On 5/24/2023 4:26 AM, T wrote:
Hi All,
Win 10 home 21H2 & 22H2
I worked on a customer yesterday with major
performance issues. I fixed!
One of the issues was a `jump 0` problem (dog
chasing his tail) trying to update from 21H2
to 22H2. 100% disk usage. I manually upgraded
him to 22H2 from ISO and that fixed that (the
disk 100%).
His antivirus ran all the way through
his hard drive without issue either. I did
remove about 40 pieces of junkware -- shhhheesh.
His hard drive passed diagnostics too. Fast
startup was off and I got a couple of nice
reboots too.
But what I find odd still is that under 21H2,
`sfc /scannow` froze at 40%. And under 22H2 it
froze at 10%. Weird.
Other than that, the dead came back to life and
his computer is running quite nicely.
You guys have any thoughts on the sfc matter?
Many thanks,
-T
Well, the online help is not helping.
You can see the developers have never had to deal
with a "problem" with their creation.
*******
PS C:\ > sfc /?
Microsoft (R) Windows (R) Resource Checker Version 6.0
Copyright (C) Microsoft Corporation. All rights reserved.
Scans the integrity of all protected system files and replaces incorrect versions with
correct Microsoft versions.
SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
[/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory> [/OFFLOGFILE=<log file path>]]
/SCANNOW Scans integrity of all protected system files and repairs files with
problems when possible.
/VERIFYONLY Scans integrity of all protected system files. No repair operation is
performed.
/SCANFILE Scans integrity of the referenced file, repairs file if problems are
identified. Specify full path <file>
/VERIFYFILE Verifies the integrity of the file with full path <file>. No repair
operation is performed.
/OFFBOOTDIR For offline repair, specify the location of the offline boot directory
/OFFWINDIR For offline repair, specify the location of the offline windows directory
/OFFLOGFILE For offline repair, optionally enable logging by specifying a log file path
e.g.
sfc /SCANNOW
sfc /VERIFYFILE=c:\windows\system32\kernel32.dll
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows /OFFLOGFILE=c:\log.txt
sfc /VERIFYONLY
*******
That means we get Procmon running, then filter on SFC later on,
and see where it stops. Perhaps Windows Defender or Tamper Proofing
setting are a problem ?
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
*******
from Reddit, I get:
"I know it sounds dumb, but try hitting enter a few times.
I've had scans get stuck until I do that."
Perhaps for an online scan, it is doing some network activity,
and it is stalled as it waits for a missing resource on the
server end.
Modern ProcMon, now includes the logging of
networking events. The only problem with this, is the network
identifiers in the listing, are things like "Akamai" and this is
generally useless for any forensic class work. If all the sooper
sekret Microsoft internal IPs end up as "Akamai" (a CDN), the situation
is hopeless. That's what happened the first time I needed that. You
can use Wireshark (but only for the simpler things in life).
Paul
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)