[SOLVED] Win7 x64 SFC errors generated by Windows Update Rollup May 2016

SleepyDude · Oct 13, 2016

Hi,

On a clean install of Windows 7 Pro EN x64 I installed:

- Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: September 20, 2016
- Windows Update Rollup May 2016 (KB3125574) downloaded from the Microsoft catalog

No other software installed besides the hardware drivers for the machine.

Running SFC /scannow reports "Windows Resource Protection found corrupt files but was unable to fix some of them."

A second run of SFC results in "Windows Resource Protection found corrupt files and successfully repaired them."

If SFC is executed again it goes back to the first error again.

The CBS log after both runs is attached View attachment CBS.zip

Any idea how we can make sfc happy?

I have found this problem on more that one machine and I'm pretty sure the problem source is related with the use of the Windows Update Rollup from May 2016!

BrianDrab · Oct 13, 2016

We can certainly try.

Code:

2016-10-13 23:13:32, Info                  CSI    0000034d Hashes for file member \??\C:\Windows\system32\drivers\en-US\usbhub.sys.mui do not match actual file [l:28{14}]"usbhub.sys.mui" :
  Found: {l:32 b:vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=} Expected: {l:32 b:P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=}

Please do the following to gather some more info.

Step#1 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
Download the file below, SFCScript.txt, and save this to your Desktop.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCScript.txt.
Drag the file SFCScript.txt onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a file should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please

SleepyDude · Oct 13, 2016

Hi Brian,

The result:

Code:

SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-10-13 23:41:04.844
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Users\rpaz\Desktop\SFCScript.txt [1]




FileScan::
[0: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f\usbhub.sys.mui
 Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
 Expected: 6.1.7601.17514 Found: 6.1.7600.16385
Successfully traced component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394



[1: 2] C:\Windows\winsxs\amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114\usbhub.sys.mui
 Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
 Expected: 6.1.7600.16385
Successfully traced component amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394

 [C:\Windows\System32\drivers\en-US\usbhub.sys.mui]


[2: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5\usbhub.sys.mui
 Expected: vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=
 Expected: 6.1.7601.23403
Failed to trace component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5 with return code -3.
FileScan:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-10-13 23:41:09.649
Script hash: sl2rFzBuJfQe4mf9sjFunFbTJaCoICi+USKq7WPqcXQ=
----------------------EOF-----------------------

BrianDrab · Oct 13, 2016

Thanks. We're going to remove the hard-link and use sfc to replace the file. Please start with the following.

FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download attached file and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

SleepyDude · Oct 13, 2016

Ok, Done.

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version: 13-10-2016
Ran by rpaz (13-10-2016 23:58:35) Run:1
Running from C:\Users\rpaz\Desktop
Loaded Profiles: rpaz (Available Profiles: rpaz)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Windows\System32\drivers\en-US\usbhub.sys.mui
*****************

Could not move "C:\Windows\System32\drivers\en-US\usbhub.sys.mui" => Scheduled to move on reboot.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 14-10-2016 00:00:33)

C:\Windows\System32\drivers\en-US\usbhub.sys.mui => Is moved successfully

==== End of Fixlog 00:00:33 ====

BrianDrab · Oct 13, 2016

Perfect. Now do the following.

SFC Scan

Click on the Start

button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

sfc /scannow

Wait for this to finish before you continue

copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

SleepyDude · Oct 14, 2016

Hi Brian,

Thanks for the reply.

I'm posting just to let you know that I will not have access to the machine until Sunday.

BrianDrab · Oct 14, 2016

No problem. Thanks for the update.

SleepyDude · Oct 16, 2016

Hi Brian,

I executed SFC two times on first run it replaced the file C:\Windows\system32\drivers\en-US\usbhub.sys.mui but on the next scan it report the same error.

New CBS log View attachment CBS.zip

BrianDrab · Oct 16, 2016

OK, thanks for the info. Repeat the steps in Post#2.

