[SOLVED] CBS Logs corrupt file(s) issue

dee_can · Aug 19, 2012

Hi, I was referred to this forum by Corrine from the Landszdown forum. Corrine has been helping me with some spyware and other issues on my computer. I believe I have the spyware/trojans issues straightened out, but after running a scannow on my computer I have some persistent CBS log errors/corrupt files that don't seem to be repaired and she thought I should have them looked at.

I'm attaching the zipped files for review of my logs. Please let me know if there is any problem with the files I've attached. Thank you.

Corrine · Aug 19, 2012

Welcome to Sysnative! Good job collecting the files. While you're waiting for a response, feel free to look around. It is quite a different setup here than at LandzDown.

tom982 · Aug 19, 2012

Hello dee_can and welcome to Sysnative :)

Unfortunately the files that you have uploaded aren't what we need to resolve your problem, so let's try and get the right files first.

Export CBS.log

Click the Start button

then click Computer
Double click on the C: drive, under the Hard Disk Drives category, and then scroll down to, and double click on the Windows folder
Find and double click on the Logs folder, and then inside that folder, the CBS folder
Right-click on the CBS.log file, and select Copy. It may show as just CBS (without the .log extension). Do not be concerned, and proceed to copy the file.
Go back to your Desktop, right-click on it, and select Paste. You should now see a file on your Desktop called CBS(.log)
Right-click on this file again, and navigate through Send to, and select Compressed (zipped) folder
Another new file, also called CBS, but this time with a different icon, will be created. Please uplaod this new file to the forum, here

Thanks to Richard for the instructions!

Tom

Corrine · Aug 19, 2012

Dee, before you do the above, you should probably delete the other CBS zip files so you don't get confused.

dee_can · Aug 19, 2012

I was afraid I wouldn't send the right ones. I'll follow your instructions, Tom. Thanks. And thank you Corrine for the advice, I'll delete the other ones first.

dee_can · Aug 19, 2012

OK, I got it. I hope.

tom982 · Aug 19, 2012

Hi Dee,

Great job! That's perfect :)

I've just had a look at your CBS log and there are two repeat offenders:

C:\Windows\PolicyDefinitions\en-US\InetRes.adml
C:\Windows\PolicyDefinitions\inetres.admx

These files define the policies in Internet Explorer. This doesn't come as much of a surprise after reading your thread at LandzDown as I see you've been having some problems with IE. I've written you a batch file to automate the fixing process, but I want to double check it before I post it here, so please bear with me.

Tom

Corrine · Aug 19, 2012

That is great news, Tom! As you saw, we've been struggling with IE.

@dee_can, not only is Tom working with Windows Update issues and System File Checker logs, he is also training in malware removal. Once IE is fixed, we'll deal with any WinPatrol questions you have in the LzD WinPatrol forum.

tom982 · Aug 21, 2012

Hello Dee,

I have finished writing your batch file, here are the instructions on how to use it:

As always, if you aren't sure about what you're doing then just let me know and I'll try and make it easier for you :)

Batch File

Click the Start button

, click All Programs, click Accessories and then click Notepad
Copy (Ctrl+C) all of the text in the following box and paste (Ctrl+V) it into Notepad

WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.

Code:

taskkill /f /im iexplore.exe

if not exist %SYSTEMDRIVE%\tom982 mkdir %SYSTEMDRIVE%\tom982

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /save %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /save %SYSTEMDRIVE%\tom982\admxaclfile

takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml
takeown /f C:\Windows\PolicyDefinitions\inetres.admx

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /grant administrators:F
icacls C:\Windows\PolicyDefinitions\inetres.admx /grant administrators:F

ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak
ren C:\Windows\PolicyDefinitions\inetres.admx *.bak

copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm.resources_31bf3856ad364e35_8.0.6001.18702_en-us_528904d6934778fd\InetRes.adml   C:\Windows\PolicyDefinitions\en-US\InetRes.adml
copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm_31bf3856ad364e35_8.0.6001.18702_none_d17a7cb2ad9eeb9c\inetres.admx  C:\Windows\PolicyDefinitions\inetres.admx

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile

sfc /scannow

copy %SYSTEMROOT%\Logs\CBS\CBS.log %USERPROFILE%\Desktop\CBS.txt

start notepad.exe %USERPROFILE%\Desktop\CBS.txt

Go to File > Save As... and save it to your Desktop named fix.bat. Make sure you change the Save as type to All Files (*.*)
Locate fix.bat on your Desktop and double-click on it

When it finishes, it will open a Notepad window with a lot of text in it, could you copy and paste all of that text into your next post please? Thanks!

