Referenced memory I/O status error

Question

WIndows10 Pro 20H2

I just started getting the following error. No changes were made recently to the system

I looked up issues and it said it was related to memory so I ran memory diagnostic ... all good

I then ran both SFC & DISM and they failed:

C:\WINDOWS\system32>SFC /ScanNow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 20% complete.

Windows Resource Protection could not perform the requested operation.

C:\WINDOWS\system32>Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.19041.746

Image Version: 10.0.19042.746

[===========================54.3% ]
Error: 605

The specified buffer contains ill-formed data.

What is the issue and how do I clear it?

Answer 1

OK ... here is the issue

This system is hijacked at the MBR level. Your offline SFC process unmasked the culprit.
First it took me time just to get the system to boot the DVD drive and keep the CD/DVD ASUS drive operational.

When I did boot to the WIn10 20H2 DVD, I executed BCDEDIT and the response was:

"The boot configuration data store could not be opened, The requested system device cannot be found."

Just to verify, I tried the same process on another win10 20H2 system and it worked just fine to identify partition and system folder..

I turned system off and will be giving it to my system builder to root out the Hijacker.

Thanks for your help & patience.

Answer 2

Check all cables

Update drivers

In Command Prompt window, type chkdsk G: /f /r /x. Here G is the drive letter; you can replace it with your drive letter.

Answer 3

CHKDSK ran 3 hours, at reboot, same werfault. Interesting it is at the same address. How can I determine what app is there?

Answer 4

If you have another machine on your network that has same Windows version, you can try running dism with the /source switch. I tried downloading the Win10 ISO and using that as a source but it would always report an error in the log. After much web searching I concluded that dism would only work if the /source was the exact same version.

C:\Windows>ver
Microsoft Windows [Version 10.0.19042.746]

On the "good" pc, I shared out the C:\Windows folder. On the "bad" pc I ran.

del C:\WINDOWS\Logs\DISM\dism.log
del C:\WINDOWS\Logs\cbs\cbs.log
Dism.exe /Online /Cleanup-Image /restoreHealth /source:\\GoodPcName\windows
notepad C:\WINDOWS\Logs\DISM\dism.log
notepad C:\WINDOWS\Logs\cbs\cbs.log

Review the entries in the log files and see what errors you get.

Caveat, my "bad pc" is a VM that I play with. I had a problem with it a while back and in my cheat sheet, my notes say to use /source and point it to my laptop. Currently the VM is not broken so I can't tell if dism is really doing anything.

I tried multiple flavors of /source with the ISO and every one errored out.

Note that the log files might not get deleted because the tiworker processes (or something else) still has the file open. I made sure that I deleted them so that I could easily identify the output of the last dism command that I ran.

On the "good pc", you might want to first verify that dism reports it as being healthy.

Dism.exe /Online /Cleanup-Image /ScanHealth
Dism.exe /online /cleanup-image /analyzecomponentstore