Corrupt File C:\Windows\Logs\CBS\CBS.log ( any fixes)? Win7 64 bit

[jjr]

Hi
Running win7 64bit, just ran the sfc /scannow and came up with this:

Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

Anyone have any ideas how to deal with this w/o reinstalling the OS?

TIA

Update I deleted the files below the CBS and re-ran the sfc .scannow and got the saem message. Would it be of to actually delete the CBS file?

See here:

 

[jjr]

Found out that the above are just logs which I can delete ( I hope) What worries myself is this and if its bad how can I fix?



(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-06 10:37

==================== End of FRST.txt ============================

 

[Megahertz07]

Please edit your profile and add ALL your hardware specs.

All files on your post #2 are very important system files.
Back up your data on an external drive
My suggestion:
Option 1 - Do a clean install. It will clean all your disk and install windows.
I know, it takes a day as you have to reinstall Windows (and the updates) and all programs. But is best solution as the name says, it is CLEAN install. Clean Install Windows 7 - Windows 7 Help Forums
Option 2 - Do a repair install. It will reinstall Windows, keeping all programs and data. It also keeps all trash (files and on register) but you only have to install the updates. Repair Install - Windows 7 Help Forums

For the updates MS releases SP2 for Windows 7 - Windows 7 Help Forums

 

[jjr]

I was really afraid of hearing that!

Will try to do a repair first

Thanks

Please edit your profile and add ALL your hardware specs.

All files on your post #2 are very important system files.
Back up your data on an external drive
My suggestion:
Option 1 - Do a clean install. It will clean all your disk and install windows.
I know, it takes a day as you have to reinstall Windows (and the updates) and all programs. But is best solution as the name says, it is CLEAN install. Clean Install Windows 7 - Windows 7 Help Forums
Option 2 - Do a repair install. It will reinstall Windows, keeping all programs and data. It also keeps all trash (files and on register) but you only have to install the updates. Repair Install - Windows 7 Help Forums

For the updates MS releases SP2 for Windows 7 - Windows 7 Help Forums

 

[torchwood]

Hi JJR,

Read in conjuction with your other thread - Access denied.

I dont know what you did when you played around with the CBS folder
i can see that youve reformatted them to ZIP files, not deleted them
NOT a good idea and as part of that i suspect you changed the access rights as well.
Screenshot of CBS> properties> Security... showing your Adminstrator and User rghts are
would be handy.

please run KB947821
post its log, it will be in the CBS folder

Roy

 

[jjr]

When I originally went in they log was notepad were Cbs persistwere rar files and would not open, only way to open was zip that did work and I was able to delete those what you see are newer cbs logs. I cant not do anything at this point ad now Im having admin issues and that is causing something to pop up in my Zone Alarm.

Part of my original problem was with Zone Alarm I was on with support and asked them if I was running the current version, the tech replied no and he did a remote to update it. At that point it would not update (went around %50 and then a message popped up saying internet connection issue) the connection was fine.

The next issue when installing it would show installed and restarted and then went back to the previous version and then finally would not work at all and I had no anti virus. I did have a acronis back up from a week earlier I I just installed that Image which had the previous version of ZA running on that. I tried to update that and it went back to yet another earlier version. ZA has esclated my case and is working on it and is supposed to get back who knows when.

Im away from that PC for the weeked but just took a look at the pc here at my GF and the CBS logs show as notepad and the Cbs persist are rar files. I get the access denied if I try to open the log.

Now that I think of it the pc with the issues I could not originally open the log file w/ notepad as the file was huge and would not let me, I chose to open with word. At some point it was a zip I did not choose that.

I ran the farbar here and it looks like this pc has the same digital signatures as the other one but I would have to copy to bring home and compare.


I fear that I fresh OS install will be in my future but I would like to hear back from ZA before I go down that road. Also the Zone Alarm did update just fine on the pc, there both running Win7 64 bit home premium.

On both of these PC's Iam the only user and and the admin, the UAC is set to default on both pc's



=================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-08-31 00:21

Hi JJR,

Read in conjuction with your other thread - Access denied.

I dont know what you did when you played around with the CBS folder
i can see that youve reformatted them to ZIP files, not deleted them
NOT a good idea and as part of that i suspect you changed the access rights as well.
Screenshot of CBS> properties> Security... showing your Adminstrator and User rghts are
would be handy.

please run KB947821
post its log, it will be in the CBS folder

Roy

 

[torchwood]

Hi JJR,

your CBS folder extentions should look like this, see screenshot.

CERTAINLY NOT .Zip or .Rar, extentions they can only be created by a user or possibly malware, but highly unlikely.
Zip files are created with either 7Zip or W7's inbuilt program, Winrar is a USER program
(Im basically saying YOU have changed them, ZoneAlarm doesn't touch them either)

There is no need to open the cabinet files, ONLY the top TEXT file for problem solving.
The text file automatically opens via notepad,
cabinet files -RIGHT click >>send to >>Compressed file - a copied .Zip file is then created directly below
using either 7Zip, W7's own version or Winrar.
These were created an then you deleted the cabinet files

AV's can and do cause certain problems, they do not change permissions in fact they ADD them.

AS i said .zip and rar extentions are user modifications, BOTH computers have been changed.

If i was you, BOTH computers
Remove ZoneAlarm - temporarily, MSE should kick in
RUN a repair install, you need a W7 SP1 disc- NO loss of user data.

IF you do not have a disc
then
run from an elevated command mode
sfc /scannow
then run KB947821
REBOOT
run an online scan using ESET
download Tweaking.com -- reset permissions
Reset Registry Permissions
REBOOT

Re-install ZoneAlarm..

Just for my curiousity could you copy/paste the 2 complete Farbar(FRST) logs.
C >> FRST >> logs

Roy

 

[jjr]

I remember th original top text file was way to large to open with notepad, yes I really believe that the home pc was infected with malware and may still be as that could be one of the problems with zone alarm no being able to update?

MSE should kick in? Please explain?
run an online scan using ESET ? Please explain?

Thanks will get back at it when Im home next week and many thanks . I still think a new reinstallation of the OS would be the best at this point.

 

[torchwood]

Hi JJR,

MSE should kick in - W7 doesnt like being unprotected if you remove an AV it re-activates Defender so you have some protection.

Eset on line - in your browser type Eset on line it will perform a live scan


Roy

 

[jjr]

Just go in and what I did to start was uninstall winzip and all came back to normal. Will run farbar next.
Also what kind of files are those CBS logs? Perhaps if I reinstall winzip or winrar I could check off not to have those programe open that type of file?

 

[torchwood]

Hi JJR,

That looks better,
post the cbs log, and SURT KB947821 log, it will appear in that folder.
Screenshots and Files - Upload and Post in Seven Forums - Windows 7 Help Forums

Roy

 

[jjr]

Was able to have MLB support take a look at this and they did some checking and determined that it was a false positive. ON top of that they did find some malware and that was removed so back to being a happy camper.