Tom

dee_can · Aug 21, 2012

Thanks, Tom. I really appreciate you doing this. I have to say I'm a bit nervous about doing the fix. Not that I doubt your expertise, but I'm just kind of anxious about doing something to my computer. Give me a day to... work up the nerve. ha. I will get back to you. Thanks very much.

Corrine · Aug 21, 2012

You can do it, Dee. (Your username proves it: dee_can!!!) Look how much you did over the past couple of weeks! Just read the instructions carefully, take your time and stop and ask questions if you aren't sure.

tom982 · Aug 21, 2012

It's my pleasure, Dee. Lol, I don't have any expertise to doubt! Well, for now anyway.

I probably should have done this in my last post to save you the hassle, sorry, I still don't know why I didn't. I have made the batch file for you, saved it and attached it to this post. All you need to do is download the file to your Desktop and run it by double-clicking on it. The script will do the rest of the work for you (hopefully!).

You're more than welcome to follow my previous instructions if you want a challenge, both Corrine and I know you're capable of doing it :) But if you aren't confident enough in yourself, then ignore the advice in my previous post - it won't matter if we're going down this route :)

Tom

dee_can · Aug 22, 2012

tom982 said:
The script will do the rest of the work for you (hopefully!).

Hi Tom, It's the hopefully part that worries me to be honest - ha. I'm pretty sure I can follow your instructions, but I'm just concerned about making changes to my computer for fear that something might go wrong, and I won't be able to change it back.

I know, I came to you guys for help. You helped me. And now I'm not sure about what to do. I really apologize. I might change my mind, though. :embarrasment5:

Thanks Tom and Corrine.

writhziden · Aug 22, 2012

The only issue I see is with restoring file permissions. Everything else should work fine for dee_can.

By the way, the .bat file needs to be run as administrator to work. Running it normally just causes CBS.txt to be made and skips the other steps, so we would end up with the same CBS.txt that has already been uploaded. You may want to fix step 4. in this post.

Alright, figured out the restore issue. The lines

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile

should read

icacls C:\Windows\PolicyDefinitions\en-US\ /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\ /restore %SYSTEMDRIVE%\tom982\admxaclfile

since you are restoring to the files in that location. Here is the reference I used: Security Watch

The first page actually has an example where the same thing was done that you did that caused restore to fail. Very helpful resource for icacls commands.

Read More:

C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore C:\tom982\admlaclfile Successfully processed 0 files; Failed processing 1 files

C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore C:\tom982\admxaclfile
Successfully processed 0 files; Failed processing 1 files

It appears it was not able to restore the permissions. I do see this message within the sfc scan; I am not sure if it is the result of the batch file being run or was an issue prior. More testing is needed before I would recommend others run the .bat file:

2012-08-22 06:32:58, Info CSI 000002e1 [SR] Repairing corrupted file [ml:520{260},l:76{38}]"\??\C:\Windows\PolicyDefinitions\en-US"\[l:24{12}]"InetRes.adml" from store
2012-08-22 06:32:58, Info CSI 000002e2 [SR] Repairing corrupted file [ml:520{260},l:64{32}]"\??\C:\Windows\PolicyDefinitions"\[l:24{12}]"inetres.admx" from store

Click to expand...

Resolved by using the correct restore location.

~~Strange coincidence that the files that are corrupted are the same ones the .bat accesses...~~ This was due to restoring from the wrong location. If I use the location given in my CBG.log file, it works fine. SFC comes up clean afterward.

dee_can: If you read this, the location given by Tom is correct for your system. He found that from your CBS.log file.

Full output of the fix.bat:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>cd c:\users\mike\Desktop


c:\Users\Mike\Desktop>fix.bat


c:\Users\Mike\Desktop>taskkill /f /im iexplore.exe
ERROR: The process "iexplore.exe" not found.


c:\Users\Mike\Desktop>if not exist C:\tom982 mkdir C:\tom982


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /sa
ve C:\tom982\admlaclfile
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /save C:\
tom982\admxaclfile
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml




SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\en-US\InetRes.adml"
 now owned by user "DEMO\Mike".


c:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\inetres.admx


SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\inetres.admx" now o
wned by user "DEMO\Mike".


