Conflicting SFC results

  • Thread starter Thread starter JohnDavid
  • Start date Start date
J

JohnDavid

Running Vista Home Premium.
No problems with system performance or behavior, but I was curious to see if
the System File Checker would find anything. Ran sfc with the /verifyonly
parameter.

Upon completion, it displayed "Windows Resource Protection found integrity
violations. Details are included in the CBS.Log."

Using the guidance in http://support.microsoft.com/kb/928228/en-us ("How
to analyze the log file entries....SFC.exe program generates..."), I
redirected the sfc entries to a separate file, sfcdetails.txt .

Reviewing that file, I see no indication of a problem; in fact, the results
look exactly like the example given in the above article for a situation
where sfc did not identify any problems with system files.

So it's not clear if there is anything to be concerned about. I could, of
course, run sfc in 'scannow' mode, but am hesitant since my system does not
seem to be broken. Any thoughts? Thanks.
 
Hi John,

I have run this command on my machine and have come to the same result. My
machine is fully up to date and is malware free. The only thing I can think
of is that the checklist that SFC uses is that as supplied on the
installation disk and that any differences are due to files that have been
updated through Windows Update.
Dwarf
 
Thanks for the response. Your analysis of the results sounds good. I was
just taken aback, since my system is also up to date and, I believe, very
clean.
 
Hello John,
SFC actually reads the manifests for each of the components on the system.
From those it gets the correct version of the file that is supposed to be
projected to be used by Windows.
Any update you install for an OS component has to update the manifests with
the new file information.
So as the system is updated, SFC reads from the manifests and knows that
the files are supposed to be updated.
What is the exact entire message you are getting from SFC?
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> Thread-Topic: Conflicting SFC results
|> thread-index: AciGvgHOoKAUtyIrQQKje4L/+9g3pw==
|> X-WBNR-Posting-Host: 71.203.36.216
|> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> References: <[email protected]>
<[email protected]>
|> Subject: RE: Conflicting SFC results
|> Date: Sat, 15 Mar 2008 10:00:01 -0700
|> Lines: 38
|> Message-ID: <[email protected]>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> charset="Utf-8"
|> Content-Transfer-Encoding: 7bit
|> X-Newsreader: Microsoft CDO for Windows 2000
|> Content-Class: urn:content-classes:message
|> Importance: normal
|> Priority: normal
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.performance_maintenance:21561
|> NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
|> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|>
|> Thanks for the response. Your analysis of the results sounds good. I
was
|> just taken aback, since my system is also up to date and, I believe,
very
|> clean.
|>
|> "Dwarf" wrote:
|>
|> > Hi John,
|> >
|> > I have run this command on my machine and have come to the same
result. My
|> > machine is fully up to date and is malware free. The only thing I can
think
|> > of is that the checklist that SFC uses is that as supplied on the
|> > installation disk and that any differences are due to files that have
been
|> > updated through Windows Update.
|> > Dwarf
|> >
|> > "JohnDavid" wrote:
|> >
|> > > Running Vista Home Premium.
|> > > No problems with system performance or behavior, but I was curious
to see if
|> > > the System File Checker would find anything. Ran sfc with the
/verifyonly
|> > > parameter.
|> > >
|> > > Upon completion, it displayed "Windows Resource Protection found
integrity
|> > > violations. Details are included in the CBS.Log."
|> > >
|> > > Using the guidance in http://support.microsoft.com/kb/928228/en-us
("How
|> > > to analyze the log file entries....SFC.exe program generates..."), I
|> > > redirected the sfc entries to a separate file, sfcdetails.txt .
|> > >
|> > > Reviewing that file, I see no indication of a problem; in fact, the
results
|> > > look exactly like the example given in the above article for a
situation
|> > > where sfc did not identify any problems with system files.
|> > >
|> > > So it's not clear if there is anything to be concerned about. I
could, of
|> > > course, run sfc in 'scannow' mode, but am hesitant since my system
does not
|> > > seem to be broken. Any thoughts? Thanks.
|> > >
|> > >
|>
 
Thanks for your response.
When the command 'sfc /verifyonly' completed, the following was displayed
in the command window: "Windows Resource Protection found integrity
violations. Details are included in the CBS.Log."