SleepyDude · Oct 17, 2016

Hi,

Result of the new scan:

SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-10-17 18:50:42.364
Microsoft Windows 7 Service Pack 1 - amd64
Using .txt script file at C:\Users\rpaz\Desktop\SFCScript.txt [2]

FileScan::
[0: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f\usbhub.sys.mui
Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
Expected: 6.1.7601.17514 Found: 6.1.7600.16385
Successfully traced component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4c32c918bd76887f.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394

[1: 3] C:\Windows\winsxs\amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114\usbhub.sys.mui
Expected: P+QMS/aJGY12ZeV7xk99rf2BlNR5Z+xU2AWVKrnIdpo=
Expected: 6.1.7600.16385
Successfully traced component amd64_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_851353ad2a152114.
Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.INF_1394

[C:\Windows\System32\drivers\en-US\usbhub.sys.mui]
[C:\FRST\Quarantine\C\Windows\System32\drivers\en-US\usbhub.sys.mui.xBAD]

[2: 1] C:\Windows\winsxs\amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5\usbhub.sys.mui
Expected: vYkBXtG1oCmsNP1esG4J3ULGtVN29TvzWckQzoIszP8=
Expected: 6.1.7601.23403
Failed to trace component amd64_usbport.inf.resources_31bf3856ad364e35_6.1.7601.23403_en-us_4cc60429d68d2bf5 with return code -3.
FileScan:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-10-17 18:50:47.419
Script hash: sl2rFzBuJfQe4mf9sjFunFbTJaCoICi+USKq7WPqcXQ=
----------------------EOF-----------------------

BrianDrab · Oct 17, 2016

Thanks. I need to see the registry hives.

Retrieve Components/Software Hives
Note: The Software have has confidential and sensitive information in it so please send me a PM with a link to that particular hive so it's not in the public form.

Please download the Freeware RegBak from here: Acelogix Software - Download products
You will find it at the bottom of the page that the link brings you to.
Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
Click the New Backup button. Accept the defaults and simply click Start.
When it says Finished successfully, click the Close button.
This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, two of which are named COMPONENTS and SOFTWARE.
Copy these two files to your Desktop. If the COMPONENTS file does not exist, please fetch it instead from C:\Windows\System32\config\COMPONENTS.
Now right click on these files on your desktop and select Send to > Compressed (zipped) folder.
Then please upload the zip file(s) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Dropbox or One Drive or SendSpace and then just provide the link in your reply.
You can close any open windows you have as well as the RegBack program now.

SleepyDude · Oct 17, 2016

Hi Brian,

Why not collect the files from the backup created by FRST on C:\FRST\Hives?

BrianDrab · Oct 17, 2016

I wasn't aware that the COMPONENTS hive was one of them that was backed up? We could use that for the SOFTWARE hive however.

BrianDrab · Oct 17, 2016

For just the COMPONENTS hive we can just do a copy instead of using a tool.

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.

SleepyDude · Oct 17, 2016

In my case all the hives are on the backup.

FRST uses ERDNT and I have found that ERDNT will backup the components hive also if its loaded at the time of backup.

BrianDrab · Oct 17, 2016

Good to know, thanks!

Yes, let's get the COMPONENTS and SOFTWARE hive from there then.

BrianDrab · Oct 17, 2016

Thanks for the info. This confirms that this is a known issue with KB3125574. There is a hotfix that resolves this. KB3181988.

SleepyDude · Oct 17, 2016

Hi Brian,

The KB3181988 update did the trick.
Problem solved :thumbs_up::beerchug2:

BrianDrab · Oct 17, 2016

Excellent. Take care.

[SOLVED] Win7 x64 SFC errors generated by Windows Update Rollup May 2016

Windows Update Moderator, Security Analyst

Emeritus

Attachments

Windows Update Moderator, Security Analyst

Emeritus

Attachments

Windows Update Moderator, Security Analyst

Emeritus

Windows Update Moderator, Security Analyst

Emeritus

Windows Update Moderator, Security Analyst

Emeritus

Windows Update Moderator, Security Analyst

Emeritus

Windows Update Moderator, Security Analyst

Emeritus

Emeritus

Windows Update Moderator, Security Analyst

Emeritus

Emeritus

Windows Update Moderator, Security Analyst

Emeritus