Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

SFC & corrupted files: shock results on successive SFC runs

Apr 30, 2011 7:04AM PDT

One of the glitches in Vista is that certain system files get corrupted, such as autochk.exe. There are some convoluted fixes for those issues, since SFC cannot fix all of them. I spent several months emailing MS tech support back and forth trying to fix such issues, and their only fix eventually was a reinstall. Reimage finally came out with a 64-bit version, and it didn't work at first either. SFC would still find corrupted files that it could not fix. Then I had the brainstorm, knowing how picky Vista is about user accounts, to run Reimage in admin first, then in my user account, and, for the first time since a clean install, SFC is able to fix all the corrupted files, AND, chkdsk now works. Glory. But the spooky thing is that, running SFC right after Reimage, it STILL finds corrupted files, but it is able to fix them. I had the brainstorm of running SFC again and again, immediately, and, guess what: having done nothing else on the computer, SFC keeps finding corrupted files (but at least fixes them). Either there is a problem with SFC, which I doubt, or some kind of system or other process is continuously causing file corruption, like a hash mismatch. What could this be?

Discussion is locked

- Collapse -
Clarification Request
Didn't you have issues before?
Apr 30, 2011 7:26AM PDT
- Collapse -
No updates or freezes or power losses
Apr 30, 2011 12:22PM PDT

There has been no loss of power during any updates, and the hardware diagnostics on the laptop finds no issues. The power supply comes via a UPS. Like any good Windows system, it will lockup occasionally, but the BSOD is extremely rare, and a hard boot is only required every few months or so. I keep my system as clean as possible, and run SFC (and even KB947821) and chkdsk regularly, even if no issues have presented themselves (although they usually do: Vista needs to be renamed the "Not Responding" os).

- Collapse -
"Like any good Windows system, it will lockup occasionally"
Apr 30, 2011 1:37PM PDT

Sorry but this is a rarity here. And I write apps (C#, now Android.)

Norton? Sorry but they failed me years ago. I've moved on.
Bob

- Collapse -
Something else may have the same cause
Apr 30, 2011 5:21PM PDT

Another issue I have is that files that seem to be the same are not. I first noticed this with some--a small fraction--of my music files after I started using Folder Match to synchronize the music folder on my pc with an external hd. Folder Match would tell me that some files in both places were not the same, but they were files that I have not played or touched with any program for years. In a few cases, it has done the same thing with video files. The difference is the hash: the files are of the identical size, bytewise. And it's only a few files, normally 10 or 20 out of the 113 gb of music. They sound the same; there is no difference between them that I can discern. Sometimes these are files that I have created, not music from a cd. I wondered for a while if maybe iTunes, when it creates its library, might do something to the files when it tries to add info from the internet to a folder, but I don't think that's it. Something is happening to files on my pc that is altering the hash, which is the same issue that SFC is finding with a very few system files. The only suspects are Norton, and Diskeeper, or maybe Vista itself. I doubt that anyone would ever have thought to run SFC consecutively as I did, so I don't know if it is the OS. I did use Smart Defrag for a while, not for the defrag, but for the smart file placement, and I thought that Smart Defrag was the culprit for a long time, but I stopped using it, and the problem still occurs.

- Collapse -
Them is good clues.
May 1, 2011 1:11AM PDT

What happens if you stop using the Apps you listed in your last reply.
Bob

- Collapse -
Will get around to it shortly
May 1, 2011 4:45AM PDT

I will try running sfc successively from safe mode, the results of which should tell me something. I plan to uninstall Diskeeper for a while to see if that helps also. If not a system process, then the mere fact that Diskeeper moves so many files around so often increases the likelihood that something will go wrong. I've run Diskeeper successively also, just to see something, and I am puzzled by their algorithms also: you can run it 3 or 4 times in a row, and each time it will move the MFT somewhere else, while it is doing which, by the way, your pc will be very slow in responding to any user input. I had not gotten around to finishing my troubleshooting, and hoped that someone, somewhere would have noticed the same thing about successive SFC runs and would have an explanation.

