Need Help With SFC-Corrupt Files - crf8j100

crf8j100 · Jan 8, 2013

Re: Need Help With SFC-Corrupt Files

Hi, I'm new to your forum and may have the same general problem. I had never performed sfc /scannow before McAfee was trying to fix my computer from it not booting after implementing their latest McAfee update. Their tech support said I had to fix the errors found by sfc before they would assist me further. Since that time, I've uninstalled McAfee and am using Microsoft Security Essentials and Firewall. I want to go back to McAfee since I have a free subscription with my cable company, and feel McAfee is a better product than Security Essentials.

The sfc said it found problems that would be fixed on the next reboot, but after reboot, the problems persist. Like David's CBS log, I have corrupted files in:
C:\Windows\system32\wbem\Wdf01000Uninstall.mof and Wdf01000.mof as in the attached CBS.zip file.

Here is my SystemLook Log:

Code:

SystemLook 30.07.11 by jpshortstuff
Log created at 21:41 on 07/01/2013 by Tony
Administrator - Elevation successful

========== filefind ==========

Searching for "Wdf01000.mof"
C:\Windows\System32\wbem\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_8026b5a71e6bdaaf\Wdf01000.mof    --a---- 4052 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 7FD159DACD1A39669F2177A727FB16D2
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000.mof    --a---- 4052 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 7FD159DACD1A39669F2177A727FB16D2
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.18703_none_765626621de95100\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.23004_none_76e09d7f37063a8a\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.22806_none_78c93ba5342a8968\Wdf01000.mof    --a---- 4495 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 309C7A9116344458026272DF77259E91

Searching for "Wdf01000Uninstall.mof"
C:\Windows\System32\wbem\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6000.16386_none_8026b5a71e6bdaaf\Wdf01000Uninstall.mof    --a---- 118 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 25395AE03FAC845654C0FA5F89D2BA06
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary-mof_31bf3856ad364e35_6.0.6001.18000_none_825d77a31b56eb83\Wdf01000Uninstall.mof    --a---- 118 bytes    [08:54 02/11/2006]    [21:43 18/09/2006] 25395AE03FAC845654C0FA5F89D2BA06
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.18703_none_765626621de95100\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6001.23004_none_76e09d7f37063a8a\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.18574_none_77f1eb061b478039\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565
C:\Windows\winsxs\x86_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.0.6002.22806_none_78c93ba5342a8968\Wdf01000Uninstall.mof    --a---- 112 bytes    [17:12 12/12/2012]    [14:34 02/06/2012] 1B866FA9F7AED13952C2D0E6CE08D565

-= EOF =-

Any help in fixing this? I never had an IE8, I went directly to IE9 from IE7. I did uninstall IE9 and reinstall it, thinking that may have been an issue, but after uninstalling IE9 and running sfc /scannow, the problems were still there. I would have given more information as requested above of David in SkyDrive, but Microsoft will not accept my username/password even after repeatedly requesting it to be reset, receiving the email and applying the new password. I've requested e-mail help from them to resolve this issue.

I've also ran System Update Readiness, and here is that log:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 14.0
2012-02-29 12:21

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257    
(f)    CSI Manifest Missing    0x00000002    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02    

Summary:
Seconds executed: 3258
 Found 2 errors
  CSI Manifest Missing Total count: 1
  CSI Payload File Missing Total count: 1

Unavailable repair files:
    winsxs\manifests\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest



=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 17.0
2013-01-07 11:48

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257    

Summary:
Seconds executed: 3218
 Found 1 errors
  CSI Payload File Missing Total count: 1

It seems there is a problem and maybe this is an easier fix? Thanks a lot for your time.

Tony

niemiro · Jan 8, 2013

This thread has been created for crf8j100. His original post has been copied above. It origially came from post 65 of this thread: https://www.sysnative.com/forums/wi...d-help-system-file-checker-corrupt-files.html

To understand the full context of this thread, that thread must be read first, as the issues are almost identical.

crf8j100 · Jan 8, 2013

Hi Richard,

Here is where you can find my components.zip file: https://skydrive.live.com/#cid=42DF18873F54095D&id=42DF18873F54095D!105

And attached is my RegistryExport1.reg zipped file.

