Windows Vista forum: SFC & corrupted files: shock results on successive SFC runs

http://forums.cnet.com/7723-6122_102-524695.html

Loss of power during updates or lock ups are a fine source for this issue.

Not that you should give Microsoft any respite over not providing good OS fix-it tools.
Bob

There has been no loss of power during any updates, and the hardware diagnostics on the laptop finds no issues. The power supply comes via a UPS. Like any good Windows system, it will lockup occasionally, but the BSOD is extremely rare, and a hard boot is only required every few months or so. I keep my system as clean as possible, and run SFC (and even KB947821) and chkdsk regularly, even if no issues have presented themselves (although they usually do: Vista needs to be renamed the "Not Responding" os).

What I am saying is that if I run SFC, then immediately run it again--the next minute--and even again and again, without doing anything else--it will find corrupted files each time. There could not possibly have been any user interaction, no updates or anything else, to cause such a thing, and I have tried it with the wireless connection off, with no difference. It has to be a system process or something that I have installed. Maybe Norton is doing it. Before using Reimage, SFC would always find a few files that it could not fix, but now it repairs everything successfully.

Sorry but this is a rarity here. And I write apps (C#, now Android.)

Norton? Sorry but they failed me years ago. I've moved on.
Bob

Another issue I have is that files that seem to be the same are not. I first noticed this with some--a small fraction--of my music files after I started using Folder Match to synchronize the music folder on my pc with an external hd. Folder Match would tell me that some files in both places were not the same, but they were files that I have not played or touched with any program for years. In a few cases, it has done the same thing with video files. The difference is the hash: the files are of the identical size, bytewise. And it's only a few files, normally 10 or 20 out of the 113 gb of music. They sound the same; there is no difference between them that I can discern. Sometimes these are files that I have created, not music from a cd. I wondered for a while if maybe iTunes, when it creates its library, might do something to the files when it tries to add info from the internet to a folder, but I don't think that's it. Something is happening to files on my pc that is altering the hash, which is the same issue that SFC is finding with a very few system files. The only suspects are Norton, and Diskeeper, or maybe Vista itself. I doubt that anyone would ever have thought to run SFC consecutively as I did, so I don't know if it is the OS. I did use Smart Defrag for a while, not for the defrag, but for the smart file placement, and I thought that Smart Defrag was the culprit for a long time, but I stopped using it, and the problem still occurs.

What happens if you stop using the Apps you listed in your last reply.
Bob

I will try running sfc successively from safe mode, the results of which should tell me something. I plan to uninstall Diskeeper for a while to see if that helps also. If not a system process, then the mere fact that Diskeeper moves so many files around so often increases the likelihood that something will go wrong. I've run Diskeeper successively also, just to see something, and I am puzzled by their algorithms also: you can run it 3 or 4 times in a row, and each time it will move the MFT somewhere else, while it is doing which, by the way, your pc will be very slow in responding to any user input. I had not gotten around to finishing my troubleshooting, and hoped that someone, somewhere would have noticed the same thing about successive SFC runs and would have an explanation.

Do you mean 'this' one? http://www.reimage.com/

If so, I think you may have found your problem. WOT tells me this is a toxic utility and warned me off that web site when I tried to go there. Their reports here;
http://www.mywot.com/en/scorecard/reimage.com

How was the system and SFC before you started using Reimage?

Mark

The problem is of very long standing, and is one of the reasons I started using Reimage, which only recently came out with a 64-bit version. In other words, Reimage could not possibly have caused the problems since the problems predated my use of it by a year and a half. It took a lot of hassle to get Reimage to work, but it actually fixed the system files that Microsoft itself could not fix. As I stated, only AFTER using Reimage did SFC stop finding files that it thought were corrupted but was unable to fix, so the program obviously did something right: I was having to replace a few corrupted system files manually, such as autochk.exe, and I was having to do so regularly, which got to be annoying, and there were a few other system files that were getting corrupted regularly also, for which Microsoft did not have a fix. I see many user reviews on WOT showing that they are put off by its "scare" advertising tactics, which is not unusual among security product vendors, as well as its sales protocol, such as using affiliates. They may very well exaggerate the problems that your system has, I could care less: all I care about is those annoying corrupted system files. I don't care if their advertising people are shifty or not, all I care about is if their program works, and it does. (I have to admit I am disgusted by some of their terminology, like the "spare parts repository" to describe their archive of Windows system files, which some reviewers of the product hallucinate into the belief that they are storing images of their clients' computers.) I don't know what planet those people come from who are calling it rogueware, etc. I use NIS 2011 as my main resident security program, but I also run Malware Antibytes, PCMatic, and Panda's online free active scan, all on at least a weekly basis, and I have found no evidence of any malevolent activity from Reimage. Before running it in safe mode with networking, I ran it in regular mode, and Norton found no problem with it. To get it to work properly, you do have to run it in safe mode with networking (make sure Windows FW is on) from the admin account and the user account; it does appear to hang up for a long time, but so does KB947821: just ignore that and leave your pc alone.

It occurred again. First, though, let me tell you of an easy way to get clean system files to copy. There are all kinds of complicated ways to get them off the install dvds, but this is easy. I made an image of the system using DiskImage. I had just run SFC before making the image, and everything was perfect, filewise. Also, I happen to have restored that particular image before, and run SFC immediately afterward, so I know for sure that the system files on that image are perfect. So, when it happened again, with autochk.exe as usual, I first took ownership of the "bad" autochk.exe, then mounted the good image, and copied and pasted the absolutely perfect file from the image into the appropriate folder. Well, guess what. SFC then decided that the file was bad and it couldn't fix it. So I know now that SFC is hallucinating. It has the wrong hash somewhere or the file it is comparing it too is corrupted.
2012-08-06 01:03:28, Info CSI 00000044 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe do not match actual file [l:22{11}]"autochk.exe" :
Found: {l:32 b:QFabLhupfA+6gVZcQA2SezqQBRksY+CcIN+f4OFY2mU=} Expected: {l:32 b:e8hHzmwtKcM08NFgC7veOTP/Rfa+5RhvRC5icKP57E4=}
2012-08-06 01:03:28, Info CSI 00000045 [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-08-06 01:03:28, Info CSI 00000046 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2012-08-06 01:03:28, Info CSI 00000047 Hashes for file member \??\C:\Windows\System32\autochk.exe do not match actual file [l:22{11}]"autochk.exe" :

Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"autochk.exe"; source file in store is also corrupted
2012-08-06 01:03:29, Info CSI 0000004a Repair results created:

I ran a search for all autochk.exe files on my C: drive as well as the image. I have not run checksums yet, but I did notice something peculiar. Autochk comes in 2 different flavors, apparently, the 6.1.7601.17514, the Win7 flavor, but the 6.1.7600.16385 flavor, the Vista flavor. Although the details tab show the identical file name and version, the 6.1.7600.16385 exists as a 652 kb version, created 7/13/09 at 8:14 PM, in one of the winsxs\86 folders, and a 759 kb version created 7/13/09 at 8:38 PM, in one of the winsxs\amd64... folders. The 6.1.7601.17514 flavor exists in a 652 kb version, created on 11/20/10 at 4:16 AM, in SysWOW64 and in one of the winsxs\x86... folders, and it also exists in a 759 kb version, created on 11/20/10 at 5:24 AM, but the properties of that file shows no product name, file version or product version on the Details tab, and it is found in System32 as well as one of the winsxs\amd64... folders. Autochk.exe.mui displays similiar aberrations. Those file differences are all for "autochk.exe" on a system that sfc loves.