- Collapse -
Clarification Request
That "Reimage"
Apr 30, 2011 10:50PM PDT
- Collapse -
Reimage use is only recent
May 1, 2011 4:34AM PDT

The problem is of very long standing, and is one of the reasons I started using Reimage, which only recently came out with a 64-bit version. In other words, Reimage could not possibly have caused the problems since the problems predated my use of it by a year and a half. It took a lot of hassle to get Reimage to work, but it actually fixed the system files that Microsoft itself could not fix. As I stated, only AFTER using Reimage did SFC stop finding files that it thought were corrupted but was unable to fix, so the program obviously did something right: I was having to replace a few corrupted system files manually, such as autochk.exe, and I was having to do so regularly, which got to be annoying, and there were a few other system files that were getting corrupted regularly also, for which Microsoft did not have a fix. I see many user reviews on WOT showing that they are put off by its "scare" advertising tactics, which is not unusual among security product vendors, as well as its sales protocol, such as using affiliates. They may very well exaggerate the problems that your system has, I could care less: all I care about is those annoying corrupted system files. I don't care if their advertising people are shifty or not, all I care about is if their program works, and it does. (I have to admit I am disgusted by some of their terminology, like the "spare parts repository" to describe their archive of Windows system files, which some reviewers of the product hallucinate into the belief that they are storing images of their clients' computers.) I don't know what planet those people come from who are calling it rogueware, etc. I use NIS 2011 as my main resident security program, but I also run Malware Antibytes, PCMatic, and Panda's online free active scan, all on at least a weekly basis, and I have found no evidence of any malevolent activity from Reimage. Before running it in safe mode with networking, I ran it in regular mode, and Norton found no problem with it. To get it to work properly, you do have to run it in safe mode with networking (make sure Windows FW is on) from the admin account and the user account; it does appear to hang up for a long time, but so does KB947821: just ignore that and leave your pc alone.

- Collapse -
Answer
Win7 started doing the same thing
Jun 6, 2012 8:57AM PDT

I finally got pissed off and upgraded to Win7, and the corrupted files problem went a way for a while, then the same thing started happening, to the same system files, but in Win7. I would fix the problem by restoring a DiskImage image made prior to the incident, and, for about 3 months, the problem recurred, and I would revert again. For the last 8 months, there have been no incidents, and I suspect that one of the MS updates must have finally fixed the issue.

- Collapse -
Alas, I must have been dreaming
Aug 5, 2012 11:09PM PDT

It occurred again. First, though, let me tell you of an easy way to get clean system files to copy. There are all kinds of complicated ways to get them off the install dvds, but this is easy. I made an image of the system using DiskImage. I had just run SFC before making the image, and everything was perfect, filewise. Also, I happen to have restored that particular image before, and run SFC immediately afterward, so I know for sure that the system files on that image are perfect. So, when it happened again, with autochk.exe as usual, I first took ownership of the "bad" autochk.exe, then mounted the good image, and copied and pasted the absolutely perfect file from the image into the appropriate folder. Well, guess what. SFC then decided that the file was bad and it couldn't fix it. So I know now that SFC is hallucinating. It has the wrong hash somewhere or the file it is comparing it too is corrupted.
2012-08-06 01:03:28, Info CSI 00000044 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe do not match actual file [l:22{11}]"autochk.exe" :
Found: {l:32 b:QFabLhupfA+6gVZcQA2SezqQBRksY+CcIN+f4OFY2mU=} Expected: {l:32 b:e8hHzmwtKcM08NFgC7veOTP/Rfa+5RhvRC5icKP57E4=}
2012-08-06 01:03:28, Info CSI 00000045 [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-08-06 01:03:28, Info CSI 00000046 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2012-08-06 01:03:28, Info CSI 00000047 Hashes for file member \??\C:\Windows\System32\autochk.exe do not match actual file [l:22{11}]"autochk.exe" :

- Collapse -
Just noticed: file it is comparing it to IS corrupted
Aug 6, 2012 12:27AM PDT

Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"autochk.exe"; source file in store is also corrupted
2012-08-06 01:03:29, Info CSI 0000004a Repair results created:

I ran a search for all autochk.exe files on my C: drive as well as the image. I have not run checksums yet, but I did notice something peculiar. Autochk comes in 2 different flavors, apparently, the 6.1.7601.17514, the Win7 flavor, but the 6.1.7600.16385 flavor, the Vista flavor. Although the details tab show the identical file name and version, the 6.1.7600.16385 exists as a 652 kb version, created 7/13/09 at 8:14 PM, in one of the winsxs\86 folders, and a 759 kb version created 7/13/09 at 8:38 PM, in one of the winsxs\amd64... folders. The 6.1.7601.17514 flavor exists in a 652 kb version, created on 11/20/10 at 4:16 AM, in SysWOW64 and in one of the winsxs\x86... folders, and it also exists in a 759 kb version, created on 11/20/10 at 5:24 AM, but the properties of that file shows no product name, file version or product version on the Details tab, and it is found in System32 as well as one of the winsxs\amd64... folders. Autochk.exe.mui displays similiar aberrations. Those file differences are all for "autochk.exe" on a system that sfc loves.