[SOLVED] SFC Corruption

[NickS]

First off, can I just say a massive thank you for the SFCFix app - it has saved me numerous times in the past.

I am investigating an issue with a web server, which is doing some strange things: Running MMC and adding the Certificates snapin crashes mmc.exe, I can't expand 'Features' in Server Manager etc.
This server had some malware infections a while ago which were all cleaned using AVG and Malwarebytes and hasn't had any issues since then

This is a virtual server, running Server 2008 Standard SP2 (6.0.6002 Service Pack 2 Build 6002)

I've run an sfc /scannow and it detected some unrepairable issues with a couple of files
I then ran an SUR scan which repaired a few things, did another SFC /scannow and it threw the same errors
Ran SFCFix and it directed me to post on the forums

As far as I can see it's this file:
2015-12-23 10:22:23, Info CSI 000001a1 [SR] Could not reproject corrupted file [ml:520{260},l:88{44}]"\??\C:\Windows\security\msscw\TransformFiles"\[l:32{16}]"scwvariables.xml"; source file in store is also corrupted

I've attached my CBS Logs folder (it's quite large, but I didn't want ot truncate the earlier entries in case they were relevant. The work described above all took place today, 23/12/2015). I've also included the SFCFix output as well as SUR.

View attachment 18162

 

[BrianDrab]

Hello and welcome. Sorry for the delay. The holiday was a factor.

Due to the precise nature of your corruption, you will receive help from a user named CKing123. He's one of our senior trainees here who's in his final phrase of his studies and needs to gain some real world experience in specific areas of Windows Update. This means that he'll be assisting you, but that I will first need to double check and approve his fixes before he posts them to you. If anything this is a good thing for you because it means that you've got at least two of us watching over your thread, but it will unfortunately add a slight delay between each reply. I hope that you understand and can accept the need for us to train up new members in this way in order to carry on doing what we do here, however, if for any reason you object to this setup, I will happily take on your thread myself.

Thank you very much for your understanding. We'll be with you very shortly.

 

[NickS]

No trouble whatsoever Brian, thank you so much for keeping me updated :) Happy holidays!!

 

[CKing123]

Hello Nick and :welcome: to Sysnative!


Please do these things:

SFCFix Fix​

This fix is very specific for NickS's computer. Trying this fix on your own computer might damage your computer. If you are after assistance, create a new thread, and you will be assisted shortly.

Download SFCFix (by niemiro) and move the executable on your Desktop
Download the attached View attachment SFCFix.zip and move the archive to your Desktop
Note: Make sure that the file is named SFCFix.zip, do not rename it.
Save any work you have open, and close every programs
Drag the SFCFix.zip archive file over the SFCFix.exe executable and release it

SFCFix will launch, let it complete
Once done, a file will appear on your Desktop, called SFCFix.txt
Open the file, then copy and paste its content in your next reply


Now, we will check to see if all the corruptions are fixed using the SFC scan:


SFC Scan
1. Right-click on the Start

button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter

[COLOR=#0000ff]sfc /scannow [/COLOR]

3. Once it finishes, copy and paste the following into the command-prompt window and press Enter.

[COLOR=#0000ff]copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"[/COLOR]

4. Once this has completed please go to your Desktop and you will find CBS.txt => Right-click on this file and choose Send To...Compressed (zipped folder). Please upload this zipped file CBS.zip to this thread

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.


-CKing

 

[NickS]

I am so so so sorry for the delay, I missed the notification of the reply in my email completely!!

Thank you for getting back to me. Below are the results you requested:


Contents of SFCFix.txt:
SFCFix version 2.4.9.2 by niemiro.
Start time: 2016-02-15 08:34:33.249
Microsoft Windows Server 2008 Service Pack 2 - x86
Using .zip script file at C:\Users\nicks\Desktop\SFCFix.zip [0]


PowerCopy::
Successfully took permissions for file or folder C:\Windows\Winsxs\x86_microsoft-windows-s..onfiguration-wizard_31bf3856ad364e35_6.0.6002.18005_none_3ddae0a5485c3169\scwvariables.xml


Successfully copied file C:\Users\nicks\AppData\Local\niemiro\Archive\Winsxs\x86_microsoft-windows-s..onfiguration-wizard_31bf3856ad364e35_6.0.6002.18005_none_3ddae0a5485c3169\scwvariables.xml to C:\Windows\Winsxs\x86_microsoft-windows-s..onfiguration-wizard_31bf3856ad364e35_6.0.6002.18005_none_3ddae0a5485c3169\scwvariables.xml.


Successfully restored ownership for C:\Windows\Winsxs\x86_microsoft-windows-s..onfiguration-wizard_31bf3856ad364e35_6.0.6002.18005_none_3ddae0a5485c3169\scwvariables.xml
Successfully restored permissions on C:\Windows\Winsxs\x86_microsoft-windows-s..onfiguration-wizard_31bf3856ad364e35_6.0.6002.18005_none_3ddae0a5485c3169\scwvariables.xml
PowerCopy:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.9.2 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2016-02-15 08:34:33.764
Script hash: IMOXpcUDnEilWh6YYNytEohRYmWGXpVPb5U8APOGdqU=
----------------------EOF-----------------------


The next SFC /Scannow:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.



Attached is the CBS log as requested :) Thank you SO much!!

View attachment cbs.zip

 

[CKing123]

No problem! Glad to help you!

-CKing

 

[NickS]

Absolute legend, thank you Mr CKing :)