[SOLVED] icrav03.rat corruption

Zonatis · Jun 6, 2022

Hello everybody,

After security rollup install sfc /scannow found corruption which couldn't be fixed.

Here is SFCFix report :

FCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-06 13:38:09.156
Microsoft Windows Server 2012 R2 Update 3 - amd64
Not using a script file.

AutoAnalysis::
CORRUPT: C:\windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20296_none_b4959c6b594e5f11\icrav03.rat
CORRUPT: C:\windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20296_none_587700e7a0f0eddb\icrav03.rat

SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 2
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2022-06-06 14:09:38.704
----------------------EOF-----------------------

I tried everything, SFCFix, DSIM and chkdsk but i can't fix the issue. Is there any solution to my problem ?

You can see CBS.log, SFCFix.log and dism.log

Thanks in advance.

Regards,

Maxstar · Jun 11, 2022

Hi and welcome to Sysnative,

Step 1. Run SFCFix again with the attached ZIP file.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Reboot the system and run the System File Checker.

Click the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator.
When command prompt opens, copy and paste the following command into it, and press enter.
Code:
```
sfc /scannow
```
Take a screenshot of the commandprompt window and paste it into your next reply.

Zonatis · Jul 13, 2022

Maxstar said:
Hi and welcome to Sysnative,

Step 1. Run SFCFix again with the attached ZIP file.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.

Download the attachment SFCFix.zip and save it to your desktop.

Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.

Once done, a file will appear on your desktop, called SFCFix.txt.

Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Reboot the system and run the System File Checker.

Click the Start button and in the search box, type Command Prompt

When you see Command Prompt on the list, right-click on it and select Run as administrator.

When command prompt opens, copy and paste the following command into it, and press enter.

Code:

sfc /scannow

Take a screenshot of the commandprompt window and paste it into your next reply.

Hello,

Thank you very much for your support.

I'm really sorry for the delay, my wife just gave birth to our child.

Here are the informations requested, it looks like sfc /scannow is still on error.

Any tips ?

Regards,

Maxstar · Jul 13, 2022

Hi,

Congratulations on the birth of your baby...

Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

Zonatis · Jul 13, 2022

Maxstar said:
Hi,

Congratulations on the birth of your baby...

Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.

Please copy this file to your desktop.

Note: If you receive an error that this file is in-use, simply reboot your computer and try again.

Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.

If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

Thank you very much

.

Here is the Link for COMPONENTS file, i hope it is the right one.

Regards,

Maxstar · Jul 13, 2022

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Right-click on the file FRST64.exe and choose Run as administrator.

Copy and paste the following (code) into the Search box and click the Search Files button.

Code:

icrav03.rat

When the scan is complete, a message will display that 'Search.txt' is saved in the same folder FRST was started from. Notepad will open this file also.
Post the logfile Search.txt as attachment in your next reply.

Zonatis · Jul 13, 2022

Maxstar said:
Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Right-click on the file FRST64.exe and choose Run as administrator.

Copy and paste the following (code) into the Search box and click the Search Files button.

Code:

icrav03.rat

When the scan is complete, a message will display that 'Search.txt' is saved in the same folder FRST was started from. Notepad will open this file also.

Post the logfile Search.txt as attachment in your next reply.

Hello again,

Here is the Search.txt file.

Regards,

Maxstar · Jul 13, 2022

Here is the next fix.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Open an elevated command prompt and run the System File Checler. Copy and paste the result in your next post.

Code:

sfc /scannow

Zonatis · Jul 13, 2022

Maxstar said:
Here is the next fix.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.

Download the attachment SFCFix.zip and save it to your desktop.

Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.

Once done, a file will appear on your desktop, called SFCFix.txt.

Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Open an elevated command prompt and run the System File Checler. Copy and paste the result in your next post.

Code:

sfc /scannow

I just applied the fix. (SFCFix.txt in attachment)

Here is the sfc /scannow result.

Looks like the issue is fixed isn't it ?

Code:

Microsoft Windows [version 6.3.9600]
(c) 2013 Microsoft Corporation. Tous droits réservés.

C:\windows\system32>sfc /scannow

Début de l'analyse du système. Cette opération peut nécessiter un certain temps.


Démarrage de la phase de vérification de l'analyse du système.
La vérification 100% est terminée.

Le programme de protection des ressources Windows n'a trouvé aucune violation d'
intégrité.

C:\windows\system32>

Maxstar · Jul 13, 2022

This looks good, please run the following command as well and copy and paste the result in your next post.

Code:

DISM /online /cleanup-image /RestoreHealth

Zonatis · Jul 15, 2022

Maxstar said:
This looks good, please run the following command as well and copy and paste the result in your next post.

Code:

DISM /online /cleanup-image /RestoreHealth

Code:

Microsoft Windows [version 6.3.9600]
(c) 2013 Microsoft Corporation. Tous droits réservés.

C:\windows\system32>DISM /online /cleanup-image /RestoreHealth

Outil Gestion et maintenance des images de déploiement
Version : 6.3.9600.19408

Version de l'image : 6.3.9600.19397

[==========================100.0%==========================]
La restauration s'est terminée correctement. Le magasin de composants a été répa
ré.
L'opération a réussi.

C:\windows\system32>

This looks good.

I really don't know how you made it, looks like magic for me.

Thank you so much, what a nice Gift of birth.

Best regards.

Maxstar · Jul 15, 2022

Hi,

You're welcome. If there are no further issues we can mark this thread as solved?

[SOLVED] icrav03.rat corruption

Zonatis

Member

Maxstar

Moderator, Windows Update Expert, Security Analyst

Attachments

Zonatis

Member

Attachments

Maxstar

Moderator, Windows Update Expert, Security Analyst

Zonatis

Member

Maxstar

Moderator, Windows Update Expert, Security Analyst

Zonatis

Member

Attachments

Maxstar

Moderator, Windows Update Expert, Security Analyst

Attachments

Zonatis

Member

Attachments

Maxstar

Moderator, Windows Update Expert, Security Analyst

Zonatis

Member

Maxstar

Moderator, Windows Update Expert, Security Analyst