CBS.log corrupt can't update windows Vista

jackel · Mar 24, 2013

Hello

The machine I am fixing had malware and trojans on it. I removed them off the computer (dell e521). I used Malewarebytes to do so. The problem looks to have come from pcmightymax 2012. Updating can not be done. I tried the sfc/scannow and it ran but was unable to fix the problem. the message returned reads

Windows Resource protection found corrupted files but was unable to fix some of them
CBS.log windir\logs\CBS\CBS.log

here is the zip CBS
View attachment CBS.zip

Thanks

tom982 · Mar 24, 2013

Hello jackel and welcome to Sysnative!

The file that is corrupt on your computer is quite obscure and I haven't been able to trace what update it originated from to extract a clean copy from. To be able to trace it properly, I will need you to do something for me please:

Upload a file to Dropbox

Note: If you prefer, the same techniques can be applied to your Skydrive however these instructions may not necessarily work for Skydrive.

If you haven't already created a Dropbox account, please do so Here
Although this procedure can be done directly through the website, it is much easier to do so via the Windows client which can be downloaded from the Dropbox website:

https://www.dropbox.com/install
After you have downloaded and installed that, you should now see Dropbox in your Favourites box in Windows Explorer. This is the folder that will be synchronised with the Dropbox servers, anything that you wish to back up online can be put in here, but today we will be using it to transfer files.
To access your Dropbox folder, just click on the link in the top left hand corner of Windows Explorer (accessible from any location - Documents etc.). Alternatively, you can double click on the icon

found in your system tray (next to the time). If you are still having issues locating this folder, unless otherwise specified, it can be found under this location: C:\Users\{Your username}\Dropbox
Copy all of the following files to the Public folder in your Dropbox:
- C:\Windows\system32\config\COMPONENTS (it has no file extension)
Select all files by pressing Ctrl+A then right-click and select Send to > Compressed (zipped) folder
This will create a .zip

file in your Public folder.
Right-click on this file and select Dropbox > Copy Public Link then Paste (Ctrl + V) this link into your next post for me please

Tom

jackel · Mar 24, 2013

hello Tom982

I ran into a problem when trying to paste the file into dropbox. I am getting the message "the action can't be completed because the file is open in another program. Close the file first" problem is I am not sure what program is using it

niemiro · Mar 25, 2013

jackel said:
hello Tom982

I ran into a problem when trying to paste the file into dropbox. I am getting the message "the action can't be completed because the file is open in another program. Close the file first" problem is I am not sure what program is using it

Hello :)

No problem, we can overcome that problem.

Export COMPONENTS Hive

Please download RegBak (by AceLogix Software) from the link below and save it to your Desktop.

Download Mirror #1

Right-click > Extract all... and extract the files to your Desktop
For 32-bit (x86) editions of Windows, double-click on regbak.exe
For 64-bit (x64) editions of Windows, double-click on regbak64.exe
If you are unsure whether you have x86 or x64 Windows, see here
Without changing any options, click Next. RegBak will now backup all of your registry hives.

Now, this time, copy the COMPONENTS file to your Public Dropbox from the newly created backup, as this file won't be in use. It is located here: C:\Windows\RegBak\{Date}\COMPONENTS

Then please follow the remainder of Tom's instructions, and post us a link to the file. One of us will take a look at it :)

Thank you!

Richard

jackel · Mar 25, 2013

Thanks Niemiro

Here's the link to the components file

https://www.dropbox.com/s/o6u71isd64lwagg/components.zip?m

tom982 · Mar 26, 2013

Hi Jackel,

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a files should be created on your Desktop: SFCFix.txt.
Copy (Ctrl + C) and Paste (Ctrl + V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

Tom

jackel · Mar 27, 2013

Hello Tom982

Here is the txt file from the sfcfix

Code:

SFCFix version 1.3.2.1 by niemiro.
Start time: 2013-03-28 01:33:39.992
Using .zip script file at C:\Users\Rogers\Desktop\SFCFix.zip
 

TakePermissions::
Successfully took permissions for file or folder C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\
Successfully took permissions for file or folder C:\Windows\System32\en-US\
TakePermissions:: directive completed successfully.
 

