New
#31
Taking your CBS log as an example: Almost complete hang after login, only on SP1
CBS logs all start with the following header, where the servicing stack is loaded and your computer becomes ready for action:
Anything under the following line is where you need to start looking, for the majority of cases:Code:2013-09-08 23:11:26, Info CBS Starting TrustedInstaller initialization. 2013-09-08 23:11:26, Info CBS Loaded Servicing Stack v6.1.7601.17592 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\cbscore.dll 2013-09-08 23:11:28, Info CSI 00000001@2013/9/9:04:11:28.016 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee6a8f0ad @0x7fee6f19849 @0x7fee6ee34e3 @0xffebe97c @0xffebd799 @0xffebdb2f) 2013-09-08 23:11:28, Info CSI 00000002@2013/9/9:04:11:28.046 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee6a8f0ad @0x7fee6f66816 @0x7fee6f32aac @0x7fee6ee35b9 @0xffebe97c @0xffebd799) 2013-09-08 23:11:28, Info CSI 00000003@2013/9/9:04:11:28.046 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee6a8f0ad @0x7feebc08738 @0x7feebc08866 @0xffebe474 @0xffebd7de @0xffebdb2f) 2013-09-08 23:11:28, Info CBS Ending TrustedInstaller initialization. 2013-09-08 23:11:28, Info CBS Starting the TrustedInstaller main loop. 2013-09-08 23:11:28, Info CBS TrustedInstaller service starts successfully. 2013-09-08 23:11:28, Info CBS SQM: Initializing online with Windows opt-in: False 2013-09-08 23:11:28, Info CBS SQM: Cleaning up report files older than 10 days. 2013-09-08 23:11:28, Info CBS SQM: Requesting upload of all unsent reports. 2013-09-08 23:11:28, Info CBS SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL] 2013-09-08 23:11:28, Info CBS SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL] 2013-09-08 23:11:28, Info CBS SQM: Queued 0 file(s) for upload with pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6 2013-09-08 23:11:28, Info CBS SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL] 2013-09-08 23:11:28, Info CBS No startup processing required, TrustedInstaller service was not set as autostart, or else a reboot is still pending. 2013-09-08 23:11:28, Info CBS NonStart: Checking to ensure startup processing was not required. 2013-09-08 23:11:28, Info CSI 00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL, phase = 0, pdwDisposition = @0xc1fbc0 2013-09-08 23:11:28, Info CSI 00000005 Creating NT transaction (seq 1), objectname [6]"(null)" 2013-09-08 23:11:28, Info CSI 00000006 Created NT transaction (seq 1) result 0x00000000, handle @0x214 2013-09-08 23:11:28, Info CSI 00000007@2013/9/9:04:11:28.816 CSI perf trace: CSIPERF:TXCOMMIT;2082 2013-09-08 23:11:28, Info CBS NonStart: Success, startup processing not required as expected. 2013-09-08 23:11:28, Info CBS Startup processing thread terminated normally 2013-09-08 23:11:28, Info CSI 00000008 CSI Store 1269712 (0x0000000000135fd0) initialized
The rest of your CBS log is the SFC log, which is appended to the CBS log as the SFC scan progresses. The SFC information is summarised at the bottom of the log, so it's best to start at the bottom and work upwards.Code:2013-09-08 23:11:28, Info CSI 00000008 CSI Store ******* (0x****************) initialized
When SFC detects a corrupt file, it will say Hashes for file member..., then list the file path and the hashes it found for the corrupt files, so if you move the cursor to the bottom of the log and search upwards, in Notepad, for "hashes for file member", you will be brought to the details on the file corruption. Yes, there are other cases where this will fail, but they're rare enough to not have to worry about them for now. By doing what I outlined previously, and copying the associated log lines around the search results, I have found the problem:
Let's break this down, line by line.Code:2013-09-08 23:25:38, Info CSI 00000314 [SR] Verify complete 2013-09-08 23:25:38, Info CSI 00000315 [SR] Repairing 1 components 2013-09-08 23:25:38, Info CSI 00000316 [SR] Beginning Verify and Repair transaction 2013-09-08 23:25:39, Info CSI 00000317 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca\Pretty_Peacock.jpg do not match actual file [l:36{18}]"Pretty_Peacock.jpg" : Found: {l:32 b:hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=} Expected: {l:32 b:tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=} 2013-09-08 23:25:39, Info CSI 00000318 [SR] Cannot repair member file [l:36{18}]"Pretty_Peacock.jpg" of Microsoft-Windows-TabletPC-Journal, Version = 6.1.7601.18126, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch 2013-09-08 23:25:39, Info CSI 00000319 