O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 22, 2016 #41 SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-22 10:27:30.567 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 8 datablocks. Finish time: 2016-03-22 10:27:32.020 ----------------------EOF-----------------------
SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-22 10:27:30.567 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.10586.20_none_335c47060e5cee53. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 8 datablocks. Finish time: 2016-03-22 10:27:32.020 ----------------------EOF-----------------------
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 22, 2016 #42 LOGS after the patch Dropbox - logs8.zip
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 22, 2016 #43 Another one. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\ovarpt_COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53] "S256H"=hex:44,d7,9a,10,47,72,4c,47,36,7a,80,c7,fe,f3,b3,45,1f,7b,fd,30,95,b6,6b,69,8c,47,63,5b,05,37,de,de Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
Another one. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\ovarpt_COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53] "S256H"=hex:44,d7,9a,10,47,72,4c,47,36,7a,80,c7,fe,f3,b3,45,1f,7b,fd,30,95,b6,6b,69,8c,47,63,5b,05,37,de,de Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 23, 2016 #44 SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-23 10:06:06.887 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 9 datablocks. Finish time: 2016-03-23 10:06:07.622 ----------------------EOF-----------------------
SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-23 10:06:06.887 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.10586.14_none_b69df7017fc0ff53. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 9 datablocks. Finish time: 2016-03-23 10:06:07.622 ----------------------EOF-----------------------
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 23, 2016 #45 You can run DISM again and provide me the CBS and DISM logs :)
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 23, 2016 #47 Just so you know, what we're doing right now is that we're modifying the SHA256 value of a manifest file in your Registry, so Windows can accept it when it scans the file. I'm basically changing the "Expected" value (which is wrong) with the "Found" one (which is right, since I have the same Found value on my system and the SHA256 hash of the file matches as well). However, it seems that we'll have to do them one by one since everytime you run DISM, Windows reports a different one (since we fixed the previous one). I don't know how many they are to fix however. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\ovarpt_COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810] "S256H"=hex:e0,4e,d5,a1,44,9b,6f,a0,f9,3c,d2,b3,14,c9,fe,69,84,18,20,c9,8b,fb,ea,4b,26,98,d9,b8,07,ef,72,55 Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
Just so you know, what we're doing right now is that we're modifying the SHA256 value of a manifest file in your Registry, so Windows can accept it when it scans the file. I'm basically changing the "Expected" value (which is wrong) with the "Found" one (which is right, since I have the same Found value on my system and the SHA256 hash of the file matches as well). However, it seems that we'll have to do them one by one since everytime you run DISM, Windows reports a different one (since we fixed the previous one). I don't know how many they are to fix however. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\ovarpt_COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810] "S256H"=hex:e0,4e,d5,a1,44,9b,6f,a0,f9,3c,d2,b3,14,c9,fe,69,84,18,20,c9,8b,fb,ea,4b,26,98,d9,b8,07,ef,72,55 Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 23, 2016 #48 SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-23 14:50:22.798 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 10 datablocks. Finish time: 2016-03-23 14:50:24.960 ----------------------EOF-----------------------
SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-23 14:50:22.798 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 10 datablocks. Finish time: 2016-03-23 14:50:24.960 ----------------------EOF-----------------------
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 23, 2016 #49 You can run DISM again and provide me the logs :)
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 25, 2016 #51 Sorry for the delay. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810] "S256H"=hex:eb,a2,51,43,8b,62,5f,5e,5d,39,f5,f2,99,18,3a,0e,46,d0,a7,ec,0a,8d,06,58,e4,8f,c3,59,9e,cd,4b,28 Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
Sorry for the delay. SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; On your Desktop, right-click and select New, then Text Document. Give it the name SFCFixScript (it should be a .txt) extension; Open the SFCFixScript.txt file you just created, and copy/paste the following in it; Code: :: [HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810] "S256H"=hex:eb,a2,51,43,8b,62,5f,5e,5d,39,f5,f2,99,18,3a,0e,46,d0,a7,ec,0a,8d,06,58,e4,8f,c3,59,9e,cd,4b,28 Save any work you have open, and close every programs; Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply;
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 25, 2016 #52 SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-26 03:21:12.370 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 10 datablocks. Finish time: 2016-03-26 03:21:14.745 ----------------------EOF-----------------------
SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-26 03:21:12.370 Microsoft Windows 10 Build 10586 - amd64 Using .txt script file at C:\Users\CD\Desktop\SFCFixScript.txt [] RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.10586.162_none_ce42e91cdf166810. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 10 datablocks. Finish time: 2016-03-26 03:21:14.745 ----------------------EOF-----------------------