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /gr
ant administrators:F
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /grant ad
ministrators:F
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak




c:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\inetres.admx *.bak


c:\Users\Mike\Desktop>copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm.r
esources_31bf3856ad364e35_8.0.6001.18702_en-us_528904d6934778fd\InetRes.adml   C
:\Windows\PolicyDefinitions\en-US\InetRes.adml
The system cannot find the path specified.


c:\Users\Mike\Desktop>copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm_3
1bf3856ad364e35_8.0.6001.18702_none_d17a7cb2ad9eeb9c\inetres.admx  C:\Windows\Po
licyDefinitions\inetres.admx
The system cannot find the path specified.


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /re
store C:\tom982\admlaclfile
C:\Windows\PolicyDefinitions\en-US\InetRes.adml\InetRes.adml: The system cannot
find the path specified.
Successfully processed 0 files; Failed processing 1 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore
C:\tom982\admxaclfile
C:\Windows\PolicyDefinitions\inetres.admx\inetres.admx: The system cannot find t
he path specified.
Successfully processed 0 files; Failed processing 1 files


c:\Users\Mike\Desktop>sfc /scannow


Beginning system scan.  This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log


c:\Users\Mike\Desktop>copy C:\Windows\Logs\CBS\CBS.log C:\Users\Mike\Desktop\C
BS.txt
        1 file(s) copied.


c:\Users\Mike\Desktop>start notepad.exe C:\Users\Mike\Desktop\CBS.txt


c:\Users\Mike\Desktop>

Output after using the correct restore location for my system:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>cd \users\mike\Desktop


C:\Users\Mike\Desktop>fix.bat


C:\Users\Mike\Desktop>taskkill /f /im iexplore.exe
ERROR: The process "iexplore.exe" not found.


C:\Users\Mike\Desktop>if not exist C:\tom982 mkdir C:\tom982


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /sa
ve C:\tom982\admlaclfile
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /save C:\
tom982\admxaclfile
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml




SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\en-US\InetRes.adml"
 now owned by user "DEMO\Mike".


C:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\inetres.admx


SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\inetres.admx" now o
wned by user "DEMO\Mike".


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /gr
ant administrators:F
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /grant ad
ministrators:F
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak


A duplicate file name exists, or the file
cannot be found.


C:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\inetres.admx *.bak
A duplicate file name exists, or the file
cannot be found.


C:\Users\Mike\Desktop>copy "C:\Windows\WinSxS\amd64_microsoft-windows-inetres-ad
m.resources_31bf3856ad364e35_9.4.8112.16421_en-us_e43c20be501fcb4b\InetRes.adml"
   C:\Windows\PolicyDefinitions\en-US\InetRes.adml
        1 file(s) copied.


C:\Users\Mike\Desktop>copy "C:\Windows\WinSxS\amd64_microsoft-windows-inetres-ad
m_31bf3856ad364e35_9.4.8112.16421_none_632d989a6a773dea\inetres.admx"  C:\Window
s\PolicyDefinitions\inetres.admx
        1 file(s) copied.


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /re
store C:\tom982\admlaclfile
C:\Windows\PolicyDefinitions\en-US\InetRes.adml\InetRes.adml: The system cannot
find the path specified.
Successfully processed 0 files; Failed processing 1 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore
C:\tom982\admxaclfile
C:\Windows\PolicyDefinitions\inetres.admx\inetres.admx: The system cannot find t
he path specified.
Successfully processed 0 files; Failed processing 1 files


C:\Users\Mike\Desktop>sfc /scannow


Beginning system scan.  This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


C:\Users\Mike\Desktop>copy C:\Windows\Logs\CBS\CBS.log C:\Users\Mike\Desktop\C
BS.txt
        1 file(s) copied.


C:\Users\Mike\Desktop>start notepad.exe C:\Users\Mike\Desktop\CBS.txt


C:\Users\Mike\Desktop>

Full CBS.txt: View attachment CBS.zip

tom982 · Aug 22, 2012

writhziden said:

The only issue I see is with restoring file permissions. Everything else should work fine for dee_can.

By the way, the .bat file needs to be run as administrator to work. Running it normally just causes CBS.txt to be made and skips the other steps, so we would end up with the same CBS.txt that has already been uploaded. You may want to fix step 4. in this post.

Alright, figured out the restore issue. The lines

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile

should read

icacls C:\Windows\PolicyDefinitions\en-US\ /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\ /restore %SYSTEMDRIVE%\tom982\admxaclfile

since you are restoring to the files in that location. Here is the reference I used: Security Watch

The first page actually has an example where the same thing was done that you did that caused restore to fail. Very helpful resource for icacls commands.