Please let me know if there is anything else I can supply you to help with finding a solution.

Again, thanks a lot for your assistance! :thumbsup2:

niemiro · Jan 9, 2013

Thanks for posting that. Can you please wait a couple of days rather than attempting what I have posted for Bobster52. Your computers are more different than perhaps is obviously apparent.

Thank you!

Richard

crf8j100 · Jan 9, 2013

Yes, I'll wait. :bored2: Thanks Richard! :thumbsup2:

niemiro · Jan 10, 2013

Hello again Tony :)

I am not too impressed by the McAfee tech's response TBH. Your SFC corruption had nothing to do with your McAfee problem, and they shouldn't have taken the very first opportunity to dump you as soon as it was clear the fix wasn't going to be simple/the tech didn't know how to properly deal with the boot problem. At the very minimum he should have taken logs to see whether it is relevant rather than just dump you. Many SFC "corruptions" are actually the result of a sidebar config file which should never have been scanned by SFC. How can they dump every user with a sidebar config non-issue from the factory? Anyway:

Two parts to this fix. First:

WARNING: This fix has been created specifically for crf8j100. If you are not crf8j100, do not follow these instructions as you may cause serious harm to your computer.

Download a copy of SFCFixScript.zip attached to this post, and save it to your Desktop.

Then download a copy of SFCFix.exe from here: https://www.sysnative.com/forums/downloads/sfcfix/, and also save it to your Desktop.

Single click on SFCFixScript.zip and drag and drop it on top of SFCFix.exe. SFCFix will open and perform a fix for your CheckSUR.log corruption.

A logfile called SFCFix.txt will open (and be saved to your Desktop). Please copy and paste the report into your next reply.

Then, please re-run the System Update Readiness Tool, and post another C:\Windows\Logs\CBS\CheckSUR.persist.log. With any luck, you won't get any errors in there this time around.

Part 2:

Please uninstall update KB2761494: Remove an update
restarting your computer if necessary. Then, please re-run SFC, and let me know if it fixes your SFC problem.

Please note that this cannot be a permanent solution, as then you won't get the benefits of that update, which is a bad thing. I intend for this to be only a temporary solution until I can discuss further with others. Please wait around until I can work on a permanent fix for you.

It would also help me, although this is a completely optional step, to take some additional registry exports after your have uninstalled the update. I do not expect you to do this. However, it would be truly great if you could. The COMPONENTS hive is more important than the CBS key, if you only have time to perform one part of it.

Export CBS folder

Click the Start button

then click Computer.
Double-click on the C: drive, under the Hard Disk Drives category, and then scroll down to, and double click on the Windows folder.
Find and double click on the Logs folder.
Right-click on the CBS folder, and select Copy.
Go back to your Desktop, right-click on it, and select Paste. You should now see a copy of the CBS folder appear on your Desktop called CBS.
Right-click on this new folder, and navigate through Send to, and select Compressed (zipped) folder.
A new file, also called CBS (CBS.zip), but this time with a different icon, will be created.

Please upload CBS.log to your next reply.

--------------

Next, please download the Freeware RegBak from here: Acelogix Software - Download products

Navigate to C:\Windows\RegBak\{Date}\ and copy the COMPONENTS file to your Desktop.

Now right click on it > Send to > Compressed (zipped) folder.

Then please upload it to your favourite file sharing website (it will be too big for here). If you have a Microsoft Account, SkyDrive could be a good choice: https://skydrive.live.com/

--------------

Finally, please open Elevated Command Prompt (How to start an Elevated Command Prompt in Windows 7 and Vista) and type in:

reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" %userprofile%\Desktop\RegistryExport1.reg

Then please zip up and upload RegistryExport1.reg, which will be on your Desktop.

Thank you very much. Again, I honestly do not mind if you are really busy at the moment, and don't want to perform the last part.

