[SOLVED] sfc /scannow corruption problems

Z

zbook

Member
Joined
Oct 2, 2015
Posts
919
This is a brand new computer, zbook17 with windows 7 professional, that was first used on 9/20/2015.

When sfc /scannow was run on the first day of use it found corruption.
Now when sfc /scannow is run it always find corruption.

SFCFix reported that no corruptions were detected.

DISM scanhealth always finds corruption.

In the links are images of administrative command prompt results for multiple sfc /scannow and DISM /online /cleanup-image /scanhealth

The first sfc /scannow found corrupt files but was unable to repair some of them.

The second sfc /scannow found corrupt files and successfully repaired them.

The third sfc /scannow found corrupt files and was unable to repair some of them.

The forth sfc /scannow found corrupt files and successfully repaired them.

The fifth sfc /scannow found corrupt files and was unable to repair some of them.

The result with sfc /scannow is always find corruption and to alternate between a successful repair and unable to repair some of them.

In windows 7 there is no DISM command to restorehealth but the scanhealth scan creates a CBS file to view corruption. The user then needs to find methods to repair the corruption. This is where I need your help.

In the links below are:

1) a snipping tool picture of the results in administrative command prompt
2) a C:\windows\logs\cbs\cbs.log
3) a C:\windows\logs\cbs\checksur.log

In the checksur log it always finds 2 corruptions:

Found 2 errors
CBS MUM Corrupt Total count: 2

The unavailable repair files are:
windows-IE-Hyphenation-Parent=Package-English
windows-IE-Spelling-Parent-Package-English


This is a brand new computer placed in use on 9/20/2015.
Next to this computer is a similar computer with a failed NVidia card.
This new computer is to replace the one with the failed video card.
The computer with the filed video card has had a sfc /scannow that has worked properly until the last few months. Immediately after a Microsoft windows update it found corruption. Instead of deleting this windows update file I waited for Microsoft to get feedback about the windows update producing sfc /scannow corruption. Within a few months Microsoft produced a windows update that fixed the problem with the prior windows update. The computer with the failed NVidia card when sfc /scannow is run has no corruption. In contrast the brand new computer always displays corruption. When sfc /scannow fixes the corruption the corruption that it fixes is only temporary as the next sfc /scannow reports that it was not able to fix the corruption. The next sfc /scannow will then fix the corruption. The computer can be reboot any time and the sfc /scannow results always display corruption.

If sfc /scan results are ignored with it displaying corruption on a new computer there may be sometime in the future where a serious corruption is missed. I would like to get this brand new computer fixed so that there is no corruption. I did not know how to locate the missing files in the log files. When reading the cbs log for the sfc /scannow using edit then find then entering "cannot" there was no result. When using the find and entering "corrupt" there were 18 results all looking for the same repair file. This file was different than the checksur log.

How does the sfc /scannow results get fixed so that windows resource protection permanently fixes the corruption?


https://www.dropbox.com/sh/b6rhh0aabmd2v2a/AABjpjld1iwVtWCMbDBmNfzqa?dl=0
 
Hi zbookwin7professional :)

My name is Aura and I'll be assisting you with your issue. According to the CBS.log you posted, only one file was repaired from the store and it was a success. As for the CheckSUR.log results, these are false positives from SURT that we cannot explain at this time, but the files don't need to be replaced.
 
Aura,

When sfc /scannow is run on the new computer it will always find a corrupt file.

When sfc /scannow is run on the computer with the failed video card it finds no integrity violations.

Today there was one windows important update.

Running SFCFix on the new computer today it found 2 corruptions.

Running SFCFix on the computer today with the failed video card it found 4 corruptions. Of these 4 corruptions the total unimportant corruption count was 2.

On both computers no corruptions were fixed by SFCFix.

The sfc /scannow, SFCFix and DISM /online /cleanup-image /scanhealth each seem to be finding different things or missing things depending on what each of the test searches for.

