Windows Backup Issue...

[niemiro]

This log is too long to analyse. Reduce the amount of data with this command:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

Hello!

This is not necessary. For one thing, you or I could do it on our own computers, and if you were to, very quickly you would become bored, and then start reading the whole CBS.log. I would strongly recommend!

Since this seems to be a red-hot issue, would people like me to write an informal tutorial about how to quickly analyse the SFC section of a whole CBS.log. I could give details about every possible message SFC gives which I know about (which is most of them), how to quickly find the correct section in a CBS.log, and just how much data is lost when the log is parsed.

Richard

 

[niemiro]

Now have a look at this OP's SFC log:

2011-07-11 22:48:11, Info                  CSI    000002d8 [SR] Verify complete
2011-07-11 22:48:11, Info                  CSI    000002d9 [SR] Repairing 1 components
2011-07-11 22:48:11, Info                  CSI    000002da [SR] Beginning Verify and Repair transaction
2011-07-11 22:48:11, Info                  CSI    000002db Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002dc [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002dd Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002de [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002df [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2011-07-11 22:48:11, Info                  CSI    000002e0 Hashes for file member \??\C:\Windows\System32\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002e1 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2011-07-11 22:48:11, Info                  CSI    000002e2 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted
2011-07-11 22:48:11, Info                  CSI    000002e3 Repair results created:

Open the CBS.log now. Yes, actually do it! Scroll to the bottom, the very bottom, find the above snippet, and tell me which file is corrupt. Is this method workable? Like it (or not)?

Here is what it would be like, parsed:

2011-07-11 22:48:11, Info                  CSI    000002d8 [SR] Verify complete
2011-07-11 22:48:11, Info                  CSI    000002d9 [SR] Repairing 1 components
2011-07-11 22:48:11, Info                  CSI    000002da [SR] Beginning Verify and Repair transaction
2011-07-11 22:48:11, Info                  CSI    000002dc [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002de [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-07-11 22:48:11, Info                  CSI    000002df [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2011-07-11 22:48:11, Info                  CSI    000002e2 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted

Yes, there is some extra data which you don't need. All I can say would be to ignore or use it!

 

[whs]

This log is too long to analyse. Reduce the amount of data with this command:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log

Hello!

This is not necessary. For one thing, you or I could do it on our own computers, and if you were to, very quickly you would become bored, and then start reading the whole CBS.log. I would strongly recommend!

Since this seems to be a red-hot issue, would people like me to write an informal tutorial about how to quickly analyse the SFC section of a whole CBS.log. I could give details about every possible message SFC gives which I know about (which is most of them), how to quickly find the correct section in a CBS.log, and just how much data is lost when the log is parsed.

Richard

That would be an excellent idea. Thanks for offering it. And mke it a real tutorial in the tut section, else it gets easily lost.

 

[SlasherIT]

Hi,

Ok great, but I'm kind of lost in what I'm supposed to do...

 

[SlasherIT]

Sigh... Anyone?

 

[SlasherIT]

@whs - Have you scanned the logs...? Soz for the bother...

 

[whs]

@whs - Have you scanned the logs...? Soz for the bother...

Yes I have. And what I read at the very end is:

All files and registry keys listed in this transaction have been successfully repaired

 

[niemiro]

@whs - Have you scanned the logs...? Soz for the bother...

Yes I have. And what I read at the very end is:

All files and registry keys listed in this transaction have been successfully repaired

That doesn't actually mean that all corruptions have been fixed, just that all corruptions have had a fix attempted.

"Cannot repair member file" and "Could not reproject corrupted file" apply to the file given, and mean that the file has not been fixed!

A recurring "Repairing corrupted file x from store" means that SFC cannot fix the file because it is in use.

@SlasherIT:

OTL - Download or alternative link here and here

Please Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in

/md5start
termsrv.dll
/md5stop

• Click the None button, followed by Run Scan button. The scan wont take long.
• When the scan completes, it will open one notepad window. OTL.Txt. This is saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post it here.

Thanks a lot!

Richard

 

[SlasherIT]

Ok I did it... Here you go.


OTL logfile created on: 14-Jul-11 5:04:58 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Naim Chahine\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

3.99 Gb Total Physical Memory | 2.29 Gb Available Physical Memory | 57.42% Memory free
9.85 Gb Paging File | 8.40 Gb Available in Paging File | 85.26% Paging File free
Paging file location(s): c:\pagefile.sys 6000 6000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.56 Gb Total Space | 154.24 Gb Free Space | 33.13% Space Free | Partition Type: NTFS
Drive E: | 931.48 Gb Total Space | 476.88 Gb Free Space | 51.20% Space Free | Partition Type: NTFS
Drive F: | 465.76 Gb Total Space | 435.36 Gb Free Space | 93.47% Space Free | Partition Type: NTFS

Computer Name: SLASHER | User Name: Naim Chahine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========



< MD5 for: TERMSRV.DLL >
[2009-07-14 03:17:47 | 000,706,560 | ---- | M] (Microsoft Corporation) MD5=572F6C8D3726DB1D3D524A6BCE1C7EAB -- C:\Windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_ea94336f6df51e09\termsrv.dll
[2011-02-23 22:23:19 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=E589BCD6041786C5E38E2D223C24C193 -- C:\Windows\SysNative\termsrv.dll
[2011-02-23 22:23:19 | 000,680,960 | ---- | M] (Microsoft Corporation) MD5=E589BCD6041786C5E38E2D223C24C193 -- C:\Windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll

< End of report >

 

[SlasherIT]

@niemiro - Mind taking a look at the log ?

 

[SlasherIT]

Anyone...?

 

[SlasherIT]

Look, sorry to sound rude and be an idiot, but... Is anyone going to check the CBS.log or not?

 

[mjf]

Based on the error message I'd run from an elevated command prompt:

vssadmin list writers

look for errors.

 

[SlasherIT]

It doesn't really do anything, the command goes idle for a few moments then reports back nothing. I posted a screenshot.



Slasher

 

[mjf]

Well that looks like a problem. I think you should be get a list of writers like this

 

[SlasherIT]

I guess so... So what can I do about it?

 

[mjf]

I guess so... So what can I do about it?

My knowledge is limited so I can't give you a definite answer but look at these links
“vssadmin list writers” does not return any writers | microtom.net
and
Explanation of Regsvr32 usage and error messages

Someone else may know more.

 

[SlasherIT]

I tried the commands from the first link you gave me, and along the way it kept giving errors loading up some dll's. I still couldn't get it to work...

 

[mjf]

I tried the commands from the first link you gave me, and along the way it kept giving errors loading up some dll's. I still couldn't get it to work...

That's the best I can do at this stage.
Someone may be able to come along and give you better support.

 

[SlasherIT]

Thanks for trying mjf, I appreciate it. Anyone care to help me?