Richard

crf8j100 · Jan 11, 2013

Hey again Richard,

I completely agree with you about the McAfee Tech support people. It was actually my second call where their "expert" called me back after the first level of support could not fix my problem after spending about an hour taking over my computer and doing various things. Why it wouldn't boot after installing their latest update is still a mystery since the errors you see were not related to not booting up. Nevertheless, here is Part 1 - the log from SFCFix:

Code:

SFCFix version 1.1.0.1 by niemiro.
Start time: 2013-01-10 20:49:13.314
Using .zip script file at C:\Users\Tony\Desktop\SFCFixScript.zip

 


TakePermissions::
Successfully took permissions for file or folder C:\Windows\Winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257
TakePermissions:: directive completed successfully.

 


CopyFiles::
Failed to copy file \\?\C:\Users\Tony\AppData\Local\niemiro\Archive\ieinstal.exe to \\?\C:\Windows\Winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257\ieinstal.exe with error code 0x5.
CopyFiles:: directive completed successfully.

 


RestorePermissions::
Successfully restored ownership for C:\Windows\Winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257
Successfully restored permissions on C:\Windows\Winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257
RestorePermissions:: directive completed successfully.

 


Successfully processed all directives.
SFCFix version 1.1.0.1 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2013-01-10 20:49:15.434
----------------------EOF-----------------------

I ran the System Readiness tool again, and here is the result:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 14.0
2012-02-29 12:21

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257   
(f)    CSI Manifest Missing    0x00000002    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest    x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02   

Summary:
Seconds executed: 3258
 Found 2 errors
  CSI Manifest Missing Total count: 1
  CSI Payload File Missing Total count: 1

Unavailable repair files:
    winsxs\manifests\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.manifest



=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 17.0
2013-01-07 11:48

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store
(f)    CSI Payload File Missing    0x00000000    ieinstal.exe    x86_microsoft-windows-ieinstal_31bf3856ad364e35_6.0.6000.16890_none_e6544ef894c4c257   

Summary:
Seconds executed: 3218
 Found 1 errors
  CSI Payload File Missing Total count: 1


=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 17.0
2013-01-10 14:01

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

=================================
Checking System Update Readiness.
Binary Version 6.0.6002.22574
Package Version 17.0
2013-01-10 16:01

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 3030
 No errors detected

Yeah! :dance: No errors! :thumbsup2:

Part 2 - Removed the KB2761494 update and ran sfc /scannow and received errors as shown in: View attachment CBS_before.zip

Restarted my System, and now for the hallelujah - "Windows Resource Protection did not find any integrity violations."

Here is that log: View attachment CBS_after.zip

Now for the extra part which I am happy to do since you did so much for me and others with this issue. The latest RegisteryExport1 file is here: View attachment RegistryExport1 (2).zip

And the latest components (2).zip file is found here: https://skydrive.live.com/#cid=42DF18873F54095D&id=42DF18873F54095D!105

If there is anything more you would like from me, just say the word. The last thing left would be to update windows with KB2761494 again once you ask around or figure out why that would cause the integrity violations it did. For the moment, I've set update KB2761494 as hidden until such time as you give me the go ahead for installing it again. I'll leave McAfee uninstalled, because I'm afraid if I reinstall it, I'll have the same reboot issue as before, and when that happened before, I had to toggle the power on my machine, then choose the repair option after it started again, then revert back to known good configuration, which may back out all of the good work we've just completed. So for now, I'll be content to use Microsoft Security Essentials and Microsoft Firewall.

I'll check back from time to time seeing what any of these files or your further research may uncover.

Again, thanks a lot for your assistance! You're the best! :thumbsup2:

Tony

Need Help With SFC-Corrupt Files - crf8j100

crf8j100

Registered Member, Contributor

Attachments

niemiro

Senior Administrator, Windows Update Expert

crf8j100

Registered Member, Contributor

Attachments

niemiro

Senior Administrator, Windows Update Expert

crf8j100

Registered Member, Contributor

niemiro

Senior Administrator, Windows Update Expert

Attachments

crf8j100

Registered Member, Contributor