation units on disk.
  60112290 allocation units available on disk.

-----------------------------------------------------------------------

BrianDrab · Apr 5, 2017

Good that's what I was hoping for. Please do the following.

Code:

Windows has made corrections to the file system.

SFC Scan

Click on the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

Platinum Lucario · Apr 5, 2017

Alrighty, here's the output:
View attachment cbs.txt

Still has the File Hash Mismatch. It might have something to do with a particular registry entry having an incorrect MD5 hash or something like that

BrianDrab · Apr 5, 2017

Check out that corruption.

Your registry is looking for the incorrect hashed file.

Code:

2017-04-06 11:10:07, Info                  CSI    00000349 Manifest hash for component [ml:280{140},l:202{101}]"amd64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06d49e4cea0604a7" does not match expected value. 
 Expected:{l:32 b:00a3f8c775d0d0a6361375b4f68835afdc185ca63f0d8c4db4a882d00483fbe3}

Let's fix.

Step#1 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
Download the file below, SFCScript.txt, and save this to your Desktop.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCScript.txt.
Drag the file SFCScript.txt onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a file should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please

Platinum Lucario · Apr 5, 2017

Alrighty, here's the output of SFCFix:

Code:

SFCFix version 3.0.0.0 by niemiro.
Start time: 2017-04-06 11:37:36.002
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Users\Administrator\Desktop\SFCScript.txt [0]




RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06d49e4cea0604a7.

Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06d49e4cea0604a7.

Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06d49e4cea0604a7.
RegistryScript:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 16 datablocks.
Finish time: 2017-04-06 11:37:37.047
Script hash: VUlVMKmpTRR7CzH8DyDpi8MZw1cqxL8tStcNE1/qWvw=
----------------------EOF-----------------------

BrianDrab · Apr 5, 2017

Let's do the following again.

SFC Scan

Click on the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

Platinum Lucario · Apr 5, 2017

Alrighty, here's the output:
View attachment cbs.txt

This time, it reported that it did not find any integrity violations

BrianDrab · Apr 5, 2017

You are good to go!

Platinum Lucario · Apr 5, 2017

Thank you so much! I'll be sure to do the other machine that I have (which has a BSOD error) in a new thread, which is actually to do with a signature mismatch, rather than a file hash mismatch

BrianDrab · Apr 5, 2017

No problem, take care.

[SOLVED] [Win7Pro] SFC contains corrupted files that even SFCFix could not fix

BrianDrab

Emeritus

Platinum Lucario

Active member

BrianDrab

Emeritus

Platinum Lucario

Active member

BrianDrab

Emeritus

Attachments

Platinum Lucario

Active member

BrianDrab

Emeritus

Platinum Lucario

Active member

BrianDrab

Emeritus

Platinum Lucario

Active member

BrianDrab

Emeritus