Windows 2012R2: icrav03.rat repair fails

[dz0rg]

Hi,

I have a small problem with my Windows Server 2012R2 on VM, it seems that some files are corrupted:

SFCFix version 3.0.2.1 by niemiro.
Start time: 2023-06-17 17:15:58.964
Microsoft Windows Server 2012 R2 Update 3 - amd64
Not using a script file.




AutoAnalysis::
CORRUPT: C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20671_none_b468ce0f59701c02\icrav03.rat
CORRUPT: C:\Windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20671_none_584a328ba112aacc\icrav03.rat


SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
   CBS & SFC total detected corruption count:     2
   CBS & SFC total unimportant corruption count:  0
   CBS & SFC total fixed corruption count:        0
   SURT total detected corruption count:          0
   SURT total unimportant corruption count:       0
   SURT total fixed corruption count:             0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.



Failed to generate a complete zip file. Upload aborted.


SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2023-06-17 19:23:46.583
----------------------EOF-----------------------

While doing some research on the internet, I came across your site which I hope will be able to help me.

I notice that there are several Threats with a similar problem but the version is not exactly the same.

If I understand correctly, I need the files:

amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20671_none_b468ce0f59701c02\icrav03.rat
x86_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.9600.20671_none_584a328ba112aacc\icrav03.rat

Could you help me where I could find these files and repair my precious Windows? Thank you in advance.

Kind regards,

 

[PeterJ]

Hello and welcome,

Follow the instructions below please.

Step 1:
WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download
  
  SFCFix and move the executable to your desktop.
• Download the attachment SFCFix.zip and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
  
  
• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Open the file, then copy and paste its content in your next reply.

Step 2:
Restart the computer.
Open an elevated command prompt.
Copy and paste the following commands into it, press enter after each.

sfc /scannow

Wait for this to finish before you continue

copy %windir%\Logs\CBS\cbs.log "%userprofile%\Desktop\cbs.txt"

This will create a file, cbs.txt on your Desktop. Zip this file and attach the zipped cbs.txt to your next post.

 

[dz0rg]

Hello,

Thanks for your help, I dragged the SFCFix.zip on the executable SFCFix.exe.

After the reboot, I'm already happy that it rebooted well :)

I did run sfc /scannow, but there still seems to be a realtif error at the file icrav03.rat.

 

[PeterJ]

That is weird. The machine needed the 2 files uncompressed. Now it complains these 2 files cannot be decompressed.

Perform the instructions below first.
This machine is missing some servicing stack updates.

Install Update with DISM

1. Download the update MSU here: https://catalog.s.download.windowsu..._3aa7832b7586e11304f8fee5e09b6829b32d1833.msu
2. Copy the MSU file to a convenient location (such as C:\temp).
3. Click on the Start button and in the search box, type Command Prompt
4. When you see Command Prompt on the list, right-click on it and select Run as administrator
5. When command prompt opens, copy and paste the following commands into it, press enter after each
   
   cd C:\temp
   replace C:\temp with your path if different
   
   expand windows8.1-kb5018922-x64_3aa7832b7586e11304f8fee5e09b6829b32d1833.msu -f:* C:\temp
   
   DISM.exe /Online /Add-Package /PackagePath:C:\temp\windows8.1-kb5018922-x64.cab
   
   
6. You should receive the message:
   The operation completed successfully.
   Make sure to allow the computer to restart if prompted.
   
7. If you receive any other message:
   Post a screenshot of the Commandprompt window.
   Zip and attach the file C:\Windows\Logs\CBS\CBS.log

 

[dz0rg]

The operation with DISM ended correctly.

However, when I relaunch sfc /scannow, some files remain in error.

According to the cbs.txt log, shouldn't I use KB kb5022352 instead ?

00009e3 [SR] This component was referenced by [l:160{80}]"Package_1401_for_KB5022352~31bf3856ad364e35~amd64~~6.3.1.20.5022352-2411_neutral"

Thank you in advance,

 

[PeterJ]

According to the cbs.txt log, shouldn't I use KB kb5022352 instead ?

No. We fixed another issue first.

Remove Update Manually

1. Click on the Start button and in the search box, type Command Prompt.
2. When you see Command Prompt on the list, right-click on it and select Run as administrator.
3. When command prompt opens, copy and paste the following command into it, then press enter.
   wusa /uninstall /KB:5022352
   
4. Let me know if it says it was successful or if there are any errors.

 

[dz0rg]

DISM has successfully uninstalled update 5022352

I restarted the server after the uninstall, it's still alive :)

Doing a sfc /scannow, I have a rather large cbs.txt file which here is the link :
cbs.txt

Thanks for your help.

 

[PeterJ]

Lets see if there are any remnants left of KB5022352.

FRST Registry Search

1. Click the Start button and choose Control Panel.
2. In the upper right corner ensure the View by: is set to Category.
3. Select the Programs group.
4. Click the Turn Windows features on or off link. This will bring up the Server Manager dialog.
   Note: This loads your components hive which is what we want. Please keep this dialog open while you perform the remaining steps. You can minimize it if you wish but keep it open.
5. Download the Farbar Recovery Scan Tool and save it to your Desktop:
   64-bit: Downloading Farbar Recovery Scan Tool
   Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
   
6. Right-click on the file FRST64.exe and choose Run as administrator.
7. Copy and paste KB5022352 into the Search box and click the Search Registry button.
8. When the scan is complete, a message will display that 'SearchReg.txt' is saved in the same folder FRST was started from. Notepad will open this file also. Close Notepad and attach the file 'SearchReg.txt' to your next reply.
9. You may close any remaining open windows now.