For the new computer the first SFCFix was ran on 10/1/2015 and found no corruption.

When SFCFix was run today, 10/6/2015 it found 4 corruptions and 2 of these were reported as unimportant.

When the CBS.log is viewed with edit find and entering "corrupted" it displays the same file used to repair each of the corruptions. It indicates that it fixed the corruption. However when SFC /SCANNOW is ran again it indicates that it found corruption again.

The SFC /Scannow always finds corruption on the new computer.

If SFC /Scannow always finds corruption how will I know when there is corruption that can be ignored and when there is corruption that needs to be addressed or fixed?

In other words how does this tool, SFC/Scannow get fixed so that it displays no integrity violations found like in the computer with the failed NVidia video card?

How come the first SFCFix found no corruptions and the second SFCFix found 2 that are important? Was that related to the latest windows 7 professional update?

In the links I have snipping tool images of administrative command prompt, SFCFix results, and CBS.log for each of the computers.

It has gotten confusing for me as the SFC/scannow has no integrity violations on the computer with the failed video card and SFCFix displays 2 corruptions that are important. And the brand new computer that was placed into use on 9/20/2015 has integrity violations on every SFC/ scannow........they alternate between Windows Resource Protection found corrupt files and successfully repaired them to Windows Resource Protection found corrupt files and was unable to repair them.

Was the first SFCFix a false negative on the new computer?
Was the second SFCFix a false positive on the new computer?
Is there new corruption from 10/1 to 10/6/2015?

Was the sfc /scannow a false negative today on the computer with the failed video card?
Was the SFCFix a false positive today on the computer with the failed video card?

In advance I am apologizing for the thread having 2 computers, one with the failed video card, and one that is brand new as it may be challenging to keep track of all of the tests and results.

These links are for the new computer with 2 new SFCFix corruptions. it is the computer that always has windows resource protection corruption. And it is the computer that will indicate that it fixes the corruption and then the next scan indicates that it was unable to fix the corruption etc.:

https://www.dropbox.com/sh/f80ew14f546pr5n/AABb_3Sr50f2ksEXqHVSJ8zja?dl=0

This link is for the computer with the failed NVidia video card. It is the computer that has SFC /scannow displaying no corruption and SFCFix displaying 4 corruptions with 2 unimportant.

https://www.dropbox.com/sh/o1s9rmk2u6ty45j/AABk1spLFaoWkGODl8VtAIy1a?dl=0

What's happening with the different test methods?
How can I get this brand new computer to have a SFC/ scannow that will display no integrity violations? That is no false positives or false negatives........an accurate sfc /scannnow
How come the computer with the failed NVidia card displays no integrity violations with 2 important corruptions out of 4 corruptions? How come they were missed by sfc /scannow?

Thank you
 
Sorry, I have a bit of difficulty with following a long post when we're talking about multiple computers. Can we focus on one computer first, fix it, then move on to the other one? It'll be way easier that way for me and for the clean-up process as well. Which one should we address first? The new computer, or the computer with the failed graphic card?
 
Let's get the brand new computer fixed first. The computer with the failed video card can be fixed at a later time and was commented on because it had different outcomes for SFC /scannow. Both are HP zbook17 computers that came with windows 8 and downgrade rights to windows 7. So from the factory they were configured with windows 7 professional. Do I need to reinstall the windows 7 professional operating system to get the sfc /scannow tool fixed? That is get it to display no integrity violations found. It is always finding corruption. It will alternate between Windows Resource protection found corrupt files but was unable to fix some of them with Windows Resource Protection found corrupt files and successfully repaired them. When Windows Resource Protection does its repair and reports it as successful it appears to only be temporary as the next SFC /scannow will display corruption found. For this computer the SFCFix was first without corruption then switched days later to 4 corruptions with 2 unimportant. That was temporally related to an important windows 7 update. In the last post I had links for cbs.logs SFCFix logs and snipping tool pictures of the administrative command prompt entries and results
 
This is today's SFCFix log:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-10-07 19:04:34.427
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.


AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 0
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 2
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-10-07 19:07:02.702
----------------------EOF-----------------------
 
We aren't at the point of doing a repair install yet, althought you can do it right now if you want. SFCFix reports two corruptions in the CheckSUR.log, so let's grab it.

IGJdB0T.png
System Update Readiness Tool (SURT) - Scan
Follow the instructions below to run a scan with the System Update Readiness Tool (SURT) and provide a log;
  • Download the right version of SURT for your system;
    • Your version of Windows is:
  • Once downloaded, execute the installer, and go throught the installation (this process can take around 15-20 minutes);
  • On completion, a log will be created in C:\Windows\Logs\CBS\CheckSUR.log;
  • Attach this log in your next reply;
Alternatively, if these instructions are unclear for you, you can follow the tutorial below.

System Update Readiness Tool (SURT)
 
Downloaded and installed: https://www.microsoft.com/en-us/download/confirmation.aspx?id=20858


Then clicked computer, then double clicked C:drive, then double clicked windows folder, then clicked logs folder, the double clicked CBS then clicked CheckSUR.log

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2015-10-07 22:28
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking Packages
Checking Component Store
Summary:
Seconds executed: 143
No errors detected

Then with administrative command prompt I ran SFC/scannow and it displayed:

Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log

Running SFC /scannow again it displayed:


Windows Resource Protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log

SFCFix was ran again after the above findings:


SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-10-07 23:01:28.788
Microsoft Windows 7 Service Pack 1 - amd64
Not using a script file.


AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.


Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-10-07 23:01:48.179
----------------------EOF-----------------------


SFCFix no longer is finding corrupt files while SFC /scannow always finds corrupts files.

Something happened in the past few days that the first SFCFix moved from 0 corruptions to 2 corruptions before todays download and fix.

What happened that SURT had two corruptions in just a few days?
How can SFC /scannow be fixed so that it displays no integrity violations were found?
How can the false positives be fixed so that this becomes an accurate tool?
If the SFC /scannow always displays found corruption when there is no significant corruption how will I know when there is significant corruption?
I would like to have a fully working tool on this brand new computer so that I can rely on the tool to fix small corruptions before they become big corruptions.
How come windows resource protection only does a temporary fix and the next sfc /scannow finds corruption that it cannot fix?
Is the only method to get an accurate sfc /scannow tool to reinstall the windows 7 professional operating system or are there other/better ways?
 
What happened that SURT had two corruptions in just a few days?
Click to expand...

It looks like SFCFix was using the results of an old CheckSUR.log in it's output. By the time you ran SURT again, the issues reported were already fixed.

How can SFC /scannow be fixed so that it displays no integrity violations were found?
Click to expand...

This is what we're working on right now. If I understand everything you explained so far, it means that one or more files becomes corrupt often and SFC takes care of them periodically as you run it.

How can the false positives be fixed so that this becomes an accurate tool?
Click to expand...

The false positives from SFC or SFCFix?

If the SFC /scannow always displays found corruption when there is no significant corruption how will I know when there is significant corruption?
Click to expand...

You'll only know when you get the CBS.log checked by an Analyst here (or someone else with experience) and/or if you start experiencing random system-related issues (like features not working, system files throwing errors, etc.).

How come windows resource protection only does a temporary fix and the next sfc /scannow finds corruption that it cannot fix?
Click to expand...

This I cannot explain, like I said above, it's possible that the files gets fixed, but somehow gets corrupted again quickly after.

Is the only method to get an accurate sfc /scannow tool to reinstall the windows 7 professional operating system or are there other/better ways?
Click to expand...

You can consider a Repair Install before a plain, clean reinstall. And we're working on the other/better way now.