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca\Pretty_Peacock.jpg do not match actual file [l:36{18}]"Pretty_Peacock.jpg" : Found: {l:32 b:hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=} Expected: {l:32 b:tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=} 2013-09-08 23:25:39, Info CSI 0000031a [SR] Cannot repair member file [l:36{18}]"Pretty_Peacock.jpg" of Microsoft-Windows-TabletPC-Journal, Version = 6.1.7601.18126, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch 2013-09-08 23:25:39, Info CSI 0000031b [SR] This component was referenced by [l:154{77}]"Package_2_for_KB2835364~31bf3856ad364e35~amd64~~6.1.1.1.2835364-8_neutral_GDR" 2013-09-08 23:25:39, Info CSI 0000031c Hashes for file member \??\C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg do not match actual file [l:36{18}]"Pretty_Peacock.jpg" : Found: {l:32 b:hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=} Expected: {l:32 b:tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=} 2013-09-08 23:25:39, Info CSI 0000031d Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca\Pretty_Peacock.jpg do not match actual file [l:36{18}]"Pretty_Peacock.jpg" : Found: {l:32 b:hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=} Expected: {l:32 b:tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=} 2013-09-08 23:25:39, Info CSI 0000031e [SR] Could not reproject corrupted file [ml:520{260},l:122{61}]"\??\C:\Program Files\Common Files\Microsoft Shared\Stationery"\[l:36{18}]"Pretty_Peacock.jpg"; source file in store is also corrupted
The SFC scan completed successfully.Code:2013-09-08 23:25:38, Info CSI 00000314 [SR] Verify complete
It found one file that is corrupt.Code:2013-09-08 23:25:38, Info CSI 00000315 [SR] Repairing 1 components
Starting the repair procedure.Code:2013-09-08 23:25:38, Info CSI 00000316 [SR] Beginning Verify and Repair transaction
The hash of the WinSxS copy (technically it's not a copy, but that's for another time) of Pretty_Peacock.jpg don't match the copy elsewhere in the system, so at least one of them is corrupt.Code:2013-09-08 23:25:39, Info CSI 00000317 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca\Pretty_Peacock.jpg do not match actual file [l:36{18}]"Pretty_Peacock.jpg" :
Hash of file: hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=Code:Found: {l:32 b:hLMYgoYEaSd6WHNAcMpQlj3ndwYSJanHCJ0EaEjgsTg=} Expected: {l:32 b:tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=}
Hash file should be: tfmxBgEeHYSqU0nOhrdrRtqL98a1xYC32if7l90WiOg=
Can't repair Pretty_Peacock.jpg.Code:2013-09-08 23:25:39, Info CSI 00000318 [SR] Cannot repair member file [l:36{18}]"Pretty_Peacock.jpg" of Microsoft-Windows-TabletPC-Journal, Version = 6.1.7601.18126, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
Parent package (what it's part of): Microsoft-Windows-TabletPC-Journal
Version: 6.1.7601.18126
Architecture: x64 (though it doesn't matter for a .jpg file, the x86 and x64 copies of this file will be the same)
Language: Neutral
Public Key: 31bf3856ad364e35
Hash of file is wrong.
What package (.mum file) this file is listed in. By downloading and extracting KB2835364, we will find a clean copy of this file:Code:2013-09-08 23:25:39, Info CSI 0000031b [SR] This component was referenced by [l:154{77}]"Package_2_for_KB2835364~31bf3856ad364e35~amd64~~6.1.1.1.2835364-8_neutral_GDR"
Split post because it's way over the limit!Code:Volume in drive C has no label. Volume Serial Number is 7C4C-6725 Directory of C:\Users\Tom\AppData\Local\Temp\KBExtractor_Windows6.1-KB2835364-x64.msu\Windows6.1-KB2835364-x64.cab 11/09/2013 12:43 <DIR> . 11/09/2013 12:43 <DIR> .. 11/09/2013 12:43 0 0 12/04/2013 16:52 708 amd64_23f880c114cab8a1f946ca394d069be6_31bf3856ad364e35_7.1.7601.22296_none_8d70805edd52551b.manifest 12/04/2013 16:52 708 amd64_6b3959a2dbbebc94f9f0fb6ff13ce019_31bf3856ad364e35_6.1.7601.18126_none_f6dd899ce23841cd.manifest 12/04/2013 16:52 1,080 amd64_75edfb6af79f5aa0861357d93edbd5af_31bf3856ad364e35_6.1.7601.18126_none_6dcd7c3a1b55c09c.manifest 12/04/2013 16:52 721 amd64_76e09380e85bdc7be1ae1e98effac7ab_31bf3856ad364e35_6.1.7601.22296_none_0ec8b96997fbff57.manifest 12/04/2013 16:52 718 amd64_8720d6acd98dd6d8c12a46dd2233bcf7_31bf3856ad364e35_6.1.7601.18126_none_9bcf68eb605b0dbb.manifest 12/04/2013 16:52 1,080 amd64_9a05ec24d4a7bc31dcdcd9c221f4905b_31bf3856ad364e35_6.1.7601.22296_none_185118f3290bf1c2.manifest 12/04/2013 16:52 718 amd64_ce191d246ee2985a09fdda8866278971_31bf3856ad364e35_6.1.7601.22296_none_42c603396e97486f.manifest 12/04/2013 16:52 708 amd64_de532efc06a31996ac36e1051fd288ba_31bf3856ad364e35_7.1.7601.18126_none_cce2a0802a772ef5.manifest 12/04/2013 16:52 721 amd64_e2a448a3c5e4da4fc1b786892cc8fe1e_31bf3856ad364e35_6.1.7601.18126_none_a55a4bb2cde3952d.manifest 12/04/2013 16:52 708 amd64_f20f75e859862caa92ef9538c1f07518_31bf3856ad364e35_6.1.7601.22296_none_715f11e362d01c8b.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7601.18126_none_a082072163ab7b11 12/04/2013 16:53 5,800 amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7601.18126_none_a082072163ab7b11.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7601.22296_none_a0bff4787d01de72 12/04/2013 16:53 5,800 amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7601.22296_none_a0bff4787d01de72.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.1.7601.18126_none_abb551c8954acc8b 12/04/2013 16:53 5,116 amd64_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.1.7601.18126_none_abb551c8954acc8b.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.1.7601.22296_none_abf33f1faea12fec 12/04/2013 16:53 5,116 amd64_microsoft-windows-t..ournalnotewriterqfe_31bf3856ad364e35_6.1.7601.22296_none_abf33f1faea12fec.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.18126_none_28ad9f904db55fb8 12/04/2013 16:53 200,860 amd64_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.18126_none_28ad9f904db55fb8.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.22296_none_28eb8ce7670bc319 12/04/2013 16:53 200,860 amd64_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.22296_none_28eb8ce7670bc319.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca 12/04/2013 16:53 138,749 amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.18126_none_75cea008bb3e33ca.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.22296_none_760c8d5fd494972b 12/04/2013 16:53 138,749 amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.22296_none_760c8d5fd494972b.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_7.1.7601.18126_none_673f1c4e4624dc99 12/04/2013 16:53 113,277 amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_7.1.7601.18126_none_673f1c4e4624dc99.manifest 11/09/2013 12:42 <DIR> amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_7.1.7601.22296_none_677d09a55f7b3ffa 12/04/2013 16:53 113,277 amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_7.1.7601.22296_none_677d09a55f7b3ffa.manifest 12/04/2013 16:59 11,250 package_1_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:53 2,244 package_1_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:54 15,100 package_1_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:52 3,219 package_1_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:59 25,210 package_2_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:53 3,103 package_2_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:54 43,020 package_2_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:52 5,265 package_2_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:59 29,060 package_3_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:53 4,143 package_3_for_kb2835364_bf~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:54 50,720 package_3_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:52 7,280 package_3_for_kb2835364~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:59 7,400 package_for_kb2835364_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:53 2,739 package_for_kb2835364_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:54 7,400 package_for_kb2835364_sp1~31bf3856ad364e35~amd64~~6.1.1.1.cat 12/04/2013 16:52 2,799 package_for_kb2835364_sp1~31bf3856ad364e35~amd64~~6.1.1.1.mum 12/04/2013 16:59 7,400 update-bf.cat 12/04/2013 16:53 2,204 update-bf.mum 12/04/2013 16:54 7,400 update.cat 12/04/2013 16:52 2,242 update.mum 11/09/2013 12:42 <DIR> x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.18126_none_cc8f040c9557ee82 12/04/2013 16:53 200,856 x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.18126_none_cc8f040c9557ee82.manifest 11/09/2013 12:42 <DIR> x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.22296_none_ccccf163aeae51e3 12/04/2013 16:53 200,856 x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7601.22296_none_ccccf163aeae51e3.manifest 43 File(s) 1,576,384 bytes Directory of C:\Users\Tom\AppData\Local\Temp\KBExtractor_Windows6.1-KB2835364-x64.msu\Windows6.1-KB2835364-x64.cab\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7601.18126_none_a082072163ab7b11 11/09/2013 12:42 <DIR> . 11/09/2013 12:42 <DIR> .. 10/04/2013 06:46 1,402,880 jnwdrv.dll 14/07/2009 02:41 98,816 jnwdui.dll 14/07/2009 02:41 24,576 jnwmon.dll 14/07/2009 02:41 27,648 jnwppr.dll 14/07/2009 02:39 51,200 pdialog.exe 5 File(s) 1,605,120 bytes