Windows 10: Question with CBS.log

So i am having problems with Win key + X + U shortcut and decided to run the sfc /scannow command in the Windows command prompt. It showed the following message after running the verification process: Windows Resource Protection found corrupt files but was unable to fix some of them. For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included in the log file provided by the /OFFLOGFILE flag.But I'm failing to understand what to do after this and how to fix the corrupted files

:)

 

CBS Log question

Hello, I have a question regarding some text in my recent CBS Log file.

I have recently reset my computer due to corruption issues. After resetting the computer I ran the sfc /scannow command and it came up with, "Windows Resource Protection found corrupt files but was unable to fix some of them."

Upon reading the CBS file, the first error I see says, "2022-02-25 19:00:57, Info CSI 00000019 Manifest hash for component [l:75 ml:140]'amd64_dual_hidirkbd.inf_31bf3856ad364e35_10.0.19041.1_none_7ae8921225fc522c' does not match expected value.



Expected:{l:32 b:558b77aa67823c368af06c60b13b34f32f50ff0506444c79144e7599af84ea45}

Found:{l:32 b:ff62f76a13ba1e2112bd4277efac2854516f4b25c6590dc320f990ba5f1b3d52}.

2022-02-25 19:00:57, Info CSI 0000001a Unable to load manifest for component [l:75 ml:140]'amd64_dual_hidirkbd.inf_31bf3856ad364e35_10.0.19041.1_none_7ae8921225fc522c'



There are other overlap and corruption texts in the file but I figured I'd start with one thing at a time.

Any help would be greatly appreciated

 

"Public CBS Session Leak Detected" in CBS Logs- What Does it Mean?

Hello, JamesBacon620

Welcome to Microsoft Community.

In the context of CBS (Component-Based Servicing) logs in Windows, the message "Public CBS Session Leak Detected" typically indicates a problem related to the management of system resources, specifically with sessions and objects. Here's what the information in your log entry means:

1. Public CBS Session Leak Detected: This message suggests that the Component-Based Servicing system has identified a situation where a session has not been closed or released properly. CBS manages various components and updates in Windows, and sessions are used to keep track of these operations.
   
2. Session ID: The "Session ID" mentioned in the log entry is a unique identifier associated with a specific operation or task in CBS. It helps CBS track and manage the components and updates being installed or modified.
   
3. Clients (FodHelper and SystemSettings): These are the components or applications that were involved in the session that experienced the leak. In your log entry, FodHelper (LanguageFeaturesOnDemand) and SystemSettings are identified as the clients responsible for this issue.
   
4. Reference Count: The reference count indicates how many references or instances of a particular object or session are active. In your log entry, it mentions a reference count of 6 for both clients, which suggests that there were six references to these sessions when there should have been none or fewer.
   
5. HRESULT Codes: The HRESULT (Handle to Result) codes are error codes that provide more information about the nature of the problem. In your log entry, the HRESULT codes (0x880f0909 and 0x888f0909) indicate that a public object leak occurred.
   

Generally, "Session Leaks" like the one mentioned in your logs can be indicative of a problem with system resource management, but they don't necessarily mean that there's a security threat or malware present. These leaks can potentially lead to system instability or performance issues over time if they accumulate.

Overall, this is a normal report and CBS.log will only record updates to these system components and resources. These Objects are just resources from the application or system performance. It does not involve personal privacy information on your PC. Do not worry

Hope it helps! If any update, welcome to share with us.

Best regards,



Chandy |Microsoft Community Support Specialist

 

Understanding the CBS log & repairing corrupt files

I've been getting some event errors lately, in particular 2 errors.

Date: 10/21/2019 8:54:17 AM
Type: ErrorEvent: 1020Source: Microsoft-Windows-Perflib

The required buffer size is greater than the buffer size passed to the Collect function of the "C:\Windows\System32\perfts.dll" Extensible Counter DLL for the "LSM" service. The given buffer size was 34008 and the required size was 45368.

Date: 10/21/2019 2:07:45 PM
Type: WarningEvent: 1008Source: Microsoft-Windows-Perflib

The Open procedure for service ".NETFramework" in DLL "C:\WINDOWS\system32\mscoree.dll" failed with error code The system cannot find the file specified.. Performance data for this service will not be available.

So I went to https://support.microsoft.com/en-us/...rrupted-system and ran

sfc /scannow

I got the message:
Windows Resource Protection found corrupt files but was unable to fix some of them.For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log.

I tried to follow the rest of the steps listed on the support page, but got lost in the details.

1. When I used an elevated Powershell & ran the suggested command, I got:

PS C:\> findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

out-file : Could not find a part of the path 'C:\%userprofile%\Desktop\sfcdetails.txt'.At line:1 char:1+ findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\s ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: ) [Out-File], DirectoryNotFoundException + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand

2. I manually went to C:\Windows\Logs\CBS & opened CBS.log.There was so much detail that I couldn't follow what was corrupt. I've attached the log.

I would appreciate anyone telling me what files are corrupt & how to replace them. Thank you in advance!