Windows Update/SFC Issue Windows 7 SP1 64 bit SFC & SFCFix unable to fix corrupt files

[daveguitaruno]

Here you go

 

[daveguitaruno]

Actually look at this CheckSUR instead (it hadn't finished)

 

[SleepyDude]

Hi,

Thanks for the log.

Run SURT again please, lets see if finally no more problems are found!

 

[daveguitaruno]

Hi SleepyDue,
Here you go, I ran it again same result

 

[SleepyDude]

Hi,

Its strange that the tools continues to do repairs and found more corrupted files!


SFCFix Script

!!! WARNING !!! The following fix is only relevant for this system and no other, applying this fix on another computer will not work and most likely will cause problems...

• Download SFCFix.exe (by Niemiro) and save it to the Desktop
• Download the file SFCFIX.ZIP, attached below, and save this to your Desktop
• On your Desktop, make sure you have the two files:
  
  SFCFix.exe and
  
  SFCFIX.zip
• Drag the file SFCFIX.zip onto the file SFCFix.exe and release it
• The SFCFix tool will process the script
• Upon completion, a log file SFCFix.txt should be created on your Desktop
• Open the SFCFix.txt log and copy & paste the contents to your post

 

[daveguitaruno]

Hi, my harddrive has no bad sectors and my RAM is fine, this is why I started to wonder if a virus or trojan is at work, but I did a boot scan and I've done a full virus scan and it's come up with nothing. I have Avast free, MalwareBytes and Superantispyware. Would you recommend any other tool I could use? Perhaps a good off-line virus scanner?
What I also find suspicious is I keep having to download the SURT tool as it keeps getting corrupted, I've downloaded it to different folder locations, but when I got to execute after running it a couple of times it says installer encountered an error.
I download a new one call it something else it is fine, but if I keep the download name it gets corrupted after a few executions.


SFCFix version 3.0.2.1 by niemiro.
Start time: 2019-06-25 21:45:12.355
Microsoft Windows 7 Service Pack 1 - amd64
Using .zip script file at C:\Users\Dave\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\Temp\CheckSur\WinSxS\Manifests

Successfully copied file C:\Users\Dave\AppData\Local\niemiro\Archive\Manifests\x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_11.2.9600.19002_none_16912967a7221812.manifest to C:\Windows\Temp\CheckSur\WinSxS\Manifests\x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_11.2.9600.19002_none_16912967a7221812.manifest.

Successfully restored ownership for C:\Windows\Temp\CheckSur\WinSxS\Manifests
Successfully restored permissions on C:\Windows\Temp\CheckSur\WinSxS\Manifests
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 453 datablocks.
Finish time: 2019-06-25 21:45:12.941
Script hash: PfQWMFnAcp2U5PS7YFldoOS5aebUzmX010tvzR7goTk=
----------------------EOF-----------------------

 

[SleepyDude]

Hi,

Sorry I forgot to add to run SURT after the fix.

If you don't notice anything strange with the system I doubt this is malware related because the problems are on the files used by Windows update, malware normally target the system files that are loaded from c:\windows c:\windows\ssytem32 etc.

I like ESET online scanner Online Malware Detection a full scan usually take several hours and make sure you don't have any other security program active to speedup the scan.

 

[SleepyDude]

Not sure if you edited your post or I missed this part!

What I also find suspicious is I keep having to download the SURT tool as it keeps getting corrupted, I've downloaded it to different folder locations, but when I got to execute after running it a couple of times it says installer encountered an error.
I download a new one call it something else it is fine, but if I keep the download name it gets corrupted after a few executions.

I have seen that error when the files gets corrupted during download or the HDD have problems! I found it very strange that the saved file simply gets corrupted specially if you shutdown or restart the machine properly so that the information on the HDD is correctly saved!

Did you notice if the SURT file size changed?

 

[daveguitaruno]

Thanks I'll give ESET a go then, File size appears the same, the SURT download isn't corrupted during download it happens afterwards, I can run it maybe a couple of times, then it gets corrupted. I always shutdown safely.
Here's the SURT BTW


=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2019-06-25 21:54

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f) CSI Manifest Failed Catalog Check 0x00000000 winsxs\Manifests\x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_11.2.9600.19002_none_16912967a7221812.manifest x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_11.2.9600.19002_none_16912967a7221812
(fix) CSI Manifest Failed Catalog Check CSI File Replaced File: x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_11.2.9600.19002_none_16912967a7221812.manifest From: C:\Windows\CheckSur\v1.0\windows6.1-7601-x64-clientcab4.cab
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_5ca6eb17137337f1 amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_5ca6eb17137337f1
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_9c229ed3ddb17764 x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_9c229ed3ddb17764
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_4f95660acc611f2b amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_4f95660acc611f2b
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_a93423e024c3902a x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_a93423e024c3902a
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_547567fcc9354e5e amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_547567fcc9354e5e
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_a45421ee27ef60f7 x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_a45421ee27ef60f7
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_97429ce1e0dd4831 x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_97429ce1e0dd4831
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_6186ed0910476724 amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_6186ed0910476724

Summary:
Seconds executed: 236
Found 9 errors
Fixed 1 errors
CSI Manifest Failed Catalog Check Total count: 1
Fixed: CSI Manifest Failed Catalog Check. Total count: 1
CSI C Mark Deployment Not Marked Total count: 8
Customer Experience report successfully uploaded. Thank you for participating. For more information, see the Microsoft Customer Experience Improvement Program on the Microsoft web site.