CopyFiles::
Failed to copy file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui with error code 0x5.
Failed to copy file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\System32\en-US\wpdshext.dll.mui with error code 0x5.
CopyFiles:: directive failed to complete successfully.
 

RestorePermissions::
Fatal error: Trailing backslash or length error for file C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\ in RestoreFromDataBlock.
Fatal error: Trailing backslash or length error for file C:\Windows\System32\en-US\ in RestoreFromDataBlock.
RestorePermissions:: directive failed to complete successfully.
 

Failed to process all directives successfully.
SFCFix version 1.3.2.1 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2013-03-28 01:33:40.834
----------------------EOF-----------------------

niemiro · Mar 28, 2013

Hello jackel :)

Based on that output, I need to slightly tweak the script for your system.

Please drag and drop this script onto SFCFix.exe, just as you did last time, and post the output in exactly the same way.

Thank you!

Richard

jackel · Mar 28, 2013

Hello Niemiro

Here is the new sfcfix txt file

Code:

SFCFix version 1.3.2.1 by niemiro.
Start time: 2013-03-28 15:26:12.790
Using .zip script file at C:\Users\Rogers\Desktop\SFCFix.zip
 

TakePermissions::
Successfully took permissions for file or folder C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Successfully took permissions for file or folder C:\Windows\System32\en-US\wpdshext.dll.mui
TakePermissions:: directive completed successfully.
 

CopyFiles::
Successfully copied file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui.
Successfully copied file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\System32\en-US\wpdshext.dll.mui.
CopyFiles:: directive completed successfully.
 

RestorePermissions::
Successfully restored ownership for C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Successfully restored permissions on C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Failure code returned from icacls process in RestoreFromDataBlock function for file C:\Windows\System32\en-US\wpdshext.dll.mui. Error code 0x5.
Failed to find stored datablock for file C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb in RestoreFromDataBlock.
Failed to find stored datablock for file C:\Windows\System32\en-US in RestoreFromDataBlock.
RestorePermissions:: directive failed to complete successfully.
 

Failed to process all directives successfully.
SFCFix version 1.3.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2013-03-28 15:26:13.180
----------------------EOF-----------------------

niemiro · Mar 28, 2013

Hello again :)

We still have a little bit of work to do, but we have achieved one of our intermediate goals with that script.

Whilst I get myself ready, can you please re-run SFC and confirm that that problem has been fixed.

Thank you!

Richard

jackel · Mar 28, 2013

Hey Niemiro

Here is the rerun

Code:

SFCFix version 1.3.2.1 by niemiro.
Start time: 2013-03-28 15:49:38.891
Using .zip script file at C:\Users\Rogers\Desktop\SFCFix.zip
 

TakePermissions::
Successfully took permissions for file or folder C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Successfully took permissions for file or folder C:\Windows\System32\en-US\wpdshext.dll.mui
TakePermissions:: directive completed successfully.
 

CopyFiles::
Successfully copied file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui.
Successfully copied file \\?\C:\Users\Rogers\AppData\Local\niemiro\Archive\wpdshext.dll.mui to \\?\C:\Windows\System32\en-US\wpdshext.dll.mui.
CopyFiles:: directive completed successfully.
 

RestorePermissions::
Successfully restored ownership for C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Successfully restored permissions on C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui
Failure code returned from icacls process in RestoreFromDataBlock function for file C:\Windows\System32\en-US\wpdshext.dll.mui. Error code 0x5.
Failed to find stored datablock for file C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb in RestoreFromDataBlock.
Failed to find stored datablock for file C:\Windows\System32\en-US in RestoreFromDataBlock.
RestorePermissions:: directive failed to complete successfully.
 

Failed to process all directives successfully.
SFCFix version 1.3.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2013-03-28 15:49:39.125
----------------------EOF-----------------------

niemiro · Mar 28, 2013

Ah! I am sorry! I meant for you to go back to Command Prompt and type in sfc /scannow again and look at the message you get out of that.

Sorry for all these ridiculously confusing names. I didn't plan it out very well when I made SFCFix, did I?

jackel · Mar 28, 2013

Hey Niemiro

Here is the sfc/scannow message

"Windows Resource Protection did not find any integrity violations."

niemiro · Mar 28, 2013

Awesome news! Something good happened :)

There is just a little bit more work we have to do. I will post back when I have your next fix ready (not yet).

