[SOLVED] sfc /scannow and SFCFix annot repair file

[juneg]

hi, I have a Acer Aspire E1-472G Laptop running Windows 8.1, 64-bit. I've tried running sfc /scannow and also DISM.exe /Online /Cleanup-image /Restorehealth several times (tell me complete) but from the CBS.log i see that sfc /scannow still CANNOT REPAIR (attached sfcdetails.docx)

2016-02-27 04:12:44, Info CSI 00000549 [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-02-27 04:12:48, Info CSI 0000054f [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-02-27 04:12:48, Info CSI 00000550 [SR] This component was referenced by [l:154{77}]"Package_3_for_KB3115858~31bf3856ad364e35~amd64~~6.3.1.1.3115858-5_neutral_GDR"
2016-02-27 04:12:48, Info CSI 00000553 [SR] Could not reproject corrupted file [ml:520{260},l:156{78}]"\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC"\[l:38{19}]"Windows Journal.lnk"; source file in store is also corrupted


2016-02-27 04:33:41, Info CSI 00000a6c [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-02-27 04:33:43, Info CSI 00000a6e [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-02-27 04:33:43, Info CSI 00000a6f [SR] This component was referenced by [l:154{77}]"Package_3_for_KB3115858~31bf3856ad364e35~amd64~~6.3.1.1.3115858-5_neutral_GDR"
2016-02-27 04:33:44, Info CSI 00000a72 [SR] Could not reproject corrupted file [ml:520{260},l:156{78}]"\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC"\[l:38{19}]"Windows Journal.lnk"; source file in store is also corrupted

So after i run SFCFix.exe but tell me (attached SFCFix.txt)

SFCFix version 2.4.9.2 by niemiro.
Start time: 2016-02-27 04:45:18.176
Microsoft Windows 8.1 Update 3 - amd64
Not using a script file.




AutoAnalysis::
CORRUPT: C:\WINDOWS\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk




SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 1
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.






Successfully processed all directives.
SFCFix version 2.4.9.2 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-02-27 05:26:20.458
----------------------EOF-----------------------

Please can you help me for solve the problem?

Thank you very much and best regards

juneg

 

[BrianDrab]

Hi and welcome to Sysnative. This should get you fixed up.

Step#1 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

1. Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
3. Save any open documents and close all open windows.
4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
6. SFCFix will now process the script.
7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please

Step#2 - SFC Scan
1. Right-click on the Start

button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
sfc /scannow

3. Once it finishes, copy and paste the following into the command-prompt window and press Enter.
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

4. Once this has completed please go to your Desktop and you will find CBS.txt => Right-click on this file and choose Send To...Compressed (zipped folder). Please upload this zipped file CBS.zip to this thread

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

---

Items for your next post
1. SFCFix.txt
2. CBS.txt

 

[juneg]

dear BrianDrab, thank you very much for reply. Before do what you tell me, I've tried running sfc /scannow again and when finish ... really surprise ... tell me that can repair the file; i copy for you the CBS.log

2016-03-01 07:43:58, Info CSI 00000551 [SR] Repairing corrupted file [ml:520{260},l:156{78}]"\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC"\[l:38{19}]"Windows Journal.lnk" from store

2016-03-01 07:55:42, Info CSI 00000a6a [SR] Repairing corrupted file [ml:520{260},l:156{78}]"\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC"\[l:38{19}]"Windows Journal.lnk" from store

I don't know why sfc /scannow before cannot repair (for several times) but now can ... maybe do you know?

I think that it's better do nothing now ... is it correct?

Sorry if i disturb you more ... everytime i make a Restore Point i've this error:

Event 513 CAPI2
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error: Access is denied.
Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol. System Error: Access is denied.

Maybe can you help me for solve also this problem?

Thanks for your cooperation and best regards

juneg

 

[BrianDrab]

I can try to assist you on both errors.

Sometimes SFC will report that it is "Repairing corrupted file" but it doesn't actually repair it (which I think may be happening in this case). So I would still follow my previous instructions. Once we verify that this is resolved we can then look at your other issue.

 

[juneg]

thank you very much for assist me and sorry for delay but before i was busy. Today i run sfc /scannow again and as you can see in the attached sfcdetails.txt, everything is ok. Can happen that the report is ok but the file system have some problem? Sorry for my english not so good ... i'm from Italy (but i live in Thailand)

 

[BrianDrab]

No problem. Let's take a look at your other error. Please do the following.

1. Download accesschk.exe and save to your desktop.
2. Right-click on the Start

button and select Command Prompt (Admin)
3. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
%userprofile%\desktop\accesschk.exe /accepteula -c mslldp >1.txt && notepad 1.txt

4. Notepad will open with some information. Please copy and paste this into your next post.

Thank you.

 

[juneg]

hi, i do what you tell me and from Notepad come this one:


mslldp
RW NT AUTHORITY\SYSTEM
RW BUILTIN\Administrators
RW S-1-5-32-549
R NT SERVICE\NlaSvc

For you can better understand the problem, you must know that everytime i make a Restore Point i see error Event 513 CAPI2 as i tell you before,
but from System - System protection (i hope that my translation is good, because my OS language is italian) i can see that the Restore Point was
correctly created. Thanks a lot for your cooperation and best regards

 

[BrianDrab]

I do understand the issue and believe I know what it is. Please do the following.

1. Right-click on the Start

button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following commands into it (one at a time), then press Enter after each
%userprofile%\desktop\accesschk.exe /accepteula -c mup >1.txt
SC sdshow MSLLDP >> 1.txt
SC sdshow MUP >> 1.txt && notepad 1.txt
3. Notepad will open with some information. Please copy and paste this into your next post.

 

[juneg]

hi, i do what you tell me and from Notepad come this one:

mup
RW NT AUTHORITY\SYSTEM
RW BUILTIN\Administrators
R NT AUTHORITY\INTERACTIVE
R NT AUTHORITY\SERVIZIO (my translation for you – SERVIZIO means SERVICE)

DD;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)


I also run sfc /scannow (before) and SFCFix.exe (after) and have the same error as before (you can see in the attached SFCFix.txt).
So now i must do what you tell me before with SFCFix.zip that you have already sent to me or i need something new?

Thank you very much

 

[BrianDrab]

Thanks. Please do the following.

1. Download fix.bat and save to your desktop.
2. Right-click on the fix.bat file and select Run as administrator.
3. Notepad will open with some information. Please copy and paste this into your next post.

 

[juneg]

dear BrianDrab, thank you very much. I do what you tell me and from Notepad come this one:

mslldp
RW NT AUTHORITY\SYSTEM
RW BUILTIN\Administrators
RW S-1-5-32-549
R NT SERVICE\NlaSvc
R NT AUTHORITY\SERVIZIO (my translation for you – SERVIZIO means SERVICE)


After i restart and i make a new Restore Point ... after i check Event ... surprise ... don't have error Event 513 CAPI2 as before ... maybe this problem is solved?

About the other problem of sfc /scannow and SFCFix cannot repair file, i inform you that today i run again before DISM.exe /Online /Cleanup-image /Scanhealth and DISM.exe /Online /Cleanup-image /Restorehealth (tell me it's ok) and after scf /scannow (attached sfcdetails.txt)

2016-03-07 09:10:44, Info CSI 00000a70 [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-03-07 09:10:44, Info CSI 00000a72 [SR] Cannot repair member file [l:38{19}]"Windows Journal.lnk" of Microsoft-Windows-TabletPC-Journal, Version = 6.3.9600.18189, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2016-03-07 09:10:44, Info CSI 00000a73 [SR] This component was referenced by [l:154{77}]"Package_3_for_KB3115858~31bf3856ad364e35~amd64~~6.3.1.1.3115858-5_neutral_GDR"
2016-03-07 09:10:44, Info CSI 00000a76 [SR] Could not reproject corrupted file [ml:520{260},l:156{78}]"\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC"\[l:38{19}]"Windows Journal.lnk"; source file in store is also corrupted

and after SFCFix (attached SFCFix.txt)

AutoAnalysis::
CORRUPT: C:\WINDOWS\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk

I don't know why before this problem was solved running scf /scannow but it come back after about only one week ... please can you help me again?

Thanks a lot for your cooperation and best regards

juneg

 

[BrianDrab]

After i restart and i make a new Restore Point ... after i check Event ... surprise ... don't have error Event 513 CAPI2 as before ... maybe this problem is solved?

Yes this problem is solved.

I don't know why before this problem was solved running scf /scannow but it come back after about only one week ... please can you help me again?

Let's take a look. Please repeat the steps in Post#2.

 

[juneg]

I do what you tell me and from Notepad come this one:

SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-03-08 01:35:05.612
Microsoft Windows 8.1 Update 3 - amd64
Using .zip script file at C:\Users\proprietario\Desktop\SFCFix.zip [0]


PowerCopy::
Successfully took permissions for file or folder C:\WINDOWS\Winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk

Successfully copied file C:\Users\proprietario\AppData\Local\niemiro\Archive\Winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk to C:\WINDOWS\Winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk.

Successfully restored ownership for C:\WINDOWS\Winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk
Successfully restored permissions on C:\WINDOWS\Winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.3.9600.18189_none_0874b872788af400\Windows Journal.lnk
PowerCopy:: directive completed successfully.


Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2016-03-08 01:35:07.503
Script hash: /leJ4gaZzWS5B792w1k1r3mYfJSbavAfXzrF5JvGS6k=
----------------------EOF-----------------------


As you tell me, i've also zipped the file cbs.txt (cbs.zip attached here) ... please tell me is it ok?

From the prompt, when sfc /scannow finish, i see that now everything is ok ... you are magic !!!


About the other problem, as i already tell you if i make a Restore Point now don't have error Event 513 CAPI2 as before, but today,
after that i've uninstalled a program using Revo Uninstaller Pro (that you know make a restore point by himself), i've this new error:

Event ID 8194 - VSS
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
This is often caused by incorrect security settings in either the writer or requestor process.
Operation: Gathering Writer Data
Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {3686b96d-9801-414a-a1e8-a9e16c1ada06}

I'm sorry for disturb you so much ... but never happen that somebody help me as you.

I'm from Italy but i live in Thailand ... can i ask where come you from? thanks a lot

 

[BrianDrab]

As you tell me, i've also zipped the file cbs.txt (cbs.zip attached here) ... please tell me is it ok?

Yes the log is OK.

About the other problem, as i already tell you if i make a Restore Point now don't haveerror Event 513 CAPI2 as before, but today,
after that i've uninstalled a program using Revo Uninstaller Pro (that you know make a restore point by himself), i've this new error:

Can you tell me what antivirus you are using?

I'm from Italy but i live in Thailand ... can i ask where come you from? thanks a lot

I'm from Ohio (United States). I enjoy working with people from all over so no problem.

 

[juneg]

good morning. From when i buy this Acer Aspire E1-472G Laptop running Windows 8.1, 64-bit about 2 years ago, i'm using
Windows Defender together with Malwarebytes Anti-Malware Home Premium/Malwarebytes Anti-Exploit Premium (real time
protection mode). About 1 or 2 times every month i also make a scan with adwcleaner/HitmanPro/RogueKiller but never find a
virus, only something as PUP or similar. Do you think that have enough protection or better i use something more?

Before reply to you, i've better checked Events and i see that error Event ID 8194 - VSS start about 20 days ago, but before
never have it. Anyway don't worry ... this one is a really small problem because i try to run a restore point and it works ...
the system was correctly restored.

I live in a beautiful thai island (Koh Samui) and many tourists also from USA come here for holidays ... so if some day maybe
you want come here, please tell me ... i will be happy to assist you for organize the travel

 

[BrianDrab]

OK. At this point your Windows Update/Corruption issues are resolved. The remaining issue may be a conflict with Revo Uninstaller and possibly the Malwarebytes realtime protection. Not certain. But you should contact Revo support and they will likely be able to assist you with this.

Your AV protection is good so yes I do think you have enough protection.

I live in a beautiful thai island (Koh Samui) and many tourists also from USA come here for holidays ... so if some day maybe
you want come here, please tell me ... i will be happy to assist you for organize the travel

Thank you very much!!

Take care.