But, as stated in original post, examination of the [SR] entries in that log
file shows no errors.

I understand the SFC examines system files in groups of 100. When looking
at the entire CBS.log file I see the [SR] entries for each block of 100
files; those entries are timestamped and have progress verbiage ("beginning
verify"...etc). After each group of 100 is a POQ section, which I'm guessing
holds intended repair info. For most of the groups-of-100 the POQ sections
are empty, showing just the start and end of a particular POQ. However, for
some of the groups-of-100, the POQ section has numbered entries that seem to
detail what change/fix is needed (though the syntax is confusing to me).
Following is a section of that CBS.log with the [SR] lines and the first
entry of the corresponding POQ section:

2008-03-14 20:41:01, Info CSI 00000006 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:01, Info CSI 00000007 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:05, Info CSI 00000008 Repair results
created:
POQ 0 starts:
0: Move File: Source =
[l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\209a43403586c801650000004815ac11._0000000000000000.cdf-ms",
Destination =
[l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
..
..
..
Again, I'm not sure what the POQ entries are trying to tell me, but I
believe that the existence of those relate to that error msg from the command
window, cited above. Further thoughts?? Thanks.

"Darrell Gorter[MSFT]" said:
Hello John,
SFC actually reads the manifests for each of the components on the system.
From those it gets the correct version of the file that is supposed to be
projected to be used by Windows.
Any update you install for an OS component has to update the manifests with
the new file information.
So as the system is updated, SFC reads from the manifests and knows that
the files are supposed to be updated.
What is the exact entire message you are getting from SFC?
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> Thread-Topic: Conflicting SFC results
|> thread-index: AciGvgHOoKAUtyIrQQKje4L/+9g3pw==
|> X-WBNR-Posting-Host: 71.203.36.216
|> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> References: <[email protected]>
<[email protected]>
|> Subject: RE: Conflicting SFC results
|> Date: Sat, 15 Mar 2008 10:00:01 -0700
|> Lines: 38
|> Message-ID: <[email protected]>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> charset="Utf-8"
|> Content-Transfer-Encoding: 7bit
|> X-Newsreader: Microsoft CDO for Windows 2000
|> Content-Class: urn:content-classes:message
|> Importance: normal
|> Priority: normal
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.performance_maintenance:21561
|> NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
|> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|>
|> Thanks for the response. Your analysis of the results sounds good. I
was
|> just taken aback, since my system is also up to date and, I believe,
very
|> clean.
|>
|> "Dwarf" wrote:
|>
|> > Hi John,
|> >
|> > I have run this command on my machine and have come to the same
result. My
|> > machine is fully up to date and is malware free. The only thing I can
think
|> > of is that the checklist that SFC uses is that as supplied on the
|> > installation disk and that any differences are due to files that have
been
|> > updated through Windows Update.
|> > Dwarf
|> >
|> > "JohnDavid" wrote:
|> >
|> > > Running Vista Home Premium.
|> > > No problems with system performance or behavior, but I was curious
to see if
|> > > the System File Checker would find anything. Ran sfc with the
/verifyonly
|> > > parameter.
|> > >
|> > > Upon completion, it displayed "Windows Resource Protection found
integrity
|> > > violations. Details are included in the CBS.Log."
|> > >
|> > > Using the guidance in http://support.microsoft.com/kb/928228/en-us
("How
|> > > to analyze the log file entries....SFC.exe program generates..."), I
|> > > redirected the sfc entries to a separate file, sfcdetails.txt .
|> > >
|> > > Reviewing that file, I see no indication of a problem; in fact, the
results
|> > > look exactly like the example given in the above article for a
situation
|> > > where sfc did not identify any problems with system files.
|> > >
|> > > So it's not clear if there is anything to be concerned about. I
could, of
|> > > course, run sfc in 'scannow' mode, but am hesitant since my system
does not
|> > > seem to be broken. Any thoughts? Thanks.
|> > >
|> > >
|>
Click to expand...
 
