[HELP] SFC /scannow found corrupt files but was unable to fix

malis2007 · Jul 26, 2013

i don't know if this is the right section or not.. :/
but i need help with this problem ^ (the SFC /scannow found corrupt files but was unable to fix problem)
i have just ran the "SFC /scannow" thing and found it saying that..
i am afraid that my pc is damaged.., would you guys please help me fixing this problem?
here is my CBS.log attached..
please help me guys as soon as possible.

p.s: i don't want to run the windows repair thing.

NoelDP · Jul 27, 2013

Code:

 Line 38608: 2013-07-26 15:21:32, Info                  CSI    00000320 [SR] Repairing 4 components
 Line 38609: 2013-07-26 15:21:32, Info                  CSI    00000321 [SR] Beginning Verify and Repair transaction
 Line 38612: 2013-07-26 15:21:32, Info                  CSI    00000323 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38615: 2013-07-26 15:21:32, Info                  CSI    00000325 [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38618: 2013-07-26 15:21:32, Info                  CSI    00000327 [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38621: 2013-07-26 15:21:32, Info                  CSI    00000329 [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post a fix protocol for these later - in the meantime, Please download and save the CheckSUR tool from System Update Readiness Tool fixes Windows Update errors in Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it in your reply.

NoelDP · Jul 27, 2013

I've uploaded a file - ml7aa.zip - to my SkyDrive at Noel's SkyDrive

Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract

Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'

Pick that

You'll have to log in with your username and password.

Pick the option to use a Command Prompt

At the prompt type

DIR C:\ml7aa

hit the enter key - if you get a 'Not
Found' error try

DIR D:\ml7aa

or

DIR E:\ml7aa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\wfire <drive>:\windows\winsxs /y /i /s /v /h
(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time) and when the prompt returns, type

EXIT

and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt

then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link

malis2007 · Jul 27, 2013

NoelDP said:

Code:

 Line 38608: 2013-07-26 15:21:32, Info                  CSI    00000320 [SR] Repairing 4 components
 Line 38609: 2013-07-26 15:21:32, Info                  CSI    00000321 [SR] Beginning Verify and Repair transaction
 Line 38612: 2013-07-26 15:21:32, Info                  CSI    00000323 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38615: 2013-07-26 15:21:32, Info                  CSI    00000325 [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38618: 2013-07-26 15:21:32, Info                  CSI    00000327 [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 38621: 2013-07-26 15:21:32, Info                  CSI    00000329 [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post a fix protocol for these later - in the meantime, Please download and save the CheckSUR tool from System Update Readiness Tool fixes Windows Update errors in Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it in your reply.

The CheckSUR.log and CheckSUR.persist.log files are attached in this post

sorry for taking long.. it is just because of the difference in the time zones.. :/
i am working in your second post

please wait.. and thanks alot for caring about helping me :)
and i am so sorry for wasting your time.

malis2007 · Jul 27, 2013

NoelDP said:
I've uploaded a file - ml7aa.zip - to my SkyDrive at Noel's SkyDrive

Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract

Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'

Pick that

You'll have to log in with your username and password.

Pick the option to use a Command Prompt

At the prompt type

DIR C:\ml7aa

hit the enter key - if you get a 'Not
Found' error try

DIR D:\ml7aa

or

DIR E:\ml7aa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\wfire <drive>:\windows\winsxs /y /i /s /v /h
(e.g.XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time) and when the prompt returns, type

EXIT

and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt

then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link

when i try this: XCOPY C:\wfire C:\windows\winsxs /y /i /s /v /h
it tells me that the "wfire" file isn't found.
and "0 File<s> copied."
so.., anyhelp here please..? :/

--------------------------------Edit-------------------------------------
or should i type it as the following :
XCOPY C:\x86_microsoft-windows-fde_31bf3856ad364e35_6.1.7601.17514_none_aa136561b9ed4ae4 C:\windows\winsxs /y /i /s /v /h
..etc for each file/folder?
and btw.. my system is x64bit win7 home premium
and sorry for double posting.

NoelDP · Jul 27, 2013

Sorry - my fault

That command should be

XCOPY C:\ml7aa C:\windows\winsxs /y /i /s /v /h

I'll correct it now (if the forum software lets me) - I missed one of the normal edits I make to my boilerplate response.

