[SOLVED] CBS Logs corrupt file(s) issue

D

dee_can

Contributor
Joined
Aug 19, 2012
Posts
159
Location
Canada
Hi, I was referred to this forum by Corrine from the Landszdown forum. Corrine has been helping me with some spyware and other issues on my computer. I believe I have the spyware/trojans issues straightened out, but after running a scannow on my computer I have some persistent CBS log errors/corrupt files that don't seem to be repaired and she thought I should have them looked at.

I'm attaching the zipped files for review of my logs. Please let me know if there is any problem with the files I've attached. Thank you.
 

Attachments

Welcome to Sysnative! Good job collecting the files. While you're waiting for a response, feel free to look around. It is quite a different setup here than at LandzDown.
 
Hello dee_can and welcome to Sysnative :)

Unfortunately the files that you have uploaded aren't what we need to resolve your problem, so let's try and get the right files first.

Export CBS.log


  1. Click the Start button
    StartButton_16x16.gif
    then click Computer
  2. Double click on the C: drive, under the Hard Disk Drives category, and then scroll down to, and double click on the Windows folder
  3. Find and double click on the Logs folder, and then inside that folder, the CBS folder
  4. Right-click on the CBS.log file, and select Copy. It may show as just CBS (without the .log extension). Do not be concerned, and proceed to copy the file.
  5. Go back to your Desktop, right-click on it, and select Paste. You should now see a file on your Desktop called CBS(.log)
  6. Right-click on this file again, and navigate through Send to, and select Compressed (zipped) folder
  7. Another new file, also called CBS, but this time with a different icon, will be created. Please uplaod this new file to the forum, here


Thanks to Richard for the instructions!

Tom
 
Last edited:
Dee, before you do the above, you should probably delete the other CBS zip files so you don't get confused.
 
I was afraid I wouldn't send the right ones. I'll follow your instructions, Tom. Thanks. And thank you Corrine for the advice, I'll delete the other ones first.
 
Hi Dee,

Great job! That's perfect :)

I've just had a look at your CBS log and there are two repeat offenders:

C:\Windows\PolicyDefinitions\en-US\InetRes.adml
C:\Windows\PolicyDefinitions\inetres.admx
Click to expand...

These files define the policies in Internet Explorer. This doesn't come as much of a surprise after reading your thread at LandzDown as I see you've been having some problems with IE. I've written you a batch file to automate the fixing process, but I want to double check it before I post it here, so please bear with me.

Tom
 
That is great news, Tom! As you saw, we've been struggling with IE.

@dee_can, not only is Tom working with Windows Update issues and System File Checker logs, he is also training in malware removal. Once IE is fixed, we'll deal with any WinPatrol questions you have in the LzD WinPatrol forum.
 
Hello Dee,

I have finished writing your batch file, here are the instructions on how to use it:

As always, if you aren't sure about what you're doing then just let me know and I'll try and make it easier for you :)

Batch File


  1. Click the Start button
    StartButton_16x16.gif
    , click All Programs, click Accessories and then click Notepad
  2. Copy (Ctrl+C) all of the text in the following box and paste (Ctrl+V) it into Notepad

WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.
Code: 
taskkill /f /im iexplore.exe

if not exist %SYSTEMDRIVE%\tom982 mkdir %SYSTEMDRIVE%\tom982

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /save %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /save %SYSTEMDRIVE%\tom982\admxaclfile

takeown /f C:\Windows\PolicyDefinitions\en-US\InetRes.adml
takeown /f C:\Windows\PolicyDefinitions\inetres.admx

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /grant administrators:F
icacls C:\Windows\PolicyDefinitions\inetres.admx /grant administrators:F

ren C:\Windows\PolicyDefinitions\en-US\InetRes.adml *.bak
ren C:\Windows\PolicyDefinitions\inetres.admx *.bak

copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm.resources_31bf3856ad364e35_8.0.6001.18702_en-us_528904d6934778fd\InetRes.adml   C:\Windows\PolicyDefinitions\en-US\InetRes.adml
copy C:\Windows\WinSxS\x86_microsoft-windows-inetres-adm_31bf3856ad364e35_8.0.6001.18702_none_d17a7cb2ad9eeb9c\inetres.admx  C:\Windows\PolicyDefinitions\inetres.admx

icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile

sfc /scannow

copy %SYSTEMROOT%\Logs\CBS\CBS.log %USERPROFILE%\Desktop\CBS.txt

start notepad.exe %USERPROFILE%\Desktop\CBS.txt

  1. Go to File > Save As... and save it to your Desktop named fix.bat. Make sure you change the Save as type to All Files (*.*)
  2. Locate fix.bat on your Desktop and double-click on it


When it finishes, it will open a Notepad window with a lot of text in it, could you copy and paste all of that text into your next post please? Thanks!