Read More:

C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore C:\tom982\admlaclfile Successfully processed 0 files; Failed processing 1 files

C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore C:\tom982\admxaclfile
Successfully processed 0 files; Failed processing 1 files

It appears it was not able to restore the permissions. I do see this message within the sfc scan; I am not sure if it is the result of the batch file being run or was an issue prior. More testing is needed before I would recommend others run the .bat file:

2012-08-22 06:32:58, Info CSI 000002e1 [SR] Repairing corrupted file [ml:520{260},l:76{38}]"\??\C:\Windows\PolicyDefinitions\en-US"\[l:24{12}]"InetRes.adml" from store
2012-08-22 06:32:58, Info CSI 000002e2 [SR] Repairing corrupted file [ml:520{260},l:64{32}]"\??\C:\Windows\PolicyDefinitions"\[l:24{12}]"inetres.admx" from store

Click to expand...

Resolved by using the correct restore location.

~~Strange coincidence that the files that are corrupted are the same ones the .bat accesses...~~ This was due to restoring from the wrong location. If I use the location given in my CBG.log file, it works fine. SFC comes up clean afterward.

dee_can: If you read this, the location given by Tom is correct for your system. He found that from your CBS.log file.

Full output of the fix.bat:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>cd c:\users\mike\Desktop


c:\Users\Mike\Desktop>fix.bat


c:\Users\Mike\Desktop>taskkill /f /im iexplore.exe
ERROR: The process "iexplore.exe" not found.


c:\Users\Mike\Desktop>if not exist C:\tom982 mkdir C:\tom982


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /sa
ve C:\tom982\admlaclfile
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /save C:\
tom982\admxaclfile
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml




SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\en-US\InetRes.adml"
 now owned by user "DEMO\Mike".


c:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\inetres.admx


SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\inetres.admx" now o
wned by user "DEMO\Mike".


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /gr
ant administrators:F
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /grant ad
ministrators:F
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


c:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak




c:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\inetres.admx *.bak


c:\Users\Mike\Desktop>copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm.r
esources_31bf3856ad364e35_8.0.6001.18702_en-us_528904d6934778fd\InetRes.adml   C
:\Windows\PolicyDefinitions\en-US\InetRes.adml
The system cannot find the path specified.


c:\Users\Mike\Desktop>copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm_3
1bf3856ad364e35_8.0.6001.18702_none_d17a7cb2ad9eeb9c\inetres.admx  C:\Windows\Po
licyDefinitions\inetres.admx
The system cannot find the path specified.


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /re
store C:\tom982\admlaclfile
C:\Windows\PolicyDefinitions\en-US\InetRes.adml\InetRes.adml: The system cannot
find the path specified.
Successfully processed 0 files; Failed processing 1 files


c:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore
C:\tom982\admxaclfile
C:\Windows\PolicyDefinitions\inetres.admx\inetres.admx: The system cannot find t
he path specified.
Successfully processed 0 files; Failed processing 1 files


c:\Users\Mike\Desktop>sfc /scannow


Beginning system scan.  This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log


c:\Users\Mike\Desktop>copy C:\Windows\Logs\CBS\CBS.log C:\Users\Mike\Desktop\C
BS.txt
        1 file(s) copied.


c:\Users\Mike\Desktop>start notepad.exe C:\Users\Mike\Desktop\CBS.txt


c:\Users\Mike\Desktop>

Output after using the correct restore location for my system:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Windows\system32>cd \users\mike\Desktop


C:\Users\Mike\Desktop>fix.bat


C:\Users\Mike\Desktop>taskkill /f /im iexplore.exe
ERROR: The process "iexplore.exe" not found.


C:\Users\Mike\Desktop>if not exist C:\tom982 mkdir C:\tom982


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /sa
ve C:\tom982\admlaclfile
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /save C:\
tom982\admxaclfile
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml




SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\en-US\InetRes.adml"
 now owned by user "DEMO\Mike".


C:\Users\Mike\Desktop>takeown /f C:\Windows\PolicyDefinitions\inetres.admx


SUCCESS: The file (or folder): "C:\Windows\PolicyDefinitions\inetres.admx" now o
wned by user "DEMO\Mike".


