Windows Backup Issue...

whs said:

This log is too long to analyse. Reduce the amount of data with this command:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

Hello!

This is not necessary. For one thing, you or I could do it on our own computers, and if you were to, very quickly you would become bored, and then start reading the whole CBS.log. I would strongly recommend!

Since this seems to be a red-hot issue, would people like me to write an informal tutorial about how to quickly analyse the SFC section of a whole CBS.log. I could give details about every possible message SFC gives which I know about (which is most of them), how to quickly find the correct section in a CBS.log, and just how much data is lost when the log is parsed.

Richard

Now have a look at this OP's SFC log:

Code:

 
2011-07-11 22:48:11, Info                  CSI    000002d8 [SR] Verify complete
2011-07-11 22:48:11, Info                  CSI    000002d9 [SR] Repairing 1 components
2011-07-11 22:48:11, Info                  CSI    000002da [SR] Beginning Verify and Repair transaction
2011-07-11 22:48:11, Info                  CSI    000002db Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002dc [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002dd Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002de [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002df [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2011-07-11 22:48:11, Info                  CSI    000002e0 Hashes for file member \??\C:\Windows\System32\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002e1 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002e2 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted
2011-07-11 22:48:11, Info                  CSI    000002e3 Repair results created:

Open the CBS.log now. Yes, actually do it! Scroll to the bottom, the very bottom, find the above snippet, and tell me which file is corrupt. Is this method workable? Like it (or not)?

Here is what it would be like, parsed:

Code:

2011-07-11 22:48:11, Info                  CSI    000002d8 [SR] Verify complete
2011-07-11 22:48:11, Info                  CSI    000002d9 [SR] Repairing 1 components
2011-07-11 22:48:11, Info                  CSI    000002da [SR] Beginning Verify and Repair transaction
2011-07-11 22:48:11, Info                  CSI    000002dc [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002de [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002df [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2011-07-11 22:48:11, Info                  CSI    000002e2 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted

Yes, there is some extra data which you don't need. All I can say would be to ignore or use it!

whs said:

SlasherIT said:

@whs - Have you scanned the logs...? Soz for the bother...

Yes I have. And what I read at the very end is:

All files and registry keys listed in this transaction have been successfully repaired

That doesn't actually mean that all corruptions have been fixed, just that all corruptions have had a fix attempted.

"Cannot repair member file" and "Could not reproject corrupted file" apply to the file given, and mean that the file has not been fixed!

A recurring "Repairing corrupted file x from store" means that SFC cannot fix the file because it is in use.

@SlasherIT:

OTL - Download or alternative link here and here

Please Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in

/md5start
termsrv.dll
/md5stop

• Click the None button, followed by Run Scan button. The scan wont take long.
• When the scan completes, it will open one notepad window. OTL.Txt. This is saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post it here.

Thanks a lot!

Richard