[SOLVED] Win7 x64 SFC errors generated by Windows Update Rollup May 2016

SleepyDude

SleepyDude

Windows Update Moderator, Security Analyst
Staff member
Joined
Dec 20, 2013
Posts
3,062
Location
Portugal
Hi,

On a clean install of Windows 7 Pro EN x64 I installed:

- Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: September 20, 2016
- Windows Update Rollup May 2016 (KB3125574) downloaded from the Microsoft catalog

No other software installed besides the hardware drivers for the machine.

Running SFC /scannow reports "Windows Resource Protection found corrupt files but was unable to fix some of them."

A second run of SFC results in "Windows Resource Protection found corrupt files and successfully repaired them."

If SFC is executed again it goes back to the first error again.

The CBS log after both runs is attached View attachment CBS.zip

Any idea how we can make sfc happy?

I have found this problem on more that one machine and I'm pretty sure the problem source is related with the use of the Windows Update Rollup from May 2016!
 
We can certainly try.

Code: 
2016-10-13 23:13:32, Info                  CSI    0000034d Hashes for file member \??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
  Found: {l:32 b:vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=} Expected: {l:32 b:P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=}

Please do the following to gather some more info.

Step#1 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.
  1. Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
  2. Download the file below, SFCScript.txt, and save this to your Desktop.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCScript.txt.
  5. Drag the file SFCScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please
 

Attachments

Hi Brian,

The result:
Code: 
SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-10-13 23:41:04.844
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Users\rpaz\Desktop\SFCScript.txt [1]




FileScan::
[0: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f\usbhub.sys.mui
 Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
 Expected: 6.1.7601.17514 Found: 6.1.7600.16385
Successfully traced component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394



[1: 2] C:\Windows\winsxs\amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114\usbhub.sys.mui
 Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
 Expected: 6.1.7600.16385
Successfully traced component amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394

 [C:\Windows\System32\drivers\en-US\usbhub.sys.mui]


[2: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5\usbhub.sys.mui
 Expected: vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=
 Expected: 6.1.7601.23403
Failed to trace component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5 with return code -3.
FileScan:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-10-13 23:41:09.649
Script hash: sl2rFzBuJfQe4mf9sjFunFbTJaCoICi+USKq7WPqcXQ=
----------------------EOF-----------------------
 
Thanks. We're going to remove the hard-link and use sfc to replace the file. Please start with the following.

FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download attached file and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 

Attachments

Ok, Done.

Code: 
Fix result of Farbar Recovery Scan Tool (x64) Version: 13-10-2016
Ran by rpaz (13-10-2016 23:58:35) Run:1
Running from C:\Users\rpaz\Desktop
Loaded Profiles: rpaz (Available Profiles: rpaz)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Windows\System32\drivers\en-US\usbhub.sys.mui
*****************

Could not move "C:\Windows\System32\drivers\en-US\usbhub.sys.mui" => Scheduled to move on reboot.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 14-10-2016 00:00:33)

C:\Windows\System32\drivers\en-US\usbhub.sys.mui => Is moved successfully

==== End of Fixlog 00:00:33 ====
 
Perfect. Now do the following.

SFC Scan


  1. Click on the Start
    Start%20Orb.jpg
    button and in the search box, type Command Prompt
  2. When you see Command Prompt on the list, right-click on it and select Run as administrator
  3. When command prompt opens, copy and paste the following commands into it, press enter after each

    sfc /scannow

    Wait for this to finish before you continue

    copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
  4. This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.
 
Hi Brian,

Thanks for the reply.

I'm posting just to let you know that I will not have access to the machine until Sunday.
 
Hi Brian,

I executed SFC two times on first run it replaced the file C:\Windows\system32\drivers\en-US\usbhub.sys.mui but on the next scan it report the same error.

New CBS log View attachment CBS.zip
 
Hi,

Result of the new scan:
SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-10-17 18:50:42.364
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Users\rpaz\Desktop\SFCScript.txt [2]




FileScan::
[0: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f\usbhub.sys.mui
Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
Expected: 6.1.7601.17514 Found: 6.1.7600.16385
Successfully traced component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394



[1: 3] C:\Windows\winsxs\amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114\usbhub.sys.mui
Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
Expected: 6.1.7600.16385
Successfully traced component amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394

[C:\Windows\System32\drivers\en-US\usbhub.sys.mui]
[C:\FRST\Quarantine\C\Windows\System32\drivers\en-US\usbhub.sys.mui.xBAD]


[2: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5\usbhub.sys.mui
Expected: vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=
Expected: 6.1.7601.23403
Failed to trace component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5 with return code -3.
FileScan:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-10-17 18:50:47.419
Script hash: sl2rFzBuJfQe4mf9sjFunFbTJaCoICi+USKq7WPqcXQ=
----------------------EOF-----------------------
Click to expand...
 
Thanks. I need to see the registry hives.

Retrieve Components/Software Hives
Note: The Software have has confidential and sensitive information in it so please send me a PM with a link to that particular hive so it's not in the public form.
  • Please download the Freeware RegBak from here: Acelogix Software - Download products
     You will find it at the bottom of the page that the link brings you to.
  • Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
  • Click the New Backup button. Accept the defaults and simply click Start.
  • When it says Finished successfully, click the Close button.
  • This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
  • This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, two of which are named COMPONENTS and SOFTWARE.
  • Copy these two files to your Desktop. If the COMPONENTS file does not exist, please fetch it instead from C:\Windows\System32\config\COMPONENTS.
  • Now right click on these files on your desktop and select Send to > Compressed (zipped) folder.
  • Then please upload the zip file(s) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Dropbox or One Drive or SendSpace and then just provide the link in your reply.
  • You can close any open windows you have as well as the RegBack program now.
 
Hi Brian,

Why not collect the files from the backup created by FRST on C:\FRST\Hives?
 
I wasn't aware that the COMPONENTS hive was one of them that was backed up? We could use that for the SOFTWARE hive however.
 
For just the COMPONENTS hive we can just do a copy instead of using a tool.

Retrieve Components Hive
 1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.
 
In my case all the hives are on the backup.

FRST uses ERDNT and I have found that ERDNT will backup the components hive also if its loaded at the time of backup.
 
Hi Brian,

The KB3181988 update did the trick.
Problem solved :thumbs_up::beerchug2:
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top