icrav03.rat corruption unable to install updates

T

trmpluym

Member
Joined
Jul 25, 2015
Posts
20
Dear reader,

On a Windows 2012 R2 system there is a file corruption icrav03.rat ( see cbs.log and CBS.log and SFCFix.txt in the attachement).

I executed the following commands:

DISM /Online /Cleanup-Image /RestoreHealth
SFC /scannow

The last cannot fix the corruption.

I also cannot remove the related update: kb3205401

In the update file ( windows8.1-kb3205401-x64_90deeb4a6a70f1bb72a229bf8337f058ad0071a0.msu ) does not contain the icrav03.rat file.

Can anybody help me ?
 

Attachments

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.


  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
  5. Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a log should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.
 

Attachments

Code: 
SFCFix version 3.0.0.0 by niemiro.Start time: 2018-10-09 19:52:28.441
Microsoft Windows Server 2012 R2 Update 3 - amd64
Using .txt script file at C:\Users\PluymAdmin.domain1\Desktop\SFCFixScript.txt [0]








Trace::
Successfully traced component amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5.
    Package_379_for_KB3205401~31bf3856ad364e35~amd64~~6.3.1.4.3205401-576_neutral_GDR4
Trace:: directive completed successfully.








Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2018-10-09 19:52:29.776
Script hash: mbfac84+C1Y0I5SxQ70hr7FjWZrBD7+258O15GNF3dY=
----------------------EOF-----------------------
 
SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.



  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put
    Code:
    tags around the log to break up the text.





SFC Scan



  1. Click on the Start button and in the search box, type Command Prompt
  2. When you see Command Prompt on the list, right-click on it and select Run as administrator
  3. When command prompt opens, copy and paste the following commands into it, press enter after each

    sfc /scannow

    Wait for this to finish before you continue

    copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
  4. This will create a file, cbs.txt on your Desktop. Please attach this to your next post.
 

Attachments

Step#1 - DISM /RestoreHealth Scan
Warning:this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.



  1. Right-click on the Start button and select Command Prompt (Admin)
  2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
    Dism /Online /Cleanup-Image /RestoreHealth
  3. Once it finishes, copy and paste the following into the command-prompt window and press Enter. If prompted to overwrite the existing file go ahead.
    copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
  4. Once this has completed please go to your Desktop and you will find CBS.txt => Please zip/upload to this thread.
    Please Note:: if the file is too big (over 7MB) to upload to your next post, please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.
 
Here the result afther the DISM command line.

Afterwards i also tried an sfc /scannow (i also included the results from that scan)
 

Attachments

Looks fine !

Code: 
SFCFix version 3.0.0.0 by niemiro.Start time: 2018-10-10 17:32:28.518
Microsoft Windows Server 2012 R2 Update 3 - amd64
Using .zip script file at C:\Users\PluymAdmin.domain1\Desktop\SFCFix.zip [0]








PowerCopy::
Successfully took permissions for file or folder C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\icrav03.rat
Successfully took permissions for file or folder C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\icrav03.rat


Successfully copied file C:\Users\PluymAdmin.domain1\AppData\Local\niemiro\Archive\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\icrav03.rat to C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\icrav03.rat.
Successfully copied file C:\Users\PluymAdmin.domain1\AppData\Local\niemiro\Archive\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\icrav03.rat to C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\icrav03.rat.


Successfully restored ownership for C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\icrav03.rat
Successfully restored permissions on C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\icrav03.rat
Successfully restored ownership for C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\icrav03.rat
Successfully restored permissions on C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\icrav03.rat
PowerCopy:: directive completed successfully.








Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2018-10-10 17:32:28.857
Script hash: WW+3zrtdK784mKr+9fPmGgCwC9316qgepdN9MJIEUPg=
----------------------EOF-----------------------
 
Retrieve Components Hive
 1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service and just provide the link here.
 
Thanks!

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download attached file and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 

Attachments

Thanks again for helping me!


Here the fix result (looks fine):


Code: 
Fix result of Farbar Recovery Scan Tool (x64) Version: 10.10.2018
Ran by PluymAdmin (16-10-2018 18:40:05) Run:1
Running from C:\c
Loaded Profiles: PluymAdmin & scanner (Available Profiles: vma & ldaps & Administrator & PluymAdmin & scanner & PluymAdmin & Administrator)
Boot Mode: Normal
==============================================


fixlist content:
*****************
CreateRestorePoint:
cmd: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
DeleteValue:HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5|CF
DeleteValue:HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f|CF
*****************


Error: (0) Failed to create a restore point.


========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========


The operation completed successfully.


========= End of CMD: =========


"HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_cb3ca7c33fc4e8b5\\CF" => removed successfully
"HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.18538_none_6f1e0c3f8767777f\\CF" => removed successfully


==== End of Fixlog 18:40:07 ====


I was hopefull and ran a new 'SFC /scannow' but there where still some issues so a also tried another 'DISM /Online /Cleanup-Image /RestoreHealth'.
This command completes successfully but the 'SFC /scannow' keeps telling me the problem cannot be solved (see attachement).
 

Attachments

Thanks again !

I ran the tool, rebooted the server and executed an other 'sfc /scannow'. Here the results (see attachment).
 

Attachments

Remove Update Manually
 1. Click on the Start button and in the search box, type Command Prompt
2. When you see Command Prompt on the list, right-click on it and select Run as administrator
3. When command prompt opens, copy and paste the following command into it, press enter
wusa /uninstall /KB:3205401

4. Let me know if it says it was successful or if there are any errors.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top