NoelDP · Jul 27, 2013

The following errors were highlighted by the CheckSUR - the remainder are normal for a machine with IE10 installed

Code:

Checking Package Watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-EmbeddedCore-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist


 servicing\packages\Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521.mum
 servicing\packages\Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521.cat

Once we have the SFC out of the way, I'll post a fix for them as well

malis2007 · Jul 27, 2013

wierd.. i get this after i finished the SFC thing.. :

Code:

Microsoft Windows [Version 6.1.7601]Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>SFC /SCANNOW


Beginning system scan.  This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


C:\Windows\system32>

and i have no idea what the hell dose it means :/
anyway.. i uploaded the new cbs log here in this post attachment
and btw.., i dont want IE10

i tried my best to uninstall it but i always fail and get an error while uninstalling.
so please help me getting rid of it :/
i want IE9 or IE8
Thanks alot for your help sofar. :)

NoelDP · Jul 27, 2013

That response from SFC is exactly what I was hoping for :) It means that I cot all the right files, and you put them in the right place.

Next step is to repair the .mum and .cat files from the CheckSUR report.
I've uploaded a file - ml7ab.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder ml7ab in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

malis2007 · Jul 27, 2013

NoelDP said:
That response from SFC is exactly what I was hoping for :) It means that I cot all the right files, and you put them in the right place.

Next step is to repair the .mum and .cat files from the CheckSUR report.
I've uploaded a file - ml7ab.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder ml7ab in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

thanks alot.. you are my hero!

i have done this now :)

But.. about this :

NoelDP said:
Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

i don't know what you do mean with it.. this "CheckSUR " tool and where it dose exist :/

--edit--
or you mean to run this tool : System Update Readiness Tool fixes Windows Update errors in Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008 ?
if so.. shall i redownload it? :)
or just reinstalling it from the time i have downloaded it(from my harddisk)?

---edit---
nvm.. i am Re-installing it from my harddisk atm

malis2007 · Jul 27, 2013

NoelDP said:
Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

done running it

The "CheckSUR" log file is attached in this post :)
Thanks alot for your help so far.
and i am so sorry for my weird questions..
and my bad english.

NoelDP · Jul 28, 2013

Good - that's fixed the Package errors, so all we have to worry about now is the Watchlist errors....

Code:

Checking Package Watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-EmbeddedCore-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-InternetExplorer-Package-MiniLP~31bf3856ad364e35~amd64~en-US~10.2.9200.16521 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~x86~~0.0.0.0 Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~10.2.9200.16437 Package registry presence failed, possibly an orphaned package on package watchlist

While essentially fairly simple to fix, the problem here arises from the permissions that are applied to the registry entries we need to adjust, which complicate a manual fix considerably, and there is no automated tool for the job that I'm aware of (unless Richard/Niemiro knows of one?)

I'll work up and instruction set for you for the first one, and see how you get on - but I have to go out soon and may not get back until late, so it may not be until Monday evening (UK time) that I can post them.

niemiro · Jul 30, 2013

NoelDP said:
While essentially fairly simple to fix, the problem here arises from the permissions that are applied to the registry entries we need to adjust, which complicate a manual fix considerably, and there is no automated tool for the job that I'm aware of (unless Richard/Niemiro knows of one?

Yes...there is now one :) Applying the registry script through SFCFix will deal with the permissions for you. The problem is, there are a couple of bugs in there in at moment (I've fixed them in my private build, but haven't yet been able to make that build public as its tied in up version 2.0 which isn't yet ready).

I'll post you more details :)

Richard

NoelDP · Jul 31, 2013

Thanks, Richard - but it's going to take me a while to learn the details of that! :S

malis2007
For my peace of mind, please run the following command and post the output, before we start tinkering - I don't want any unpleasant surprises!....

REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0" /S

Here are some instructions to make lifeeasier :)
1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.
2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.
3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

malis2007 · Jul 31, 2013

hey all, thank you very much for helping me :)
here is the output/the whole cmd text.. xD :

Code:

Microsoft Windows [Version 6.1.7601]Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Co
mponent Based Servicing\PackageDetect\Microsoft-Windows-Embedded-SKU-Foundation-
Package~31bf3856ad364e35~x86~~0.0.0.0" /S


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Ser
vicing\PackageDetect\Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856a
d364e35~x86~~0.0.0.0
    Microsoft-Windows-IE-Spelling-Parent-Package-English~31bf3856ad364e35~~~10.2
.9200.16437    REG_DWORD    0x2
    Microsoft-Windows-IE-Hyphenation-Parent-Package-English~31bf3856ad364e35~~~1
0.2.9200.16437    REG_DWORD    0x2




