Coming soon - Get a detailed view of why an account is flagged as spam!
view details

This post has been de-listed

It is no longer included in search results and normal feeds (front page, hot posts, subreddit posts, etc). It remains visible only via the author's post history.

0
SFC without DISM has strange behavior
Post Flair (click to view more posts with a particular flair)
Post Body

I used to run a DISM.exe /Online /Cleanup-image /Restorehealth and then sfc /scannow, as suggested in Microsoft's documentation:

  1. If you are running Windows 10, Windows 8.1 or Windows 8, first run the inbox Deployment Image Servicing and Management (DISM) tool prior to running the System File Checker.

and had never encountered any file corruptions till date
For the last few days, I started doing DISM.exe /Online /Cleanup-image /Scanhealth and then sfc /scannow but I started encountering .dll file corruptions in the SFC scan results randomly. Most of the time there were no corruptions detected but three scans of out of all in the last 20-25 days (atleast 1 scan everyday) detected corrupted dlls (hash mismatch) and they were: SHCore.dll, dialserver.dll and mshtml.dll (today after reinstalling Debian Stable). After doing a DISM with /Restorehealth, the dlls were repaired and had the correct (expected) hash. I managed to copy the corrupted and original/repaired versions of dialserver.dll and mshtml.dll. I did a hexdump on both versions (original and corrupted) of the dlls and then a diff of the hexdump and there was only a difference of a single byte which was incremented by one than in the original (byte with value 40 was 41 in corrupted version) in the .text section. I also checked both the versions in ghidra and there wasn't any significant change in the instruction at the changed byte's location. This started happening after dual booting Debian which I thought was doing something sketchy, but it happens to be the same time I started doing /Scanhealth instead of /Restorehealth (I don't remember exactly if started this after installing Debian or before that but in the same time period, last 20-25 days).
Also the modification and creation date for the corrupted dlls corresponds to the date when I installed windows cumulative updates even when the hash mismatch detected (at a later date, today) means there were some modifications.
But after looking at Microsoft's documentation saying to run DISM with /Restorehealth for Windows 10 and 8 specifically before SFC suggests that the DISM with /Restorehealth must be fixing some windows runtime mess in Windows 10 and 8 (only) after which the SFC scan can be ran without any problems. Is this suspicious?

Author
Account Strength
60%
Account Age
3 years
Verified Email
Yes
Verified Flair
No
Total Karma
5
Link Karma
5
Comment Karma
n/a
Profile updated: 5 hours ago

Subreddit

Post Details

We try to extract some basic information from the post title. This is not always successful or accurate, please use your best judgement and compare these values to the post title and body for confirmation.
Posted
11 months ago