Fixing Windows Corruption After Malware: DISM and SFC Repair

LIMEHAWK - Managed IT

Home>Incident Reports>Fixing Windows Corruption After Malware: DISM and SFC Repair

Incident

User's laptop came back from a malware remediation engagement. Threat was removed, scans came back clean, but the machine was "acting weird." The user described it as "broken." Not reinfected — genuinely broken. Settings app wouldn't open. Start menu search returned nothing for anything, including apps the user could see installed. Windows Update failing with cryptic errors. Random Explorer crashes when clicking into certain folders.

The malware had corrupted system files during its tenure on the machine, and removing the malware didn't restore the damage it caused. We needed to rebuild the Windows component store itself.

Observed symptoms

- Settings app: would flash briefly then close — couldn't change any system settings
- Start menu search: returned "No results" for everything, including installed apps
- Windows Update: error 0x80073712 — "component store has been corrupted"
- Explorer: random crashes, especially when accessing certain folders
- core applications: Office, Chrome, and the line-of-business app all worked fine

The pattern was clear: built-in Windows components were corrupted, but third-party applications were unaffected. The malware had modified or deleted protected system files, and Windows couldn't repair itself because the component store — the source of truth it repairs from — was also damaged.

Why sfc alone wouldn't work

The obvious first instinct is to run sfc /scannow. We did. It made things worse.

- first SFC run: "Windows Resource Protection found corrupt files but was unable to fix some of them"
- why it failed: SFC repairs files by copying them from the component store (WinSxS). If the component store is corrupt, SFC just copies corrupt files over corrupt files.
- CBS.log revealed: "Cannot repair member file... source file in [store] is also corrupted"

This is the classic chicken-and-egg problem with Windows corruption, and it trips people up constantly. SFC needs DISM to fix the component store first. Running SFC on a corrupted store just spreads the corruption — you can actually make a recoverable machine worse by running SFC in the wrong order.

Resolution

The proper repair sequence is DISM first (to fix the component store by downloading clean copies from Windows Update), then SFC (to repair system files from the now-clean component store). We automated this into a single script that runs the full repair chain in the right order.

Why this works

The script executes operations in the correct sequence. Order matters.

The repair chain:

1. DISM /ScanHealth: scans the component store for corruption, reports what's broken
2. DISM /RestoreHealth: downloads clean copies of corrupted components from Windows Update
3. SFC /scannow: now that the component store is clean, SFC can properly repair system files from it
4. DISM /StartComponentCleanup: removes superseded components, frees disk space at the end

Critical insight: DISM /RestoreHealth requires internet access to download components from Windows Update. On airgapped systems, you need to specify a local source (a mounted Windows ISO with a matching build). This script assumes internet connectivity — it's for endpoints, not isolated servers.

Outcome

Script completed in 34 minutes. DISM found and repaired 847 corrupted components. SFC subsequently found and replaced 12 protected system files that DISM's pass hadn't addressed directly. After a reboot, Settings app opened normally, Start menu search worked again, Windows Update installed the pending patches without error. Machine was fully functional.

- components repaired: 847 (by DISM)
- system files replaced: 12 (by SFC)
- total runtime: 34 minutes

Key takeaways

Takeaway

post-malware remediation should always include DISM/SFC — removing the malware doesn't undo the damage it caused.

Takeaway

DISM must run before SFC — running SFC on a corrupt component store makes things worse, not better.

Takeaway

"Settings won't open" plus "Search doesn't work" is the classic signature of component store corruption.

Takeaway

we now run this script proactively on all endpoints monthly — catches corruption before it becomes visible to users.

Need help with something like this? Contact us

• Automating CrushFTP Upgrades and In-Place Updates (Automation)

• PC Replacement: Zero Data Loss User Profile Migration (Automation)

• Winget for RMM: Silent Software Deployment at Scale (Automation)