Tom
 
Last edited by a moderator:
Thanks, Tom. I really appreciate you doing this. I have to say I'm a bit nervous about doing the fix. Not that I doubt your expertise, but I'm just kind of anxious about doing something to my computer. Give me a day to... work up the nerve. ha. I will get back to you. Thanks very much.
 
You can do it, Dee. (Your username proves it: dee_can!!!) Look how much you did over the past couple of weeks! Just read the instructions carefully, take your time and stop and ask questions if you aren't sure.
 
It's my pleasure, Dee. Lol, I don't have any expertise to doubt! Well, for now anyway.

I probably should have done this in my last post to save you the hassle, sorry, I still don't know why I didn't. I have made the batch file for you, saved it and attached it to this post. All you need to do is download the file to your Desktop and run it by double-clicking on it. The script will do the rest of the work for you (hopefully!).

You're more than welcome to follow my previous instructions if you want a challenge, both Corrine and I know you're capable of doing it :) But if you aren't confident enough in yourself, then ignore the advice in my previous post - it won't matter if we're going down this route :)

Tom
 

Attachments

tom982 said:
The script will do the rest of the work for you (hopefully!).
Click to expand...

Hi Tom, It's the hopefully part that worries me to be honest - ha. I'm pretty sure I can follow your instructions, but I'm just concerned about making changes to my computer for fear that something might go wrong, and I won't be able to change it back.

I know, I came to you guys for help. You helped me. And now I'm not sure about what to do. I really apologize. I might change my mind, though. :embarrasment5:

Thanks Tom and Corrine.
 
The only issue I see is with restoring file permissions. Everything else should work fine for dee_can.

By the way, the .bat file needs to be run as administrator to work. Running it normally just causes CBS.txt to be made and skips the other steps, so we would end up with the same CBS.txt that has already been uploaded. You may want to fix step 4. in this post.

Alright, figured out the restore issue. The lines
icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile
Click to expand...
should read
icacls C:\Windows\PolicyDefinitions\en-US\ /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\ /restore %SYSTEMDRIVE%\tom982\admxaclfile
Click to expand...
since you are restoring to the files in that location. Here is the reference I used: Security Watch

The first page actually has an example where the same thing was done that you did that caused restore to fail. Very helpful resource for icacls commands.

Read More:
 
Last edited:
writhziden said:
The only issue I see is with restoring file permissions. Everything else should work fine for dee_can.

By the way, the .bat file needs to be run as administrator to work. Running it normally just causes CBS.txt to be made and skips the other steps, so we would end up with the same CBS.txt that has already been uploaded. You may want to fix step 4. in this post.

Alright, figured out the restore issue. The lines
icacls C:\Windows\PolicyDefinitions\en-US\InetRes.adml /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\inetres.admx /restore %SYSTEMDRIVE%\tom982\admxaclfile
Click to expand...
should read
icacls C:\Windows\PolicyDefinitions\en-US\ /restore %SYSTEMDRIVE%\tom982\admlaclfile
icacls C:\Windows\PolicyDefinitions\ /restore %SYSTEMDRIVE%\tom982\admxaclfile
Click to expand...
since you are restoring to the files in that location. Here is the reference I used: Security Watch

The first page actually has an example where the same thing was done that you did that caused restore to fail. Very helpful resource for icacls commands.

Read More:
Click to expand...


Thanks for the tips Mike :) I really appreciate you taking the time to diagnose this for me! Fortunately the mistakes that I made wouldn't have caused any problems, it just would've given me some extra work. Just for future reference, I'm more than happy for anyone to edit my posts if they spot an error like you did here :)

No worries Dee, it's your choice and I'm happy with whatever you choose :) If you do, however, change your mind, use the attached batch file. Download it to your Desktop then right-click on it and select Run as administrator.

WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.

Tom
 

Attachments

Last edited by a moderator:
Dee, the batch file that Tom created for you (and reviewed/approved by niemiro, the person I mentioned at LandzDown) is nowhere as complex as the scans and changes I had you make during the malware removal process.
 
Hello dee_can :)

You have done really well so far. As Corrine has said, I have approved tom982's script. I personally have performed operations like this hundreds of times before without problem, and as they go, this is one of the safer repair operations. You are in really safe hands with tom982, and the script he has provided is good. Please take a deep breath, and give it a go :)

I wish you the very best of luck,

Richard
 
Thank you - Mike, Tom, Corrine, and Richard. I truly appreciate all of your help... and reassurance. I didn't have any computer time yesterday, and won't have any until later on today. I've decided since all of you say it's ok, then it must be. lol So I will do it later on today. Just to clarify, which script am I supposed to use - this one?

(WARNING: This fix has been created specifically for this poster's computer. If you are not this poster, do not use this fix, as you could cause serious harm to your computer.)

paperclip.png
Attached Files
 
Last edited by a moderator:
Yes. Right-click that file and select the option to Run as Administrator.
 
You must log in or register to reply here.
Back
Top