This being said, I'll need you to run a new SFC scan, and give me the full CBS.log to review. If possible, run SFC until it gives you the following message:
Code: 
Windows Resource Protection found corrupt files but was unable to fix some of them. 
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log
And give me the CBS.log of that scan.

EndqYRa.png
System File Checker (SFC)
Follow the instructions below to run a SFC scan on your system and to provide the CBS log in your next reply;
  • On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select
    Spcusrh.png
    Run as Administrator
  • On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
  • On Windows 8.1, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
  • Enter the command below and press on Enter;
    Code: 
    sfc /scannow
    Note: There's a space between "sfc" and "/scannow";
  • Once the scan is complete, enter the command below and press on Enter
    Code: 
    copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
  • A file called cbs.txt will have appeared on your Desktop. Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;
Note: Please note that the CBS.log is volatile, which means that if you don't upload it after the SFC scan is completed, it won't have the information from the scan anymore. So archive it and upload it as soon as you can.
 
Using administrative command prompt I ran sfc /scannow.

Then I entered:

%windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

Nothing appeared on the desktop.

Searcheverything software has been installed on this computer which makes search quick by having an index of all files.

When I entered *.CBS.txt there was no file on the computer.

When I entered CBS.txt there was no file on the computer.

Somehow the above administrative command prompt command did not produce the desktop file.

It displayed: Access is denied.

Is a space needed somewhere or was something missed in the command entry?

In the link below is a snipping tool of the entries into administrative command prompt.

https://www.dropbox.com/sh/8b2l7ee61snr9qv/AAAr7pXRuiO2uKxmuP0Mp2Pja?dl=0

In the above link I also included information on the system, the system log, and the application log.

In earlier posts I had submitted links that had the full cbs.log, cbs.zip, dism.log, dism.zip, and sfcdetails.txt.

What needs to be done to get the cbs.txt to appear on the desktop?
 
%windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
Click to expand...

You forgot the "copy" in front of it.

Code: 
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
 
When I read the post I had thought that copy was copy into the administrative command prompt instead of it actually being part of the administrative command entry........thanks.


This seems to be the recurrent corrupt problem in the cbs.log:

2015-10-07 22:39:20, Info CSI 00000206 Hashes for file member \??\C:\windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
Found: {l:32 b:mGCBnw8MfWjTIDzcZTNrS3+q9KapF+J1hftJNW380gw=} Expected: {l:32 b:P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=}
2015-10-07 22:39:20, Info CSI 00000207 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\windows\system32\drivers\en-US"\[l:28{14}]"usbhub.sys.mui" from store


This is a link of the cbs.txt:

https://www.dropbox.com/sh/iwnow4shwfzancw/AADDPL-bKHDgHXAUwN_OfGXea?dl=0
 
Not the first time I've seen that particuliar file behaving like that. Can you run SFC again until you hit that message at the end?
Code: 
Windows Resource Protection found corrupt files but was unable to fix some of them. 
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log
Once done, you can upload the CBS.log once more for me.
 
Using administrative command prompt I entered sfc /scannow and it produced a result.

This was repeated numerous times.

In the link below is the administrative command prompt for 6 of the repeated sfc /scannows

When Windows resource protection displays that it successfully repaired the problem that it found this appears only temporary as the sfc /scannow that immediately follows a successful repair is always a failed repair.

A sfc /scannow that follows a failed repair is always a successful repair.

The cbs log though never displays a failed repair.

Using edit then find and entering "cannot" never produces a result that displays anything that sfc /scannow cannot repair.

Using edit then find and entering "corrupt" on the current cbs.txt has approximately 35 successful repairs and none of these lasted more than the time it took to report that it was a successful repair. The very next sfc /scannow reported that it failed on the administrative command prompt. The log though reported that it was successful and contradicted the administrative command prompt.