Hello,
What is the output from this?
findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> Thread-Topic: Conflicting SFC results
|> thread-index: AciHL3GAZiYEL9hURNesLghhwamsmQ==
|> X-WBNR-Posting-Host: 71.203.36.216
|> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> References: <[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
|> Subject: RE: Conflicting SFC results
|> Date: Sat, 15 Mar 2008 23:32:01 -0700
|> Lines: 133
|> Message-ID: <[email protected]>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> charset="Utf-8"
|> Content-Transfer-Encoding: 7bit
|> X-Newsreader: Microsoft CDO for Windows 2000
|> Content-Class: urn:content-classes:message
|> Importance: normal
|> Priority: normal
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.performance_maintenance:21593
|> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|>
|> Thanks for your response.
|> When the command 'sfc /verifyonly' completed, the following was
displayed
|> in the command window: "Windows Resource Protection found integrity
|> violations. Details are included in the CBS.Log."
|>
|> But, as stated in original post, examination of the [SR] entries in that
log
|> file shows no errors.
|>
|> I understand the SFC examines system files in groups of 100. When
looking
|> at the entire CBS.log file I see the [SR] entries for each block of 100
|> files; those entries are timestamped and have progress verbiage
("beginning
|> verify"...etc). After each group of 100 is a POQ section, which I'm
guessing
|> holds intended repair info. For most of the groups-of-100 the POQ
sections
|> are empty, showing just the start and end of a particular POQ. However,
for
|> some of the groups-of-100, the POQ section has numbered entries that
seem to
|> detail what change/fix is needed (though the syntax is confusing to me).

|> Following is a section of that CBS.log with the [SR] lines and the first
|> entry of the corresponding POQ section:
|>
|> 2008-03-14 20:41:01, Info CSI 00000006 [SR]
Verifying
|> 100 (0x00000064) components
|> 2008-03-14 20:41:01, Info CSI 00000007 [SR]
Beginning
|> Verify and Repair transaction
|> 2008-03-14 20:41:05, Info CSI 00000008 Repair
results
|> created:
|> POQ 0 starts:
|> 0: Move File: Source =
|>
[l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\209a43403586c801650000004
815ac11._0000000000000000.cdf-ms",
|> Destination =
|> [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
|> .
|> .
|> .
|> Again, I'm not sure what the POQ entries are trying to tell me, but I
|> believe that the existence of those relate to that error msg from the
command
|> window, cited above. Further thoughts?? Thanks.
|>
|> ""Darrell Gorter[MSFT]"" wrote:
|>
|> > Hello John,
|> > SFC actually reads the manifests for each of the components on the
system.
|> > From those it gets the correct version of the file that is supposed to
be
|> > projected to be used by Windows.
|> > Any update you install for an OS component has to update the manifests
with
|> > the new file information.
|> > So as the system is updated, SFC reads from the manifests and knows
that
|> > the files are supposed to be updated.
|> > What is the exact entire message you are getting from SFC?
|> > Thanks,
|> > Darrell Gorter[MSFT]
|> >
|> > This posting is provided "AS IS" with no warranties, and confers no
rights
|> > --------------------
|> > |> Thread-Topic: Conflicting SFC results
|> > |> thread-index: AciGvgHOoKAUtyIrQQKje4L/+9g3pw==
|> > |> X-WBNR-Posting-Host: 71.203.36.216
|> > |> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> > |> References: <[email protected]>
|> > <[email protected]>
|> > |> Subject: RE: Conflicting SFC results
|> > |> Date: Sat, 15 Mar 2008 10:00:01 -0700
|> > |> Lines: 38
|> > |> Message-ID: <[email protected]>
|> > |> MIME-Version: 1.0
|> > |> Content-Type: text/plain;
|> > |> charset="Utf-8"
|> > |> Content-Transfer-Encoding: 7bit
|> > |> X-Newsreader: Microsoft CDO for Windows 2000
|> > |> Content-Class: urn:content-classes:message
|> > |> Importance: normal
|> > |> Priority: normal
|> > |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> > |> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> > |> Path: TK2MSFTNGHUB02.phx.gbl
|> > |> Xref: TK2MSFTNGHUB02.phx.gbl
|> > microsoft.public.windows.vista.performance_maintenance:21561
|> > |> NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
|> > |> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|> > |>
|> > |> Thanks for the response. Your analysis of the results sounds good.
I
|> > was
|> > |> just taken aback, since my system is also up to date and, I
believe,
|> > very
|> > |> clean.
|> > |>
|> > |> "Dwarf" wrote:
|> > |>
|> > |> > Hi John,
|> > |> >
|> > |> > I have run this command on my machine and have come to the same
|> > result. My
|> > |> > machine is fully up to date and is malware free. The only thing I
can
|> > think
|> > |> > of is that the checklist that SFC uses is that as supplied on the
|> > |> > installation disk and that any differences are due to files that
have
|> > been
|> > |> > updated through Windows Update.
|> > |> > Dwarf
|> > |> >
|> > |> > "JohnDavid" wrote:
|> > |> >
|> > |> > > Running Vista Home Premium.
|> > |> > > No problems with system performance or behavior, but I was
curious
|> > to see if
|> > |> > > the System File Checker would find anything. Ran sfc with the
|> > /verifyonly
|> > |> > > parameter.
|> > |> > >
|> > |> > > Upon completion, it displayed "Windows Resource Protection
found
|> > integrity
|> > |> > > violations. Details are included in the CBS.Log."
|> > |> > >
|> > |> > > Using the guidance in
http://support.microsoft.com/kb/928228/en-us
|> > ("How
|> > |> > > to analyze the log file entries....SFC.exe program
generates..."), I
|> > |> > > redirected the sfc entries to a separate file, sfcdetails.txt .
|> > |> > >
|> > |> > > Reviewing that file, I see no indication of a problem; in fact,
the
|> > results
|> > |> > > look exactly like the example given in the above article for a
|> > situation
|> > |> > > where sfc did not identify any problems with system files.
|> > |> > >
|> > |> > > So it's not clear if there is anything to be concerned about.
I
|> > could, of
|> > |> > > course, run sfc in 'scannow' mode, but am hesitant since my
system
|> > does not
|> > |> > > seem to be broken. Any thoughts? Thanks.
|> > |> > >
|> > |> > >
|> > |>
|> >
|> >
|>
 