 

[SleepyDude]

The surt log doesn't show new problems this time, it fixed the file using the one we provide.

When possible restart the computer and then run SURT again, the normal is not to find more problems besides the benign entry's related with Avast.

 

[daveguitaruno]

Hi, Here's the latest SURT log. BTW I ran ESET it found 0 Viruses but it did delete a few PUPs

 

[SleepyDude]

Man the errors don't stop! I'm consulting my colleagues for ideas...

Fix attached to apply using SFCFix.

Run SURT after this and provide the log please.

Edit: Also lest scan using FRST...


Farbar Recovery Scan Tool (FRST)

• Download FRST or FRST x64 and save it to the Desktop.
  (Please pick the version that matches your operating system's bit type. If you don't know which version matches your system, try FRST if it say that is not compatible with your OS you have to use FRST64
• Execute FRST/FRST64 right click on the icon
  
  and choose Run as Administrator. Make sure all other windows are closed.
  (When the Tool opens for the first time you must click Yes on the disclaimer.)
  
  
• Press Scan button.
• It will produce a log called (FRST.txt) in the same directory the Tool is run from.
• The first time the Tool is run, it makes also another log (Addition.txt).
• Please attach both logs to your post.

 

[daveguitaruno]

Hi SleepyDude,
Thank you so much for all your help, I so sorry that I've taken up so much of your time.
I'm running an sfc /verifyonly see if it comes up with anything different issues.
I'll run the SURT and provide the log afterwards

 

[daveguitaruno]

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2019-06-26 21:35

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_5ca6eb17137337f1 amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_5ca6eb17137337f1
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_9c229ed3ddb17764 x86_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_9c229ed3ddb17764
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_4f95660acc611f2b amd64_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_4f95660acc611f2b
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_a93423e024c3902a x86_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_a93423e024c3902a
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_547567fcc9354e5e amd64_policy.14.0.avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_547567fcc9354e5e
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_a45421ee27ef60f7 x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_a45421ee27ef60f7
(f) CSI C Mark Deployment Not Marked 0x00000000 c!policy.14.0..t.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_97429ce1e0dd4831 x86_policy.14.0.avast.vc140.crt_fcc99ee6193ebbca_14.0.27012.0_none_97429ce1e0dd4831
(f) CSI C Mark Deployment Not Marked 0x00000000 c!avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_6186ed0910476724 amd64_avast.vc140.mfc_fcc99ee6193ebbca_14.0.27012.0_none_6186ed0910476724

Summary:
Seconds executed: 507
Found 8 errors
CSI C Mark Deployment Not Marked Total count: 8
Customer Experience report successfully uploaded. Thank you for participating. For more information, see the Microsoft Customer Experience Improvement Program on the Microsoft web site.

 

[SleepyDude]

Hi,

Can your run SURT one more time and the result of FRST scan from post #152

 

[daveguitaruno]

Hi,
Here's the result of FRST scan from post #152 and here's the SURT log as well

 

[daveguitaruno]

Looking at the SURT log I realise I have to reboot and run it again

 

[daveguitaruno]

Here's the latest run of the SURT

 

[SleepyDude]

Hi Dave,

The last two SURT logs are ok.

From the FRST logs it seems Windows registered an error accessing a external HDD

Error: (06/26/2019 07:57:50 PM) (Source: atapi) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Ide\IdePort1.

 

[SleepyDude]

I only want to do a small fix with FRST...

Farbar Recovery Scan Fix

!!! WARNING !!! The following fix is only relevant for this system and no other, running the script on another computer will not work and may cause problems...

• Highlight the contents of the box below, right click on it and select Copy to transfer the script to the Windows Clipboard
  

  Start::
  CreateRestorePoint:
  CloseProcesses:
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
  FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
  Task: {A167DB0A-E9F1-4F8A-B14A-7A22C2E28EFE} - System32\Tasks\{4AA5F333-A208-4736-9523-82C578527B7F} => C:\Windows\system32\pcalua.exe -a "D:\My Downloads\Win7Fixes\NetFx20SP1_x64.exe" -d "D:\My Downloads\Win7Fixes"
  Task: {CFC2B5C7-E2BA-4DE8-8E52-BAA8DA840FB0} - System32\Tasks\{92F8D9B5-CCF1-4733-95A8-EF769B6DC958} => C:\Windows\system32\pcalua.exe -a "D:\My Downloads\Win7Fixes\NetFx20SP2_x64.exe" -d "D:\My Downloads\Win7Fixes"
  VirusTotal: C:\Users\Dave\AppData\Roaming\msregsvv.dll
  EmptyTemp:
  End::

• Execute FRST/FRST64 right click on the icon
  
  and choose Run as Administrator. Make sure all other windows are closed.
  
  
• Press the Fix button just once and Wait, FRST will read the instructions from the Clipboard. After the fix the system needs to restart if the tool does not request it please Restart the computer.
• The tool will make a log (Fixlog.txt) on the same location as FRST/FRST64 please post it in your next reply.

By the way I don't recommend the use of any of those programs:
- Ashampoo WinOptimizer 17
- Ashampoo WinOptimizer 2016
or similar because they have a very high potential to create problems messing with the Windows Registry, etc.