It appears to me that sfc /scannow is not making any repairs as the very next sfc /scannow reports it found corruption that it was not able to repair. Or the repair is only temporary and something is trumping the repair and making it corrupt immediately after it is repaired. It's a puzzle why the administrative command prompt report of failed to fix never appears in the cbs.log

https://www.dropbox.com/sh/hrv5xmwe1ysmaow/AABbaRgMtPKer7rcjMorHyipa?dl=0
 
In the above link there is a snipping tool picture on administrative command prompt. There were 5 (mistake typing 6 in the prior post) SFC /scannow ran. They alternated with results unable to fix on scan 1 to successfully repaired on scan 2 to unable to to fix on scan 5. After scan 5 was completed the copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt" command was used to generate the cbs.txt. The full cbs.log was not generated. If you want the full cbs.log I can attempt to do that instead of the txt. Let me know if you need the log instead of the txt.
 
I need the CBS.log (whether you grab it directly from the folder or copy it on the Desktop first) when SFC returns the following message.
Code: 
Windows Resource Protection found corrupt files but was unable to fix some of them. 
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log
 
After your post I used administrative command prompt and ran multiple sfc /scannow. The last one ended with wrp found corrupt files and was unable to fix some of them.
Then I saved the CBS.log to desktop. Then I saved CBS.txt to desktop. Then I used administrative command prompt and entered dism / online /cleanup-image /scanhealth and saved checksur.log to desktop. Then I ran SFCFix.exe and saved sfcfix.txt to desktop.

All of the above are included in this link:

https://www.dropbox.com/sh/pbeqkn4um0d2dvl/AAAmDv0QGebhB8UpQHR2wsV6a?dl=0
 
According to the last CBS.txt you sent me, even thought SFC reported that it couldn't fix some corruption, it fixed them anyway.
Code: 
2015-10-09 11:46:31, Info                  CSI    00000d25 Hashes for file member \??\C:\windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
  Found: {l:32 b:P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=} Expected: {l:32 b:mGCBnw8MfWjTIDzcZTNrS3+q9KapF+J1hftJNW380gw=}
2015-10-09 11:46:31, Info                  CSI    00000d26 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\windows\system32\drivers\en-US"\[l:28{14}]"usbhub.sys.mui" from store
2015-10-09 11:46:31, Info                  CSI    00000d27 WARNING: File [l:28{14}]"usbhub.sys.mui" in [l:74{37}]"\??\C:\windows\system32\drivers\en-US" switching ownership
    Old: usb.inf.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: usbport.inf.Resources, Version = 6.1.7601.18337, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2015-10-09 11:46:31, Info                  CSI    00000d28 Repair results created:
POQ 583 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\d112d90cb202d1016efe0000601ad023._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\13afd90cb202d1016ffe0000601ad023.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\5706df0cb202d10170fe0000601ad023.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
    3: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\2f02e10cb202d10171fe0000601ad023.$$_system32_drivers_dc1b782427b5ee1b.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms"
    4: Move File: Source = [l:242{121}]"\SystemRoot\WinSxS\Temp\PendingRenames\92ece10cb202d10172fe0000601ad023.$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms", Destination = [l:154{77}]"\SystemRoot\WinSxS\FileMaps\$$_system32_drivers_en-us_4bb913fc5eb96bcf.cdf-ms"
    5: Hard Link File: Source = [l:232{116}]"\SystemRoot\WinSxS\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.18337_en-us_4c200f8abd842bb9\usbhub.sys.mui", Destination = [l:104{52}]"\??\C:\windows\system32\drivers\en-US\usbhub.sys.mui"
 
The sfc /scannow (see snipping tool picture) results always find one or more corrupt file (s). On this brand new computer the sfc /scannow never displays no integrity violations found. The sfc /scannow always alternates the results. A found corrupt files and fixed them is always followed by found corrupt files and was unable to fix. It is able to find corruption and is able to report a fix which is only temporary or may only be a report but not a real fix. Or it may fix a corrupt file and then something trumps the fix and corrupts the file again.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top