Contects of sfcdetails.txt is what I first examined. It doesn't seem to show
any problems. But feel free to take a look; it follows:
2008-03-14 20:41:01, Info CSI 00000006 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:01, Info CSI 00000007 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:05, Info CSI 00000009 [SR] Verify
complete
2008-03-14 20:41:05, Info CSI 0000000a [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:05, Info CSI 0000000b [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:09, Info CSI 0000000d [SR] Verify
complete
2008-03-14 20:41:10, Info CSI 0000000e [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:10, Info CSI 0000000f [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:11, Info CSI 00000011 [SR] Verify
complete
2008-03-14 20:41:12, Info CSI 00000012 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:12, Info CSI 00000013 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:14, Info CSI 00000015 [SR] Verify
complete
2008-03-14 20:41:14, Info CSI 00000016 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:14, Info CSI 00000017 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:16, Info CSI 00000019 [SR] Verify
complete
2008-03-14 20:41:17, Info CSI 0000001a [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:17, Info CSI 0000001b [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:19, Info CSI 0000001d [SR] Verify
complete
2008-03-14 20:41:19, Info CSI 0000001e [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:19, Info CSI 0000001f [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:25, Info CSI 00000021 [SR] Verify
complete
2008-03-14 20:41:26, Info CSI 00000022 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:26, Info CSI 00000023 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:32, Info CSI 00000025 [SR] Verify
complete
2008-03-14 20:41:32, Info CSI 00000026 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:32, Info CSI 00000027 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:39, Info CSI 0000002a [SR] Verify
complete
2008-03-14 20:41:40, Info CSI 0000002b [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:40, Info CSI 0000002c [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:44, Info CSI 0000002f [SR] Verify
complete
2008-03-14 20:41:45, Info CSI 00000030 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:45, Info CSI 00000031 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:41:51, Info CSI 00000033 [SR] Verify
complete
2008-03-14 20:41:51, Info CSI 00000034 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:41:51, Info CSI 00000035 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:00, Info CSI 0000003f [SR] Verify
complete
2008-03-14 20:42:00, Info CSI 00000040 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:00, Info CSI 00000041 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:04, Info CSI 00000043 [SR] Verify
complete
2008-03-14 20:42:05, Info CSI 00000044 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:05, Info CSI 00000045 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:10, Info CSI 00000047 [SR] Verify
complete
2008-03-14 20:42:11, Info CSI 00000048 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:11, Info CSI 00000049 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:16, Info CSI 0000004b [SR] Verify
complete
2008-03-14 20:42:16, Info CSI 0000004c [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:16, Info CSI 0000004d [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:25, Info CSI 0000004f [SR] Verify
complete
2008-03-14 20:42:25, Info CSI 00000050 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:25, Info CSI 00000051 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:35, Info CSI 00000055 [SR] Verify
complete
2008-03-14 20:42:35, Info CSI 00000056 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:35, Info CSI 00000057 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:42:44, Info CSI 00000059 [SR] Verify
complete
2008-03-14 20:42:45, Info CSI 0000005a [SR] Verifying
100 (0x00000064) components
2008-03-14 20:42:45, Info CSI 0000005b [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:07, Info CSI 0000005d [SR] Verify
complete
2008-03-14 20:43:08, Info CSI 0000005e [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:08, Info CSI 0000005f [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:14, Info CSI 00000061 [SR] Verify
complete
2008-03-14 20:43:15, Info CSI 00000062 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:15, Info CSI 00000063 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:18, Info CSI 00000065 [SR] Verify
complete
2008-03-14 20:43:18, Info CSI 00000066 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:18, Info CSI 00000067 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:21, Info CSI 00000069 [SR] Verify
complete
2008-03-14 20:43:21, Info CSI 0000006a [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:21, Info CSI 0000006b [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:29, Info CSI 00000080 [SR] Verify
complete
2008-03-14 20:43:30, Info CSI 00000081 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:30, Info CSI 00000082 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:36, Info CSI 0000008d [SR] Verify
complete
2008-03-14 20:43:37, Info CSI 0000008e [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:37, Info CSI 0000008f [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:40, Info CSI 00000091 [SR] Verify
complete
2008-03-14 20:43:41, Info CSI 00000092 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:41, Info CSI 00000093 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:46, Info CSI 00000095 [SR] Verify
complete
2008-03-14 20:43:47, Info CSI 00000096 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:47, Info CSI 00000097 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:43:53, Info CSI 00000099 [SR] Verify
complete
2008-03-14 20:43:53, Info CSI 0000009a [SR] Verifying
100 (0x00000064) components
2008-03-14 20:43:53, Info CSI 0000009b [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:03, Info CSI 0000009d [SR] Verify
complete
2008-03-14 20:44:04, Info CSI 0000009e [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:04, Info CSI 0000009f [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:07, Info CSI 000000a1 [SR] Verify
complete
2008-03-14 20:44:08, Info CSI 000000a2 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:08, Info CSI 000000a3 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:16, Info CSI 000000a5 [SR] Verify
