Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Problem using SFC.EXE to Repair System Files


  • Please log in to reply
15 replies to this topic

#1 flying92

flying92

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 25 November 2008 - 07:46 PM

Hi!
I have been in the process of restoring my computer from a virus with the help of someone on malwareremoval.com. The person helping me sent me to the page on this site ( http://www.bleepingcomputer.com/forums/t/43051/how-to-use-sfcexe-to-repair-system-files/ ) to recover my operating system files. I was going through the steps "to run SFC.EXE /SCANNOW without a Windows installation CD - only a restore CD from the manufacturer". I copied the directory "i386" from C:\WINDOWS\Driver Cache to C:\ and I redirected the regedit HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SetupSourcePath to C:\ so that it would read the i386 folder after rebooting. When I ran SFC.EXE /SCANNOW, I was getting the error message "please insert XP disk". Could the files in the i386 folder be incorrect or not up to date? What can I do to update my system files without an XP disk (only my system recovery disks)?

Thanks in advance,
Mark

Edited by flying92, 25 November 2008 - 08:09 PM.


BC AdBot (Login to Remove)

 


#2 Michael-Anthony

Michael-Anthony

  • Banned
  • 267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:38 PM

Posted 25 November 2008 - 09:39 PM

go ahead and add to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SetupSourcePath to make it C:\i386 instead of C:\


or just burn the i386 folder to a cd.

#3 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 26 November 2008 - 10:20 PM

I just tried that and it is still asking for the XP cd. If there is no other option, will try to get ahold of one.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 27 November 2008 - 11:20 AM

FWIW: I also (earlier this week) tried pointing to the i386 folder on my XP Home system...even edited the registry also...and sfc /scannow still required my slipstreamed XP CD before it would run properly.

Louis

#5 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:09:38 PM

Posted 27 November 2008 - 05:47 PM

Go to Start > Run and type in Notepad
Copy/paste the following text inside the code box into a new notepad document. Make sure that under Format menu Word Wrap is unchecked.

reg query "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" /v SourcePath > look.txt
reg query "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v SourcePath >> look.txt
reg query "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" /v ServicePackSourcePath >> look.txt
  • Go to the File menu at the top of the Notepad and select Save as.
  • Select save in: desktop
  • Fill in File name: look.bat
  • Save as type: All file types (*.*)
  • Click save
  • Close the Notepad.
  • Locate and double-click look.bat on the desktop.
  • Notepad will open with some txt in it. Copy and paste the contents in your next reply.


#6 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 27 November 2008 - 07:37 PM

Here it is:

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
SourcePath REG_SZ c:\i386


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
SourcePath REG_SZ D:\I386


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
ServicePackSourcePath REG_SZ c:\windows\ServicePackFiles



#7 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:09:38 PM

Posted 27 November 2008 - 09:05 PM

  • Make sure the i386 folder is placed on C drive (the path is c:\i386)

  • Go to Start > Run and type in Notepad
    Copy/paste the following text inside the code box into a new notepad document. Make sure that under Format menu Word Wrap is unchecked.

    reg add "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" /v SourcePath /t reg_sz /d C:\ /f
    reg add "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v SourcePath /t reg_sz /d C:\ /f
    del look.bat
    • Go to the File menu at the top of the Notepad and select Save as.
    • Select save in: desktop
    • Fill in File name: look.bat
    • Save as type: All file types (*.*)
    • Click save
    • Close the Notepad.
    • Locate and double-click look.bat on the desktop.
    • Reboot your computer.
  • Go to Start > Run and type or copy and paste in the Run box: sfc /scannow

    (note the space between sfc and /)

    The scan might take at least 20 minutes may be more depending on the system. Please tell me how it went.
EDIT: As with any registry modifications, it is recommended that you backup your registry before proceeding.

Edited by usasma, 29 November 2008 - 08:40 AM.
EDIT:


#8 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 27 November 2008 - 10:24 PM

I am still getting the dialog box, "Files that are required for Windows to run properly must be copied to the DLL Cache. Insert your Windows XP Professional CD now."

Would it be possible to download the needed files from Microsoft?

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:09:38 PM

Posted 28 November 2008 - 02:47 AM

There must be still some some registry entry left.

Download regsearch.zip by Bobbi Flekman and Save it to your desktop.
  • Extract it to your desktop. It will extract the zip file to a folder named regsearch.
  • Open the folder and double click regsearch.exe to start the program.
  • Type sourcepath in the upper window.
  • Type relativesourcepath in the lower window.
  • Click "OK" and Registry Search will search the Registry and report what it finds.
  • Copy and paste the result into your next reply.
Note: The search takes a while. If you get notifications of access violation click Ok as many times as it needed.

#10 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 28 November 2008 - 10:00 AM

This is the log it produced:

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman 2005
; Version: 2.0.5.0

; Results at 11/28/2008 9:53:51 AM for strings:
; 'sourcepath'
; Strings excluded from search:
; 'relativesourcepath'
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
"SourcePath"="C:\\"
"ServicePackSourcePath"="c:\\windows\\ServicePackFiles"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"SourcePath"="C:\\"

; End Of The Log...



#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:09:38 PM

Posted 28 November 2008 - 10:46 AM

The registry items are OK and all point to C drive.

The i386 folder should be C:\i386 and ServicePackFiles folder should be here c:\windows\ServicePackFiles. If this is also OK then it is possible you don't have full i386 folder. So the System Files Checker tries to replace some corrupted system file but the file doesn't exist neither in your i386 folder nor in ServicePackFiles.

Some type of infection infect .exe files beyond repair. A couple of system files are restorable but if you have had a file infector the System File Checker might not do the job.

Another option is to update Windows (if you have Service Pack 2 updating to service pack 3 might work).

#12 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 29 November 2008 - 09:42 AM

I am not sure what else I can do. I don't have access to an XP disk and even after all the sugestions above, sfc /scannow is still asking for it. I downloaded service pack three and after that didn't resolve it, I copied the i386 folder from a friend's computer. When I was getting the service pack three download, it said that some systems will still ask for the XP cd.

#13 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:09:38 PM

Posted 29 November 2008 - 10:05 AM

So the damage to system files might be greater than what initially thought. In that case a repair install of of Windows might be the solution but I would go for a reformat and clean install. In both cases you need a Windows CD. I don't really know what else you can do.

#14 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 29 November 2008 - 11:07 AM

If you have a valid Windows key for either XP Home or XP Pro...the logical solution is to have someone burn you a copy of the respective version of XP installed (no matter what version) and then create a slipstreamed CD from that and including SP3 in the slipstream.

Hard for me to believe that XP install CDs are sparse in any section of the world.

Louis

#15 flying92

flying92
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 30 November 2008 - 11:49 AM

Thanks for your help. I will continue to look for a XP cd. When I find one, I will check back in here for further assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users