C:\Windows\system32>

NoelDP · Jul 31, 2013

Ah, good - that makes me a little more confident:)

Open Regedit
Navigate to the
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\
key
and find the
Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0

subkey

right-click on the subkey to highlight it and select Permissions
Click on the Advanced button
Click on the Owner tab
highlight 'Administrators' in the box, and click Apply
put a tick in the 'Replace owner...' box, and click Apply
Click on the Permissions tab
highlight Administrators
Click Edit
put a tick in the Allow/Full Control box and click OK
put a tick in the 'Replace all child...' box and click Apply
Accept the warning
Click OK twice to get back into Regedit

in the right pane, delete both the entries found
(highlight each and hit the delete button - accept the warning if you're sure you got the right one)
THERE IS NO UNDO OPTION IN REGEDIT!

Now we have to get permissions back to where they should be....
right-click on the subkey name again, and select Permissions
Click on Advanced
There should be two entries for Administrators
Highlight Administrators (with Full Control - not inherited) - make sure that the other Administrators entry with Read permissions still exists!
click Remove
Click on the Owner tab
Click 'Other users or groups'
in the box, type
NT SERVICE\TrustedInstaller
and click on 'Check Names' - the entry should change to TrustedInstaller
click OK three times

...and you should be back in Regedit

Close Regedit, and reboot
Now run CheckSUR again, and we'll see how you did :)

Then we'll deal with the other keys...

.

malis2007 · Jul 31, 2013

NoelDP said:
Ah, good - that makes me a little more confident:)

Open Regedit
Navigate to the
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\
key
and find the
Microsoft-Windows-Embedded-SKU-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0

subkey

right-click on the subkey to highlight it and select Permissions
Click on the Advanced button
Click on the Owner tab
highlight 'Administrators' in the box, and click Apply
put a tick in the 'Replace owner...' box, and click Apply
Click on the Permissions tab
highlight Administrators
Click Edit
put a tick in the Allow/Full Control box and click OK
put a tick in the 'Replace all child...' box and click Apply
Accept the warning
Click OK twice to get back into Regedit

in the right pane, delete both the entries found
(highlight each and hit the delete button - accept the warning if you're sure you got the right one)
THERE IS NO UNDO OPTION IN REGEDIT!

Now we have to get permissions back to where they should be....
right-click on the subkey name again, and select Permissions
Click on Advanced
There should be two entries for Administrators
Highlight Administrators (with Full Control - not inherited) - make sure that the other Administrators entry with Read permissions still exists!
click Remove
Click on the Owner tab
Click 'Other users or groups'
in the box, type
NT SERVICE\TrustedInstaller
and click on 'Check Names' - the entry should change to TrustedInstaller
click OK three times

...and you should be back in Regedit

Close Regedit, and reboot
Now run CheckSUR again, and we'll see how you did :)

Then we'll deal with the other keys...

.

i am so sorry but.., where is "HKLM"? :/
i cant find it xD

malis2007 · Jul 31, 2013

never mind about the previous post.. xD
i manged to find it

"HKLM" = "HKEY_LOCAL_MACHINE", right?

i am running the CHECKSUR tool at the moment.. please wait

Thanks alot for helping me! :)

--------------------
edit i am so sorry for the double post.. i am just unable to edit the previous post :/

malis2007 · Jul 31, 2013

the new CheckSUR log is attached in this post.. :)
Thanks alot for helping me :)

NoelDP · Aug 1, 2013

Great - that's done exactly what it was supposed to have done - and we're a third of the way home :)

Please run the following commands - again for my peace of mind - and post the results....

REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-EmbeddedCore-Package~31bf3856ad364e35~amd64~~0.0.0.0" /S
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~0.0.0.0" /S

[HELP] SFC /scannow found corrupt files but was unable to fix

Well-known member

Attachments

Windows Update Analyst, Contributor

Windows Update Analyst, Contributor

Well-known member

Attachments

Well-known member

Windows Update Analyst, Contributor

Windows Update Analyst, Contributor

Well-known member

Attachments

Windows Update Analyst, Contributor

Well-known member

Well-known member

Attachments

Windows Update Analyst, Contributor

Senior Administrator, Windows Update Expert

Windows Update Analyst, Contributor

Well-known member

Windows Update Analyst, Contributor

Well-known member

Well-known member

Well-known member

Attachments

Windows Update Analyst, Contributor