complete
2008-03-14 20:44:16, Info CSI 000000a6 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:16, Info CSI 000000a7 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:22, Info CSI 000000a9 [SR] Verify
complete
2008-03-14 20:44:23, Info CSI 000000aa [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:23, Info CSI 000000ab [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:31, Info CSI 000000ad [SR] Verify
complete
2008-03-14 20:44:31, Info CSI 000000ae [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:31, Info CSI 000000af [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:45, Info CSI 000000d4 [SR] Verify
complete
2008-03-14 20:44:46, Info CSI 000000d5 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:46, Info CSI 000000d6 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:44:55, Info CSI 000000d8 [SR] Verify
complete
2008-03-14 20:44:55, Info CSI 000000d9 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:44:55, Info CSI 000000da [SR] Beginning
Verify and Repair transaction
2008-03-14 20:45:18, Info CSI 000000dc [SR] Verify
complete
2008-03-14 20:45:18, Info CSI 000000dd [SR] Verifying
100 (0x00000064) components
2008-03-14 20:45:18, Info CSI 000000de [SR] Beginning
Verify and Repair transaction
2008-03-14 20:45:42, Info CSI 000000e0 [SR] Verify
complete
2008-03-14 20:45:43, Info CSI 000000e1 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:45:43, Info CSI 000000e2 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:45:52, Info CSI 000000e4 [SR] Verify
complete
2008-03-14 20:45:52, Info CSI 000000e5 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:45:52, Info CSI 000000e6 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:00, Info CSI 000000e8 [SR] Verify
complete
2008-03-14 20:46:00, Info CSI 000000e9 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:00, Info CSI 000000ea [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:06, Info CSI 000000ed [SR] Verify
complete
2008-03-14 20:46:07, Info CSI 000000ee [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:07, Info CSI 000000ef [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:12, Info CSI 000000f1 [SR] Verify
complete
2008-03-14 20:46:12, Info CSI 000000f2 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:12, Info CSI 000000f3 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:31, Info CSI 000000f5 [SR] Verify
complete
2008-03-14 20:46:31, Info CSI 000000f6 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:31, Info CSI 000000f7 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:38, Info CSI 000000f9 [SR] Verify
complete
2008-03-14 20:46:38, Info CSI 000000fa [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:38, Info CSI 000000fb [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:51, Info CSI 000000fd [SR] Verify
complete
2008-03-14 20:46:51, Info CSI 000000fe [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:51, Info CSI 000000ff [SR] Beginning
Verify and Repair transaction
2008-03-14 20:46:59, Info CSI 00000101 [SR] Verify
complete
2008-03-14 20:46:59, Info CSI 00000102 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:46:59, Info CSI 00000103 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:05, Info CSI 00000105 [SR] Verify
complete
2008-03-14 20:47:06, Info CSI 00000106 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:06, Info CSI 00000107 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:18, Info CSI 0000010a [SR] Verify
complete
2008-03-14 20:47:19, Info CSI 0000010b [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:19, Info CSI 0000010c [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:28, Info CSI 0000010e [SR] Verify
complete
2008-03-14 20:47:28, Info CSI 0000010f [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:28, Info CSI 00000110 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:35, Info CSI 00000112 [SR] Verify
complete
2008-03-14 20:47:36, Info CSI 00000113 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:36, Info CSI 00000114 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:42, Info CSI 00000116 [SR] Verify
complete
2008-03-14 20:47:42, Info CSI 00000117 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:42, Info CSI 00000118 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:47:51, Info CSI 0000011a [SR] Verify
complete
2008-03-14 20:47:52, Info CSI 0000011b [SR] Verifying
100 (0x00000064) components
2008-03-14 20:47:52, Info CSI 0000011c [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:02, Info CSI 0000011e [SR] Verify
complete
2008-03-14 20:48:02, Info CSI 0000011f [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:02, Info CSI 00000120 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:10, Info CSI 00000122 [SR] Verify
complete
2008-03-14 20:48:10, Info CSI 00000123 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:10, Info CSI 00000124 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:12, Info CSI 00000126 [SR] Verify
complete
2008-03-14 20:48:13, Info CSI 00000127 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:13, Info CSI 00000128 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:20, Info CSI 0000012a [SR] Verify
complete
2008-03-14 20:48:20, Info CSI 0000012b [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:20, Info CSI 0000012c [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:25, Info CSI 0000012e [SR] Verify
complete
2008-03-14 20:48:25, Info CSI 0000012f [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:25, Info CSI 00000130 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:30, Info CSI 00000132 [SR] Verify
complete
2008-03-14 20:48:30, Info CSI 00000133 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:30, Info CSI 00000134 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:41, Info CSI 00000136 [SR] Verify
complete
2008-03-14 20:48:42, Info CSI 00000137 [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:42, Info CSI 00000138 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:46, Info CSI 0000013a [SR] Verify
complete
2008-03-14 20:48:46, Info CSI 0000013b [SR] Verifying
100 (0x00000064) components
2008-03-14 20:48:46, Info CSI 0000013c [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:53, Info CSI 0000013e [SR] Verify
complete
2008-03-14 20:48:53, Info CSI 0000013f [SR] Verifying 35
(0x00000023) components
2008-03-14 20:48:53, Info CSI 00000140 [SR] Beginning
Verify and Repair transaction
2008-03-14 20:48:55, Info CSI 00000142 [SR] Verify
complete


