SFC: amd64/x86 winsxs comsvcs.dll's corrupted

R

ravenize

Well-known member
Joined
Feb 21, 2018
Posts
213
Ran chkdsk C:, found 19 unindexed files

SFCFix version 3.0.0.0 by niemiro.
Start time: 2018-07-06 08:28:48.508
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.


AutoAnalysis::
CORRUPT: C:\Windows\winsxs\amd64_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_6.1.7601.24114_none_d171b991cf9b8028\comsvcs.dll
CORRUPT: C:\Windows\winsxs\x86_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_6.1.7601.24114_none_75531e0e173e0ef2\comsvcs.dll


SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 2
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.


Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2018-07-06 08:30:57.969
----------------------EOF-----------------------

Using the latest rollup security updates for Windows 7 SP1.

CBS.log:2018-07-06 05:13:22, Info CSI 00000266 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:22{11}]"comsvcs.dll"; source file in store is also corrupted
CBS.log:2018-07-06 05:14:19, Info CSI 0000034b [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:22{11}]"comsvcs.dll"; source file in store is also corrupted


CBS.log:2018-07-06 05:14:19, Info CSI 00000344 [SR] Cannot repair member file [l:22{11}]"comsvcs.dll" of Microsoft-Windows-COM-ComPlus-Runtime-QFE-CATSRVUT-COMSVCS, Version = 6.1.7601.24114, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
CBS.log:2018-07-06 05:14:19, Info CSI 00000346 [SR] Cannot repair member file [l:22{11}]"comsvcs.dll" of Microsoft-Windows-COM-ComPlus-Runtime-QFE-CATSRVUT-COMSVCS, Version = 6.1.7601.24114, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 
Anyone have a copy of these files? Also what are the odds both x64 and 32bit files would be corrupted without a malware infection? I did have a couple sudden power outages in the last few weeks.
 
Virus total shows the file in my c:\windows\syswow64\comsvcs.dll was never detected before... Antivirus scan for f44f23d1d7d142b7743cd19ae5e6285b1c21781ef540b80e15cdf7c649696d6a at
2018-07-06 13:54:13 UTC - VirusTotal

however


both of the following have been shown to been detected by virustotal previously:

CORRUPT: C:\Windows\winsxs\amd64_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_6.1.7601.24114_none_d171b991cf9b8028\comsvcs.dll
CORRUPT: C:\Windows\winsxs\x86_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_6.1.7601.24114_none_75531e0e173e0ef2\comsvcs.dll

Antivirus scan for 69755e587653293de2b386c200e8fffb4ddf15c2f1dea969b31e0babc3fd2f4d at
2018-06-29 13:19:53 UTC - VirusTotal

Antivirus scan for 41780603ab328f2f24683ff43d6a773e94b2e70752fb203e8b016f3d92185c6a at
2018-06-26 08:38:34 UTC - VirusTotal

The file size is exactly the same however the hash is different.
 
Ok ran the update and now I have zero file integrity violations :) Happy camper! I hope someone else finds this useful in some way.
 
softwaremaniac said:
Thanks for letting us know! Take care.
Click to expand...

OK have been grappling with this strange issue for a while, surt and sfc occasionally fix the problem. Seems some times just rebooting the computer fixes the issue. Reinstalling the update sometimes fixes the issue, and sfc says there are no corruptions, but a few hours later, it happens again and again.
 
Looks like some kind of strange windows bug or possibly some kind of malware. I've ran malwarebytes, adwcleaner, kapersky, zemana, unhackme ...etc. My computer is extremely hardened and secure. Not sure what is going on here.
 
STRANGELY, if I delete the cbs.log, and rescan with sfc /scannow once again, the integrity violations do not re-appear, for a while. But the cycle continues after only so long. Very odd!
 
Wait a minute, cbs.log is 0 bytes after the scan, probably because i had to force delete the file. I must reboot and scan again.
 
OK, after reboot I did a scan with a fresh cbs.log, and found zero integrity violations. As has been the case time and again, eventually it will say there is an integrity violation with comsvcs.dll. ORIGINALLY [as per the first post] when uploading the file affected file to virus total, it was the first time virus total had seen the file. Its hash was different from the one in the store. The one currently in the directory appears to be clean and is the hash that HAS been previously detected by virus total. I will continue to check the hash size and compare and see if there are any changes, the next time this happens.
 
Ok after nearly two days the file was corrupted again... the new sha256 is F44F23D1D7D142B7743CD19AE5E6285B1C21781EF540B80E15CDF7C649696D6A; which is the same as the original corrupted file.
I'll try get the hash of the original file once I fix it. Never noted it.
 
Ok the file was fixed some how or another, it appears to have happened on its own. I ran sfc fix which claimed it was incapable of repairing the file, however suddnely the new SHA256 hash is 69755E587653293DE2B386C200E8FFFB4DDF15C2F1DEA969B31E0BABC3FD2F4D, which is correct. This has happens over and over, time and again. I believe this hash is actually the same as the one found in the store that is allegedly corrupted.
 
Is there any software you are aware of that will allow me to monitor a file for size changes, that lists the associated applications involved?
 
Any thoughts? According to the file monitoring software, its been 67 hours with no corruption yet; this is a new record;
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top