SFC and CBS errors

LGG · May 10, 2013

I kept getting an error message after my PC would freeze. I ran two different anti-virus programs and they came back fine. I figured out how to run the SFC program and how to view the resulting CBS log, but I don't know what the error messages mean. I get that SFC can't fix the problem, but I'm having trouble finding out exactly what the problem is and how to fix it manually. I'm running Vista 32-bit. I attached the report with the errors from when I ran it today. Any help would be greatly appreciated!

NoelDP · May 11, 2013

Here's the condensed results of the SFC

Code:

 Line 591: 2013-05-10 10:41:46, Info                  CSI    0000021a [SR] Repairing 3 components
 Line 592: 2013-05-10 10:41:46, Info                  CSI    0000021b [SR] Beginning Verify and Repair transaction
 Line 595: 2013-05-10 10:41:46, Info                  CSI    0000021d [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 598: 2013-05-10 10:41:46, Info                  CSI    0000021f [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
 Line 601: 2013-05-10 10:41:46, Info                  CSI    00000221 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
 Line 610: 2013-05-10 10:41:46, Info                  CSI    00000225 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 611: 2013-05-10 10:41:46, Info                  CSI    00000226 [SR] This component was referenced by [l:158{79}]"Package_16_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.948465-49_neutral_GDR"
 Line 614: 2013-05-10 10:41:46, Info                  CSI    00000228 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
 Line 617: 2013-05-10 10:41:46, Info                  CSI    0000022a [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
 Line 641: 2013-05-10 10:41:47, Info                  CSI    0000022e [SR] Repair complete

I have seen similar problems before in Vista - and they were extremely difficult to pin down - even when apparently fixed, they'd crop up again as soon as another SFC was run.

Please open Event Viewer

In the left pane, navigate to the Windows Logs

right-click on Applications and select 'Save all events as...' save as Apps.evtx

repeat for the System logs - save as Sys.evtx

Compress both files, and attach to your reply.

niemiro · May 11, 2013

In my personal opinion (and all three of these corruptions do sadly come down to opinion rather than hard fact), none of these actually need fixing. settings.ini corruption is simply because the factory modified some sidebar setting prior to creating the install disk. Perhaps they added a gadget, disabled it, something like that. It isn't a problem. See here: The SFC.exe command reports Settings.ini file errors in the CBS.log file after you add gadgets to the Windows Vista Sidebar by using the Sysprep tool and an Autounattend.xml file

With the other two, despite the failure reports, stem from a bug ~3-4 patch Tuesdays ago. We know that this bug only affects SFC detection, and that the files themselves are not corrupt. We also know that an ideal fix for this is extremely difficult for us to create and must really come in the form of a re-release from Microsoft. Sadly, this hasn't happened.

However, my take on the issue is that these files aren't corrupt, we can't fix it, therefore ignoring it, which is perfectly safe, is the best course of action.

Richard

Digerati · May 11, 2013

I guess the question is, does your computer freeze up often? When did the problem start? Can you reboot after, boot normally and use your computer?

NoelDP · May 11, 2013

The Event Logs will still be useful in diagnosis :)

niemiro · May 11, 2013

NoelDP said:
The Event Logs will still be useful in diagnosis :)

That is a very good point actually, I am very sorry, I wasn't trying to step on your toes in this way :)

Richard

NoelDP · May 11, 2013

No problem, Richard - I was hoping you'd come in on the thread, as I had a marathon thread elsewhere on this subject :)

LGG · May 13, 2013

NoelDP said:
I have seen similar problems before in Vista - and they were extremely difficult to pin down - even when apparently fixed, they'd crop up again as soon as another SFC was run.

Please open Event Viewer

In the left pane, navigate to the Windows Logs

right-click on Applications and select 'Save all events as...' save as Apps.evtx

repeat for the System logs - save as Sys.evtx

Compress both files, and attach to your reply.

Thanks for the instructions, Noel. Here's the Apps file, but it wouldn't let me do the same for the System logs. I kept getting the following error: "Event Viewer cannot open the event log or custom view. Verify that Event log service is running. The data is invalid (13)." I got this error immediately after doing the Apps file, so I didn't change anything that would cause the error.

As far as freezing, I can't tell you what started it, or what I'm doing when it happens. I'm not doing anything different than I have always done on this computer. I could be checking my email like I do many times/day, and suddenly it freezes. And not because I opened a virus, I know better than that, and I prefer to delete and miss out on something rather than risk a virus. If I let it sit for several minutes, I would get the popup message about security options failure, and then it would go back to normal. Interestingly, it hasn't happened since I ran the first SFC, but if something is still wrong, I want to try to fix it before it causes a bigger problem. Thanks for the help!

NoelDP · May 14, 2013

Sounds like the evtx file may be corrupted.
Please open an Elevated Command Prompt, and run the following command...

REN C:\Windows\System32\winevt\logs\System.evtx oldsystem.evtx

Asssuming that runs OK, reboot, and then try opening the log and exporting/compressing/posting it again.

LGG · May 18, 2013

Hi Noel,

That command is not working. I get the error: "The process cannot access the file because it is being used by another process." I tried rebooting and got the same error. However, I still have not seen the security failure error since I ran the SFC. Maybe the issue has resolved itself?

NoelDP · May 18, 2013

OK - boot to Safe Mode with Command Prompt, and try the same command there.

Can you now open the System Event log?

Search

Search

SFC and CBS errors

LGG

New member

Attachments

NoelDP

Windows Update Analyst, Contributor

niemiro

Senior Administrator, Windows Update Expert

Digerati

Moderator
Hardware Expert
Microsoft MVP (Ret.)

NoelDP

Windows Update Analyst, Contributor

niemiro

Senior Administrator, Windows Update Expert

NoelDP

Windows Update Analyst, Contributor

LGG

New member

Attachments

NoelDP

Windows Update Analyst, Contributor

LGG

New member

NoelDP

Windows Update Analyst, Contributor

SFC and CBS errors

New member

Attachments

Windows Update Analyst, Contributor

Senior Administrator, Windows Update Expert

ModeratorHardware ExpertMicrosoft MVP (Ret.)

Windows Update Analyst, Contributor

Senior Administrator, Windows Update Expert

Windows Update Analyst, Contributor

New member

Attachments

Windows Update Analyst, Contributor

New member

Windows Update Analyst, Contributor

Moderator
Hardware Expert
Microsoft MVP (Ret.)