"Darrell Gorter[MSFT]" said:
Hello,
What is the output from this?
findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> Thread-Topic: Conflicting SFC results
|> thread-index: AciHL3GAZiYEL9hURNesLghhwamsmQ==
|> X-WBNR-Posting-Host: 71.203.36.216
|> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> References: <[email protected]>
<[email protected]>
<[email protected]>
<[email protected]>
|> Subject: RE: Conflicting SFC results
|> Date: Sat, 15 Mar 2008 23:32:01 -0700
|> Lines: 133
|> Message-ID: <[email protected]>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> charset="Utf-8"
|> Content-Transfer-Encoding: 7bit
|> X-Newsreader: Microsoft CDO for Windows 2000
|> Content-Class: urn:content-classes:message
|> Importance: normal
|> Priority: normal
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.performance_maintenance:21593
|> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|>
|> Thanks for your response.
|> When the command 'sfc /verifyonly' completed, the following was
displayed
|> in the command window: "Windows Resource Protection found integrity
|> violations. Details are included in the CBS.Log."
|>
|> But, as stated in original post, examination of the [SR] entries in that
log
|> file shows no errors.
|>
|> I understand the SFC examines system files in groups of 100. When
looking
|> at the entire CBS.log file I see the [SR] entries for each block of 100
|> files; those entries are timestamped and have progress verbiage
("beginning
|> verify"...etc). After each group of 100 is a POQ section, which I'm
guessing
|> holds intended repair info. For most of the groups-of-100 the POQ
sections
|> are empty, showing just the start and end of a particular POQ. However,
for
|> some of the groups-of-100, the POQ section has numbered entries that
seem to
|> detail what change/fix is needed (though the syntax is confusing to me).

