[SOLVED] Windows Resource Protection found corrupt files but was unable to fix

Sydney · Sep 13, 2013

Hello,
I'm new here so I wanted to start by saying hi and thanks in advance for any help you guys might be able to provide... I'm kinda stuck and REALLY appreciate any ideas you might point me toward.

I'm trying to help a friend who has been having some pop-up errors like the ones I've pasted text for below. In an effort to help fix them, I did a chkdsk /r scan (I've pasted the log below), and a hard drive Short DST scan with SeaTools (which passed).

I then tried sfc /scannow.

The result is:

Windows Resource Protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

I've attached the CBS log folder to this thread per the forum instructions :)
My hope is that if I'm able to complete the SFC scan, perhaps windows will behave better and I can resolve those other popups...

Many thanks and please let me know if I left anything out or if I can provide any further info!
(see error text and chkdsk log below)

Sydney
View attachment 5265

Errors I was seeing:
---------------------------
ApplnchConfig.exe - Bad Image
---------------------------
C:\Windows\system32\adsldpc.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
---------------------------
OK
---------------------------

---------------------------
Msg: FlashPlayerPlugin_11_7_700_224.exe - Bad Image
---------------------------
C:\Windows\System32\MMDevApi.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
---------------------------
OK
---------------------------

CHKDSK Log:
Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 9/10/2013 4:15:40 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
147456 file records processed.

File verification completed.
355 large file records processed.

0 bad file records processed.

19716 EA records processed.

89 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
206744 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
147456 file SDs/SIDs processed.

Cleaning up 33 unused index entries from index $SII of file 0x9.
Cleaning up 33 unused index entries from index $SDH of file 0x9.
Cleaning up 33 unused security descriptors.
Security descriptor verification completed.
29645 data files processed.

CHKDSK is verifying Usn Journal...
37401504 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
147440 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
217724418 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

957249535 KB total disk space.
85999896 KB in 116159 files.
71412 KB in 29646 indexes.
0 KB in bad sectors.
280555 KB in use by the system.
65536 KB occupied by the log file.
870897672 KB available on disk.

4096 bytes in each allocation unit.
239312383 total allocation units on disk.
217724418 allocation units available on disk.

Internal Info:
00 40 02 00 18 35 02 00 81 1a 04 00 00 00 00 00 .@...5..........
33 01 00 00 59 00 00 00 00 00 00 00 00 00 00 00 3...Y...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

tom982 · Sep 13, 2013

Hello Sydney, welcome to Sysnative!

Your SFC corruption is here:

Code:

013-09-13 13:48:36, Info                  CSI    00000335 [SR] Repairing 2 components
2013-09-13 13:48:36, Info                  CSI    00000336 [SR] Beginning Verify and Repair transaction
2013-09-13 13:48:36, Info                  CSI    00000337 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll do not match actual file [l:22{11}]"adsldpc.dll" :
  Found: {l:32 b:mlFeUgkjsvaWdBilmn+MbOcIgzyvYWJLwxAGla9OUPo=} Expected: {l:32 b:ClCjWGPJZ56N/AeD1fH2QRAQhzc4xrHZC36ZPSxs+wY=}
2013-09-13 13:48:36, Info                  CSI    00000338 [SR] Cannot repair member file [l:22{11}]"adsldpc.dll" of Microsoft-Windows-Active-Directory-Services-Interface-LDAPC-Layer, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-13 13:48:36, Info                  CSI    00000339 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll do not match actual file [l:24{12}]"MMDevAPI.dll" :
  Found: {l:32 b:VRHJJLgHFV4TDawvVtgr6ihcpE1fqMGN9dJ7r/FPGz8=} Expected: {l:32 b:dV+mf3vxDjxjNniNKX+6pw8o9jCFKkOnjT99fjp+ztA=}
2013-09-13 13:48:36, Info                  CSI    0000033a [SR] Cannot repair member file [l:24{12}]"MMDevAPI.dll" of Microsoft-Windows-MMDeviceAPI, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-13 13:48:36, Info                  CSI    0000033b Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll do not match actual file [l:22{11}]"adsldpc.dll" :
  Found: {l:32 b:mlFeUgkjsvaWdBilmn+MbOcIgzyvYWJLwxAGla9OUPo=} Expected: {l:32 b:ClCjWGPJZ56N/AeD1fH2QRAQhzc4xrHZC36ZPSxs+wY=}
2013-09-13 13:48:36, Info                  CSI    0000033c [SR] Cannot repair member file [l:22{11}]"adsldpc.dll" of Microsoft-Windows-Active-Directory-Services-Interface-LDAPC-Layer, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-13 13:48:36, Info                  CSI    0000033d [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-13 13:48:36, Info                  CSI    0000033e Hashes for file member \??\C:\Windows\SysWOW64\adsldpc.dll do not match actual file [l:22{11}]"adsldpc.dll" :
  Found: {l:32 b:mlFeUgkjsvaWdBilmn+MbOcIgzyvYWJLwxAGla9OUPo=} Expected: {l:32 b:ClCjWGPJZ56N/AeD1fH2QRAQhzc4xrHZC36ZPSxs+wY=}
2013-09-13 13:48:36, Info                  CSI    0000033f Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll do not match actual file [l:22{11}]"adsldpc.dll" :
  Found: {l:32 b:mlFeUgkjsvaWdBilmn+MbOcIgzyvYWJLwxAGla9OUPo=} Expected: {l:32 b:ClCjWGPJZ56N/AeD1fH2QRAQhzc4xrHZC36ZPSxs+wY=}
2013-09-13 13:48:36, Info                  CSI    00000340 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:22{11}]"adsldpc.dll"; source file in store is also corrupted
2013-09-13 13:48:36, Info                  CSI    00000341 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll do not match actual file [l:24{12}]"MMDevAPI.dll" :
  Found: {l:32 b:VRHJJLgHFV4TDawvVtgr6ihcpE1fqMGN9dJ7r/FPGz8=} Expected: {l:32 b:dV+mf3vxDjxjNniNKX+6pw8o9jCFKkOnjT99fjp+ztA=}
2013-09-13 13:48:36, Info                  CSI    00000342 [SR] Cannot repair member file [l:24{12}]"MMDevAPI.dll" of Microsoft-Windows-MMDeviceAPI, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-09-13 13:48:36, Info                  CSI    00000343 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-09-13 13:48:36, Info                  CSI    00000344 Hashes for file member \??\C:\Windows\SysWOW64\MMDevAPI.dll do not match actual file [l:24{12}]"MMDevAPI.dll" :
  Found: {l:32 b:VRHJJLgHFV4TDawvVtgr6ihcpE1fqMGN9dJ7r/FPGz8=} Expected: {l:32 b:dV+mf3vxDjxjNniNKX+6pw8o9jCFKkOnjT99fjp+ztA=}
2013-09-13 13:48:36, Info                  CSI    00000345 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll do not match actual file [l:24{12}]"MMDevAPI.dll" :
  Found: {l:32 b:VRHJJLgHFV4TDawvVtgr6ihcpE1fqMGN9dJ7r/FPGz8=} Expected: {l:32 b:dV+mf3vxDjxjNniNKX+6pw8o9jCFKkOnjT99fjp+ztA=}
2013-09-13 13:48:36, Info                  CSI    00000346 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:24{12}]"MMDevAPI.dll"; source file in store is also corrupted

