Share via


How to repair corrupt files identified by sfc /scannnow

Question

Wednesday, July 24, 2019 2:32 PM | 1 vote

My wife's Windows 10 computer failed a couple of days ago. Wouldn't boot, just went into the dreaded "Preparing Automatic Repair / Diagnosing your PC" loop. But never actually repaired anything. After booting and rebooting for a few hours, in despair, I had no choice but to reinstall Windows 10, using a repair CD which I'd created when we first set up the PC.

Windows 10 is now working again, but sfc /scannow is reporting as follows:

"Windows Resource Protection found corrupt files but was unable to fix some of them. For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included in the log file provided by the /OFFLOGFILE flag."

Looking at the above CBS.log file, there are numerous lines of gobbledygook such as:

"2019-07-24 14:56:51, Info                  CSI    0000033c Hashes for file member [l:23]'MSFT_MpPreference.cdxml' do not match.
** Expected: {l:32 ml:33 b:8861d55dd84b45902d2fbd8f73fd663be669f589105ce656000b77496ece0de6}.**
** Actual: {l:32 b:22454077de87f1cb3bff79e0acf51befbf929c31231f8c780fb9f254825f97ad}.**
2019-07-24 14:56:51, Info                  CSI    0000033d [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpPreference.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info                  CSI    0000033e Hashes for file member [l:17]'MSFT_MpScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8}.**
** Actual: {l:32 b:905248df4310b3bfe79b60dfe69b82517b81c16864e2e12677c50f6a66ca0459}.**
2019-07-24 14:56:51, Info                  CSI    0000033f Hashes for file member [l:17]'MSFT_MpScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8}.**
** Actual: {l:32 b:905248df4310b3bfe79b60dfe69b82517b81c16864e2e12677c50f6a66ca0459}.**
2019-07-24 14:56:51, Info                  CSI    00000340 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpScan.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info                  CSI    00000341 Hashes for file member [l:20]'MSFT_MpWDOScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd}.**
** Actual: {l:32 b:12f7403a57636e10490a52a2caf3010c56e0a86da83fda2c055e9534293039fb}.**
2019-07-24 14:56:51, Info                  CSI    00000342 Hashes for file member [l:20]'MSFT_MpWDOScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd}.**
** Actual: {l:32 b:12f7403a57636e10490a52a2caf3010c56e0a86da83fda2c055e9534293039fb}.**
2019-07-24 14:56:51, Info                  CSI    00000343 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpWDOScan.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info                  CSI    00000344 Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.
** Expected: {l:32 ml:33 b:dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da}.**
** Actual: {l:32 b:b4035789fec4e2e1ee3dd5e97a50a0cf5837308773d9ac1af3550f2ea04e9385}.**
2019-07-24 14:56:51, Info                  CSI    00000345 Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.
** Expected: {l:32 ml:33 b:dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da}.**
** Actual: {l:32 b:b4035789fec4e2e1ee3dd5e97a50a0cf5837308773d9ac1af3550f2ea04e9385}.**
2019-07-24 14:56:51, Info                  CSI    00000346 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpSignature.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info                  CSI    00000347 Hashes for file member [l:13]'Defender.psd1' do not match."

I suppose I should be flattered that Microsoft thinks an end-user would understand this guff, but this particular end-user does not.

Could someone explain why, having just reinstalled Windows 10, some of its files are corrupt? It has taken two days to reinstall Windows 10, my wife's apps and all of her settings. If sfc /scannow knows which files are corrupt, why cannot it simply replace them? 

So frustrating - and an utter time-waster. Does anyone have any idea how I can repair or replace the (apparently numerous) corrupted files?

BTW, Windows 10 is hopefully up to date - the most recently installed update is "Feature update to Windows 10, version 1903".

