This post has been de-listed
It is no longer included in search results and normal feeds (front page, hot posts, subreddit posts, etc). It remains visible only via the author's post history.
I used to run a DISM.exe /Online /Cleanup-image /Restorehealth and then sfc /scannow, as suggested in Microsoft's documentation:
- If you are running Windows 10, Windows 8.1 or Windows 8, first run the inbox Deployment Image Servicing and Management (DISM) tool prior to running the System File Checker.
and had never encountered any file corruptions till date
For the last few days, I started doing DISM.exe /Online /Cleanup-image /Scanhealth and then sfc /scannow but I started encountering .dll file corruptions in the SFC scan results randomly. Most of the time there were no corruptions detected but three scans of out of all in the last 20-25 days (atleast 1 scan everyday) detected corrupted dlls (hash mismatch) and they were: SHCore.dll, dialserver.dll and mshtml.dll (today after reinstalling Debian Stable). After doing a DISM with /Restorehealth, the dlls were repaired and had the correct (expected) hash. I managed to copy the corrupted and original/repaired versions of dialserver.dll and mshtml.dll. I did a hexdump on both versions (original and corrupted) of the dlls and then a diff of the hexdump and there was only a difference of a single byte which was incremented by one than in the original (byte with value 40 was 41 in corrupted version) in the .text section. I also checked both the versions in ghidra and there wasn't any significant change in the instruction at the changed byte's location. This started happening after dual booting Debian which I thought was doing something sketchy, but it happens to be the same time I started doing /Scanhealth instead of /Restorehealth (I don't remember exactly if started this after installing Debian or before that but in the same time period, last 20-25 days).
Also the modification and creation date for the corrupted dlls corresponds to the date when I installed windows cumulative updates even when the hash mismatch detected (at a later date, today) means there were some modifications.
But after looking at Microsoft's documentation saying to run DISM with /Restorehealth for Windows 10 and 8 specifically before SFC suggests that the DISM with /Restorehealth must be fixing some windows runtime mess in Windows 10 and 8 (only) after which the SFC scan can be ran without any problems. Is this suspicious?
Subreddit
Post Details
- Posted
- 11 months ago
- Reddit URL
- View post on reddit.com
- External URL
- reddit.com/r/AskNetsec/c...