SFC Reports Corruption Issues on all 4 of my PCs (after recent update)

Lots of us found the same problem after the WD platform was updated.
[see WD, Settings {in the bottom-left corner}, About - Antimalware client version]
from
4.18.1905.4
to
4.18.1906.3
[and some Insiders, users of preliminary updates, have said that it happened again after a further update}

Since the only effect seems to be the SFC error it is possible to just ignore the problem and wait for MS to fix it.

- - - - - - - - - - - - - - - - - - - - - - - - - -

If you want to fix it then look again at SFC - TenForumsTutorials and run the Dism restore health command explained there. Some of us found that an effective sequence was
1 Restart the computer
2 Check you are connected to the internet. The Dism command needs to use WU & an online {MS} source for the repair. ***
3 Open an Admin command window to use for each of the following commands
4 SFC /scannow
5 Dism /Online /Cleanup-Image /RestoreHealth
6 SFC /scannow
7 SFC /scannow [this final one being just to confirm that there are no remaining faults]

*** For those of us who have jobbed WU by crippling USOClient - This repair procedure still works despite that.
- - - - - - - - - - - - - - - - - - - - - - - - - -

Extracting SFC results from the CBS.log

You can use findstr commands to extract just the entries in the CBS log that you want.
- You never need to look through the entire log.
- SFC entries contain [SR]
- Other Windows functions, such as Windows installer, also write to the CBS log.
- Windows does archive the CBS log when it sees fit so you should extract results when you find an SFC problem and not leave it for a rainy day. If you do leave it too long, you might find the data you want in the archive files in %windir%\Logs\CBS [they are called cbsPersist...log].

To extract all SFC entries into a text file {choose your own path & filename; I include the computer name because I run the same code on several computers}

Code:

findstr.exe /c:"[SR]" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults.Log

To extract all SFC repairs into a text file {choose your own path & filename}

Code:

findstr.exe /c:"[SR] Repair" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults-Repairs.Log

To extract all SFC "could not reproject" failures into a text file {choose your own path & filename} - I have never found a decent explanation of this type of failure but, because each entry includes "source file in store is also corrupted", I believe that it can serve as an explanation for a corresponding entry in the irrepairables list.

Code:

[findstr.exe /c:"[SR] Could not reproject" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults-CouldNotReproject.Log

To extract all SFC failures to repair into a text file {choose your own path & filename}

Code:

findstr.exe /c:"[SR] Cannot repair member file" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults-Unrepairables.Log"

Note that every line in the output files has its date-time stamp so if the extracts were very long you could just search for the first instance of today's date to start looking through what it has just been up to.
- But, by being very well focussed, the extracts are normally short enough to be read easily and to be posted in a forum thread if necessary [unlke the CBS log itself, which is far too long to comprehend or to expect others to review].
- If you make multiple extractions [such as Irreparables & Could not reproject ones] then you can also use that date-time stamp to compare entries.

- - - - - - - - - - - - - - - - - - - - - - - - - -

When this particular problem appears, the irreparables list entries all contain, "Windows-Defender-Management-Powershell" and attribute the problem to a "hash mismatch".

There are several threads on this topic, including
sfc -scannow failing after this latest Defender Platfom update - TenForums
weird problem involving corrupted files. please help, i'm stumped. - TenForums
SFC and DISM error when trying to fix corrupt windows files - TenForums
sfc -scannow found corrupted file that could not be corrected [a general thread] - TenForums
System File Checker errors reported - TenForums

and the MS admission is at
SFC incorrectly flags WD PowerShell module files as corrupted - MSSupport


Denis

The Pool Man said:

Greetings All,

A recent update (presumably the last Cumulative) caused SFC to uncover corrupted files (and the CBS files stuff) on three computers. On the first two I believed it involved a conflict between Malwarebytes and Windows, but on the third one I believe it's simply the update.

I run SFC after all major and minor Windows releases. Almost always perfect. This time? 4 for 4.

Anyone else?

Oh, the only fix I've managed for the first three was some relentless DISM RestoreHealth sessions. At least 3 times in a row.

I would consider you lucky that it only happened this time. Every single Cumulative Update since Windows 10 was released for public use, I have had to repair SFC Corruption. The corruption usually manifests itself in the .wim file that can only be restored through the Advanced Recovery Environment for me anyways.

I had mentioned this before on the site, but no one even had any comment about it or they just don't run SFC I guess. Either way, I have got use to picking up the pieces after Cumulative Updates and have lived with it since Windows 10 release. Is it right?

No.

Is there a solution?

I haven't found one yet, (other than my manual restore of the .wim file) since it involves the restoration of a file that cannot be obtained by the Restore Health method (DISM).

Have I reported it to Microsoft?

Yes. Ever single Cumulative Update that caused it since Windows 10 release to the public. I even supplied them the Cumulative Update Versions since it started and it was just shrugged off as an older hardware issue. Really? Microsoft is the frigging company that evaluated my machine for upgrade approval through their Upgrade Assistant Tool.

Open Command Prompt as an Administrator, copy and paste this command and hit enter, let it do it`s thing until it says "Press an key" and your done. Restart the PC and run a system file check again. It will be perfect.

The corrupt file comes from a Defender update, it`s no big deal. Credit for the command goes to Cliff.

fsutil resource setautoreset true c:\&fsutil usn deletejournal /d /n c:&Dism.exe /online /Cleanup-Image /StartComponentCleanup&sfc /scannow&Dism.exe /Online /Cleanup-Image /RestoreHealth&sfc /scannow&Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase&pause

Hmmm, you seem to have a different problem.

I have updated my suggested recovery procedure [post #2 above] in response to new evidence.

For Dism to repair the defective components, the computer must be connected to the internet.
- The Dism command needs to use WU & an online {MS} source for the repair.
- [For those of us who have jobbed WU by crippling USOClient - This repair procedure still works despite that.]

I can understand the logic of it but it had never occurred to me before.
- Without any other source being available, there is nowhere for any replacement files to come from given that SFC has already checked the component store.
- WU & hence the internet acts as a default source when DISM /RestoreHealth /Source:nnnnnnnnnnn is not specified.
- For this particular situation, given that the fault is in a WD update issued after the ISO, the latest ISO is probably not going to do any good as a /Source:nnnnnnnnnnn.

Denis