All replies (11)

Thursday, July 25, 2019 2:00 PM âś…Answered | 3 votes

the solution is 

sfc /scannow

 Dism /Online /Cleanup-Image /CheckHealth

 Dism /Online /Cleanup-Image /ScanHealth

 Dism /Online /Cleanup-Image /restoreHealth

sfc /scannow

sfc /scannow


Thursday, July 25, 2019 3:09 AM | 1 vote

Hi,

Try the following commands to fix these files: 

 

     Dism /Online /Cleanup-Image /CheckHealth

     Dism /Online /Cleanup-Image /ScanHealth

     Dism /Online /Cleanup-Image /restoreHealth

If they don't work, I suspect the image could be damaged, it's recommended to download the Windows 10 image from the following link and do a clean install: 

https://www.microsoft.com/en-us/software-download/windows10

Best regards,

Yilia 

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].


Thursday, July 25, 2019 7:31 AM | 1 vote

there is currently a known issue: System File Checker (SFC) incorrectly flags Windows Defender PowerShell module files as corrupted


Thursday, July 25, 2019 10:13 AM | 1 vote

Thank you both for your replies. I ran the three Dism commands, with results as follows:

"Dism /Online /Cleanup-Image /CheckHealth" returned:

No component store corruption detected.
The operation completed successfully.

"Dism /Online /Cleanup-Image /ScanHealth" returned:

The component store is repairable.
The operation completed successfully.

"Dism /Online /Cleanup-Image /restoreHealth" returned:

The restore operation completed successfully.
The operation completed successfully.

However, the first rerun of "sfc /scannow" still returned:

Windows Resource Protection found corrupt files and successfully repaired them. For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included in the log file provided by the /OFFLOGFILE flag.

But looking at the CBS.log file, there was only one type of error remaining (occurring quite a few times). Here is an example:

2019-07-25 10:34:25, Info                  CSI    0000007f Warning: Overlap: Directory \?\C:\WINDOWS\System32\drivers\en-US\ is owned twice or has its security set twice
**   Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}**
**   New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}**

I immediately ran "sfc /scannow" a second time. This time, it returned:

Windows Resource Protection did not find any integrity violations.

So, thank you very much. Problem solved. Most grateful.


Thursday, July 25, 2019 1:49 PM | 1 vote

In closing, I would just point out the disadvantage of downloading a vanilla image of Windows 10 (as recommended above). Not only does one lose everything that was pre-installed by the manufacturer on the particular PC (Lenovo in my wife's case), but - even worse - one cannot trust Microsoft to honour perfectly legal product codes. A few years ago, after another Windows corruption, I installed a vanilla version of Windows and then went to re-install MS Office. But despite my product code being perfectly legal, those nasty people at Microsoft decided to block it. To this day, I have no idea why - despite a most unhelpful conversation with someone at the other end of the Microsoft support line.

I do get the idea that things go wrong with Windows and that a vanilla re-install may often be for the best. But why does it, a) take me two days of effort, and b) provide me with no guarantee that my legally purchased MS Office product code will actually be re-honoured.

MS Office is hugely expensive - yet one has no redress when Microsoft decides not to honour it.


Monday, July 29, 2019 8:52 AM

I can confirm (as mentioned above) that System File Checker (SFC) is flagging Windows Defender PowerShell module files as corrupted. Having got rid of the error messages, I ran "sfc /scannow" again yesterday, only to find that they had come back. Re-running the above dism / dism / dism / sfc / sfc sequence got rid of them again.


Monday, July 29, 2019 9:19 PM

While the "Overlap: Directory xxx is owned twice..." is only a WARNING, is there a good explanation for the warning and if it is not a problem, then SFC should ignore it.  Right?


Wednesday, September 25, 2019 1:50 PM

Thank you sir, I got my pc fixed following your instructions.


Saturday, October 5, 2019 7:24 PM

Hi I have win10 home. None of this worked to repair troubleshoot. I have error code 0x80070005 Any other ideas maybe?


Saturday, October 5, 2019 8:16 PM

the error code is ERROR_ACCESS_DENIED .
You are running the commands from an elevated command prompt?


Sunday, October 13, 2019 1:06 AM

The problems reported in the opening post should be fixed by Microsoft updates following dism restorehealth.

These were windows defender hash mismatches (Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.)

The hash mismatches should have been addressed by recent windows updates.

Following the updates run dism /online /cleanup-image /restorehealth and sfc /scannow