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 26, 2016 #54 Alright, now it's payloads... SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; Download the attached SFCFix.zip and move the archive to your Desktop; Note: Make sure that the file is named SFCFix.zip, do not rename it. Save any work you have open, and close every programs; Drag the SFCFix.zip archive file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply; SFCFix.zip
Alright, now it's payloads... SFCFix - Fix Time WARNING! The following fix is specific to the user's system in this thread. No one else should follow the instructions below to apply that fix, as it could damage your system. If you need assistance with an issue, please start a new thread and someone will assist you shortly. Follow the instructions below to download and execute a SFCFix fix, and provide the log. Download SFCFix and move the executable on your Desktop; Download the attached SFCFix.zip and move the archive to your Desktop; Note: Make sure that the file is named SFCFix.zip, do not rename it. Save any work you have open, and close every programs; Drag the SFCFix.zip archive file over the SFCFix.exe executable and release it; SFCFix will launch, let it complete; Once done, a file will appear on your Desktop, called SFCFix.txt; Open the file, then copy and paste its content in your next reply; SFCFix.zip
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Mar 26, 2016 #55 SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-26 19:23:15.306 Microsoft Windows 10 Build 10586 - amd64 Using .zip script file at C:\Users\CD\Desktop\SFCFix.zip [] PowerCopy:: Successfully took permissions for file or folder C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully took permissions for file or folder C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully took permissions for file or folder C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll WARNING: File C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll to C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll. WARNING: File C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll to C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll. WARNING: File C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll to C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll. Successfully restored ownership for C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully restored permissions on C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully restored ownership for C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully restored permissions on C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully restored ownership for C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll Successfully restored permissions on C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll PowerCopy:: directive completed successfully. RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 13 datablocks. Finish time: 2016-03-26 19:23:17.943 ----------------------EOF-----------------------
SFCFix version 3.0.0.0 by niemiro. Start time: 2016-03-26 19:23:15.306 Microsoft Windows 10 Build 10586 - amd64 Using .zip script file at C:\Users\CD\Desktop\SFCFix.zip [] PowerCopy:: Successfully took permissions for file or folder C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully took permissions for file or folder C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully took permissions for file or folder C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll WARNING: File C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll to C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll. WARNING: File C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll to C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll. WARNING: File C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll was not backed up as that would replace the current backup. Successfully copied file C:\Users\CD\AppData\Local\niemiro\Archive\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll to C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll. Successfully restored ownership for C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully restored permissions on C:\WINDOWS\winsxs\x86_system.data_b77a5c561934e089_4.0.10586.0_none_a39aa5523c1d706f\System.Data.dll Successfully restored ownership for C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully restored permissions on C:\WINDOWS\winsxs\msil_system.data.entity_b77a5c561934e089_4.0.10586.0_none_c2ca24eb3ea1ef4f\System.Data.Entity.dll Successfully restored ownership for C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll Successfully restored permissions on C:\WINDOWS\winsxs\msil_presentationframework_31bf3856ad364e35_4.0.10586.0_none_60e3b95f7f7e0e47\PresentationFramework.dll PowerCopy:: directive completed successfully. RegistryScript:: Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.10586.17_none_36c6a6ae89ba2760. RegistryScript:: directive completed successfully. Successfully processed all directives. SFCFix version 3.0.0.0 by niemiro has completed. Currently storing 13 datablocks. Finish time: 2016-03-26 19:23:17.943 ----------------------EOF-----------------------
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 29, 2016 #58 I'll only be able to post the next set of instructions on Thursday, since the log it'll give me is really long to go through, and right now I need to study for an exam that I have on Wednesday evening. Sorry for the inconvenience.
I'll only be able to post the next set of instructions on Thursday, since the log it'll give me is really long to go through, and right now I need to study for an exam that I have on Wednesday evening. Sorry for the inconvenience.
Aura Sysnative Staff, Security Analyst Staff member Joined Mar 16, 2015 Posts 8,061 Mar 31, 2016 #59 Alright, can you try to install the update once more and send me the logs? If the same error is still present, we'll have to do it again using ProcMon, and this is a very long log to upload and analyze.
Alright, can you try to install the update once more and send me the logs? If the same error is still present, we'll have to do it again using ProcMon, and this is a very long log to upload and analyze.
O ovarpt Well-known member Joined Mar 3, 2016 Posts 47 Apr 1, 2016 #60 Hi Aura, last logs Dropbox - logs13.zip