I don't have time to fix this today, and have a very long day at work tomorrow, so I'll do my best to get a fix to you by tomorrow evening :)

Tom

Sydney · Sep 13, 2013

You're amazingly fast :) THANKS SO MUCH. certainly, much appreciated... of course I'm happy to have you provide a fix, but if you want to point me in any specific direction to research this I'm happy to help! :)

tom982 · Sep 13, 2013

Hi Sydney,

Having looked at the files, I see one's an RTM file and the other is an SP1 file, so it's only a minute or two for me to hunt them down. Here's the fix :)

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a file should be created on your Desktop: SFCFix.txt.
Copy (Ctrl + C) and Paste (Ctrl + V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/16537616/Fixes/SFCFix/Scripts/Sydney/SFCFix.zip

SFC Scan

Click on the Start

button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Tom

Sydney · Sep 13, 2013

Tom-- THANKS! :) That's awesome! I think I'm all set! I would have been lost. Were these files I could have pulled off the windows install cd? Or expanded out from a download of SP1? you mentioned one was an RTM file and another an SP1 file... Just trying to see if I might be more self-sufficient next time :)

The CBS.txt file was 10MB+, so I zipped it and attached it HERE: View attachment cbslog.zip

Here's the log from SFCFix:

Code:

SFCFix version 1.5.7.0 by niemiro.
Start time: 2013-09-13 22:05:38.382
Using .zip script file at C:\Users\bmorris\Desktop\SFCFix.zip




PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll
Successfully took permissions for file or folder C:\Windows\winsxs\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll

Successfully copied file \\?\C:\Users\bmorris\AppData\Local\niemiro\Archive\winsxs\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll to \\?\C:\Windows\winsxs\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll.
Successfully copied file \\?\C:\Users\bmorris\AppData\Local\niemiro\Archive\winsxs\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll to \\?\C:\Windows\winsxs\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll.

Successfully restored ownership for C:\Windows\winsxs\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll
Successfully restored permissions on C:\Windows\winsxs\x86_microsoft-windows-mmdeviceapi_31bf3856ad364e35_6.1.7601.17514_none_570bad8317a3f395\MMDevAPI.dll
Successfully restored ownership for C:\Windows\winsxs\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll
Successfully restored permissions on C:\Windows\winsxs\x86_microsoft-windows-a..terface-ldapc-layer_31bf3856ad364e35_6.1.7600.16385_none_5f08ca5cc7d0eeed\adsldpc.dll
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 1.5.7.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2013-09-13 22:05:39.426
----------------------EOF-----------------------

tom982 · Sep 16, 2013

Hi Sydney,

Sorry for the delay, I thought I'd replied to this! All sorted!

Code:

2013-09-13 15:15:59, Info                  CSI    0000066c Repair results created:
POQ 277 starts:
 
POQ 277 ends.
2013-09-13 15:15:59, Info                  CSI    0000066d [SR] Repair complete

Possible file sources:

adsldpc.dll
-Any Windows 7 system or ISO image, regardless of architecture and updates installed

MMDevAPI.dll
-Any Windows 7 SP1 system or ISO image, regardless of architecture
-Extracted from SP1 update

Whilst I admire your drive to become more self-sufficient for next time, I would advise you against replacing any system files yourself because if permissions and ownership aren't restored on a file after replacing it, it leaves your system potentially open to attack.

Tom

[SOLVED] Windows Resource Protection found corrupt files but was unable to fix

Sydney

New member

tom982

Emeritus

Sydney

New member

tom982

Emeritus

Sydney

New member

tom982

Emeritus