|> Following is a section of that CBS.log with the [SR] lines and the first
|> entry of the corresponding POQ section:
|>
|> 2008-03-14 20:41:01, Info CSI 00000006 [SR]
Verifying
|> 100 (0x00000064) components
|> 2008-03-14 20:41:01, Info CSI 00000007 [SR]
Beginning
|> Verify and Repair transaction
|> 2008-03-14 20:41:05, Info CSI 00000008 Repair
results
|> created:
|> POQ 0 starts:
|> 0: Move File: Source =
|>
[l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\209a43403586c801650000004
815ac11._0000000000000000.cdf-ms",
|> Destination =
|> [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
|> .
|> .
|> .
|> Again, I'm not sure what the POQ entries are trying to tell me, but I
|> believe that the existence of those relate to that error msg from the
command
|> window, cited above. Further thoughts?? Thanks.
|>
|> ""Darrell Gorter[MSFT]"" wrote:
|>
|> > Hello John,
|> > SFC actually reads the manifests for each of the components on the
system.
|> > From those it gets the correct version of the file that is supposed to
be
|> > projected to be used by Windows.
|> > Any update you install for an OS component has to update the manifests
with
|> > the new file information.
|> > So as the system is updated, SFC reads from the manifests and knows
that
|> > the files are supposed to be updated.
|> > What is the exact entire message you are getting from SFC?
|> > Thanks,
|> > Darrell Gorter[MSFT]
|> >
|> > This posting is provided "AS IS" with no warranties, and confers no
rights
|> > --------------------
|> > |> Thread-Topic: Conflicting SFC results
|> > |> thread-index: AciGvgHOoKAUtyIrQQKje4L/+9g3pw==
|> > |> X-WBNR-Posting-Host: 71.203.36.216
|> > |> From: =?Utf-8?B?Sm9obkRhdmlk?= <[email protected]>
|> > |> References: <[email protected]>
|> > <[email protected]>
|> > |> Subject: RE: Conflicting SFC results
|> > |> Date: Sat, 15 Mar 2008 10:00:01 -0700
|> > |> Lines: 38
|> > |> Message-ID: <[email protected]>
|> > |> MIME-Version: 1.0
|> > |> Content-Type: text/plain;
|> > |> charset="Utf-8"
|> > |> Content-Transfer-Encoding: 7bit
|> > |> X-Newsreader: Microsoft CDO for Windows 2000
|> > |> Content-Class: urn:content-classes:message
|> > |> Importance: normal
|> > |> Priority: normal
|> > |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
|> > |> Newsgroups: microsoft.public.windows.vista.performance_maintenance
|> > |> Path: TK2MSFTNGHUB02.phx.gbl
|> > |> Xref: TK2MSFTNGHUB02.phx.gbl
|> > microsoft.public.windows.vista.performance_maintenance:21561
|> > |> NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
|> > |> X-Tomcat-NG: microsoft.public.windows.vista.performance_maintenance
|> > |>
|> > |> Thanks for the response. Your analysis of the results sounds good.
I
|> > was
|> > |> just taken aback, since my system is also up to date and, I
believe,
|> > very
|> > |> clean.
|> > |>
|> > |> "Dwarf" wrote:
|> > |>
|> > |> > Hi John,
|> > |> >
|> > |> > I have run this command on my machine and have come to the same
|> > result. My
|> > |> > machine is fully up to date and is malware free. The only thing I
can
|> > think
|> > |> > of is that the checklist that SFC uses is that as supplied on the
|> > |> > installation disk and that any differences are due to files that
have
|> > been
|> > |> > updated through Windows Update.
|> > |> > Dwarf
|> > |> >
|> > |> > "JohnDavid" wrote:
|> > |> >
|> > |> > > Running Vista Home Premium.
|> > |> > > No problems with system performance or behavior, but I was
curious
|> > to see if
|> > |> > > the System File Checker would find anything. Ran sfc with the
|> > /verifyonly
|> > |> > > parameter.
|> > |> > >
|> > |> > > Upon completion, it displayed "Windows Resource Protection
found
|> > integrity
|> > |> > > violations. Details are included in the CBS.Log."
|> > |> > >
|> > |> > > Using the guidance in
http://support.microsoft.com/kb/928228/en-us
|> > ("How
|> > |> > > to analyze the log file entries....SFC.exe program
generates..."), I
|> > |> > > redirected the sfc entries to a separate file, sfcdetails.txt .
|> > |> > >
|> > |> > > Reviewing that file, I see no indication of a problem; in fact,
the
|> > results
|> > |> > > look exactly like the example given in the above article for a
|> > situation
|> > |> > > where sfc did not identify any problems with system files.
|> > |> > >
|> > |> > > So it's not clear if there is anything to be concerned about.
I
|> > could, of
|> > |> > > course, run sfc in 'scannow' mode, but am hesitant since my
system
|> > does not
|> > |> > > seem to be broken. Any thoughts? Thanks.
|> > |> > >
|> > |> > >
|> > |>
|> >
|> >
|>
Click to expand...
 
Back
Top