Thank you!

niemiro · Mar 28, 2013

Hello again :)

Please click start, search for regedit, and press enter.

Navigate through to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_7_for_KB2656362~31bf3856ad364e35~x86~~6.0.1.1

Right click on the key, and select Permissions...

Click Advanced. Navigate to the Owner Tab. Select your username from the list, and click OK.

Back to the original window, select Users from the list, and put a check in Full Control: Allow.

Click OK.

All those extra windows should now be closed. Staying in the Package_7_for_KB2656362~31bf3856ad364e35~x86~~6.0.1.1 key, in the right hand pane of regedit, right click in empty space > New > DWORD (32-bit) Value.

Give it a name of CurrentState, and then double click on it, and give it a value of 70 (leaving the radio dot in hexadecimal).

Click OK.

Now right click on the key again > Permissions..., and take the checkbox out of Users: Full Control: Allow. Click OK again.

Done :)

Please try Windows Update again and let me know if there has been any improvement.

Finally, there is one more very important step for you to perform. Please run the attached SFCFix script (drop it onto SFCFix.exe) and copy and paste me the output.

Thank you!

Richard

jackel · Mar 28, 2013

Here is the txt file Niemiro

Code:

SFCFix version 1.3.2.1 by niemiro.
Start time: 2013-03-28 20:14:34.713
Using .txt script file at C:\Users\Rogers\Desktop\SFCFix.txt
 

PrintDataBlocks::
C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\|S-1-5-18
C:\Windows\System32\en-US\|S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464
C:\Windows\WinSxS\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.0.6002.18112_en-us_4d3216725918d2eb\wpdshext.dll.mui|D:PAI(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;0x1200a9;;;BA)(A;;0x1200a9;;;SY)(A;;0x1200a9;;;BU)S:AI|S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464
C:\Windows\System32\en-US\wpdshext.dll.mui|D:PAI(A;;FA;;;WD)S:AI|S-1-1-0
PrintDataBlocks:: directive completed successfully.
 

Successfully processed all directives.
SFCFix version 1.3.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2013-03-28 20:14:34.728
----------------------EOF-----------------------

jackel · Mar 28, 2013

It still will not allow update

niemiro · Mar 29, 2013

Hello again :)

Can you please export another CBS folder and WindowsUpdate.log, and I'll take a look at what still might be failing:

Export CBS folder and WindowsUpdate.log

Click the Start button

then click Computer.
Double-click on the C: drive, under the Hard Disk Drives category, and then scroll down to, and double click on the Windows folder.
Find and double click on the Logs folder.
Right-click on the CBS folder, and select Copy.
Go back to your Desktop, right-click on it, and select Paste. You should now see a copy of the CBS folder appear on your Desktop called CBS.
Copy into this new CBS folder on your Desktop the file: C:\Windows\WindowsUpdate.log
Right-click on this new folder, and navigate through Send to, and select Compressed (zipped) folder.
A new file, also called CBS (CBS.zip), but this time with a different icon, will be created.

Now please upload this file. Thank you!

Richard

jackel · Mar 29, 2013

Hello Niemiro

here is the cbs file with the windows update log

https://www.dropbox.com/s/s4vekbwhrl539k3/CBS.zip?m

niemiro · Mar 29, 2013

jackel said:
Hello Niemiro

here is the cbs file with the windows update log

https://www.dropbox.com/s/s4vekbwhrl539k3/CBS.zip?m

Thanks a lot for that. The logs have revealed the problem. Please give me a couple of hours to put together a fix.

Thank you!

Richard

CBS.log corrupt can't update windows Vista

Well-known member

Emeritus

Well-known member

Senior Administrator, Windows Update Expert

Well-known member

Emeritus

Attachments

Well-known member

Senior Administrator, Windows Update Expert

Attachments

Well-known member

Senior Administrator, Windows Update Expert

Well-known member

Senior Administrator, Windows Update Expert

Well-known member

Senior Administrator, Windows Update Expert

Senior Administrator, Windows Update Expert

Attachments

Well-known member

Well-known member

Senior Administrator, Windows Update Expert

Well-known member

Senior Administrator, Windows Update Expert