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /gr
ant administrators:F
processed file: C:\Windows\PolicyDefinitions\en-US\InetRes.adml
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /grant ad
ministrators:F
processed file: C:\Windows\PolicyDefinitions\inetres.admx
Successfully processed 1 files; Failed processing 0 files


C:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak


A duplicate file name exists, or the file
cannot be found.


C:\Users\Mike\Desktop>ren C:\Windows\PolicyDefinitions\inetres.admx *.bak
A duplicate file name exists, or the file
cannot be found.


C:\Users\Mike\Desktop>copy "C:\Windows\WinSxS\amd64_microsoft-windows-inetres-ad
m.resources_31bf3856ad364e35_9.4.8112.16421_en-us_e43c20be501fcb4b\InetRes.adml"
   C:\Windows\PolicyDefinitions\en-US\InetRes.adml
        1 file(s) copied.


C:\Users\Mike\Desktop>copy "C:\Windows\WinSxS\amd64_microsoft-windows-inetres-ad
m_31bf3856ad364e35_9.4.8112.16421_none_632d989a6a773dea\inetres.admx"  C:\Window
s\PolicyDefinitions\inetres.admx
        1 file(s) copied.


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /re
store C:\tom982\admlaclfile
C:\Windows\PolicyDefinitions\en-US\InetRes.adml\InetRes.adml: The system cannot
find the path specified.
Successfully processed 0 files; Failed processing 1 files


C:\Users\Mike\Desktop>icacls C:\Windows\PolicyDefinitions\inetres.admx /restore
C:\tom982\admxaclfile
C:\Windows\PolicyDefinitions\inetres.admx\inetres.admx: The system cannot find t
he path specified.
Successfully processed 0 files; Failed processing 1 files


C:\Users\Mike\Desktop>sfc /scannow


Beginning system scan.  This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


C:\Users\Mike\Desktop>copy C:\Windows\Logs\CBS\CBS.log C:\Users\Mike\Desktop\C
BS.txt
        1 file(s) copied.


C:\Users\Mike\Desktop>start notepad.exe C:\Users\Mike\Desktop\CBS.txt


C:\Users\Mike\Desktop>

Full CBS.txt: View attachment 1515

Thanks for the tips Mike :) I really appreciate you taking the time to diagnose this for me! Fortunately the mistakes that I made wouldn't have caused any problems, it just would've given me some extra work. Just for future reference, I'm more than happy for anyone to edit my posts if they spot an error like you did here :)

No worries Dee, it's your choice and I'm happy with whatever you choose :) If you do, however, change your mind, use the attached batch file. Download it to your Desktop then right-click on it and select Run as administrator.

WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.

Tom

Corrine · Aug 22, 2012

Dee, the batch file that Tom created for you (and reviewed/approved by niemiro, the person I mentioned at LandzDown) is nowhere as complex as the scans and changes I had you make during the malware removal process.

niemiro · Aug 23, 2012

Hello dee_can :)

You have done really well so far. As Corrine has said, I have approved tom982's script. I personally have performed operations like this hundreds of times before without problem, and as they go, this is one of the safer repair operations. You are in really safe hands with tom982, and the script he has provided is good. Please take a deep breath, and give it a go :)

I wish you the very best of luck,

Richard

dee_can · Aug 24, 2012

Thank you - Mike, Tom, Corrine, and Richard. I truly appreciate all of your help... and reassurance. I didn't have any computer time yesterday, and won't have any until later on today. I've decided since all of you say it's ok, then it must be. lol So I will do it later on today. Just to clarify, which script am I supposed to use - this one?

(WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.)

Attached Files

fix.bat (1.3 KB, 0 views)

Corrine · Aug 24, 2012

Yes. Right-click that file and select the option to Run as Administrator.

dee_can · Aug 24, 2012

Corrine said:
Yes. Right-click that file and select the option to Run as Administrator.

Thanks, Corrine. I'm going to try it now.

[SOLVED] CBS Logs corrupt file(s) issue

Contributor

Attachments

Administrator, Microsoft MVP, Security Analyst

Emeritus

Administrator, Microsoft MVP, Security Analyst

Contributor

Contributor

Attachments

Emeritus

Administrator, Microsoft MVP, Security Analyst

Emeritus

Contributor

Administrator, Microsoft MVP, Security Analyst

Emeritus

Attachments

Contributor

Administrator, .NET/UWP Developer

Emeritus

Attachments

Administrator, Microsoft MVP, Security Analyst

Senior Administrator, Windows Update Expert

Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst