Support for Windows Vista without any service packs installed ended

on April 13, 2010. To continue receiving security updates for

Windows, make sure you're running Windows Vista with Service Pack
2 (SP2). For more information, refer to this Microsoft web
page: Support is ending for some versions of Windows
INTRODUCTION
This article describes how to analyze the log files that the Microsoft Windows Resource Checker (SFC.exe)
program generates in Windows Vista.

More Information

Overview

You can use the SFC.exe program to help you troubleshoot crashes that occur in the user mode part of
Windows Vista. These crashes may be related to missing or damaged operating system files.

The SFC.exe program performs the following operations:

It verifies that non-configurable Windows Vista system files have not changed. Also, it verifies that
these files match the operating system's definition of which files are expected to be installed on the computer.

It repairs non-configurable Windows Vista system files, when it is possible.

How to analyze the log file that the SFC.exe program generates

How to view the log file

The SFC.exe program writes the details of each verification operation and of each repair operation to the
CBS.log file. Each SFC.exe program entry in this file has an [SR] tag. The CBS.log file is located in the
%windir%\Logs\CBS folder.

Note The Windows Modules Installer service also writes to this log file. (The Windows Modules Installer
service installs optional features, updates, and service packs.)

You can search for [SR] tags to help locate SFC.exe program entries. To perform this kind of search and to
redirect the results to a text file, follow these steps:

1. Click Start , type cmd in the Start Search box, right-click cmd in the Programs list, and then
click Run as administrator.

If you are prompted for an administrator password or for a confirmation, type your password, or
click Continue.

2. Type the following command, and then press ENTER:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

The Sfcdetails.txt file includes the entries that are logged every time that the SFC.exe program runs on the
computer.

How to interpret the log file entries

The SFC.exe program verifies files in groups of 100. Therefore, there will be many groups of SFC.exe program
entries. Each entry has the following format:
date time entry_type details
The following sample excerpt from a CBS.log file shows that the SFC.exe program did not identify any
problems with the Windows Vista system files:

<date> <time>, Info CSI 00000006 [SR] Verifying 100 (0x00000064) components
<date> <time>, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
<date> <time>, Info CSI 00000009 [SR] Verify complete
<date> <time>, Info CSI 0000000a [SR] Verifying 100 (0x00000064) components
<date> <time>, Info CSI 0000000b [SR] Beginning Verify and Repair transaction
<date> <time>, Info CSI 0000000d [SR] Verify complete
<date> <time>, Info CSI 0000000e [SR] Verifying 100 (0x00000064) components
<date> <time>, Info CSI 0000000f [SR] Beginning Verify and Repair transaction
<date> <time>, Info CSI 00000011 [SR] Verify complete
<additional entries>
<additional entries>
<date> <time>, Info CSI 00000011 [SR] Verify complete

The following sample excerpt from a CBS.log file shows that the SFC.exe program has identified problems
with the Windows Vista system files:

<date> <time>, Info CSI 00000006 [SR] Verifying 100 (0x00000064) components
<additional entries>
<additional entries>
<date> <time>, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
<date> <time>, Info CSI 00000008 [SR] Repairing corrupted file
[ml:520{260},l:108{54}]"\??\E:\Program Files\Common Files\Microsoft Shared\DAO"\[l:20{10}]"dao360.dll"
from store
<date> <time>, Info CSI 0000000a [SR] Verify complete

Note Although the log file entry states that the SFC.exe program is repairing the changed file, no actual
repair operation occurs when a file is verified.

The following table lists other messages that may be logged in the SFC.exe program entries of the CBS.log
file after verification is completed.

Entry Example Expla

nation

Cannot repair member file file Cannot repair member file This
details [l:14{7}]"url.dll" of Microsoft- entry
Windows-IE-WinsockAutodialStub, indicat
Version = 6.0.5752.0, pA = es that
PROCESSOR_ARCHITECTURE_I the file
NTEL (0), Culture neutral, conten
VersionScope = 1 nonSxS, t does
PublicKeyToken = {l:8 not
b:31bf3856ad364e35}, Type neutral, match
TypeN the
operati
 ng
system
definit
ion for
the
file. In
this
situati
on, the
SFC.e
xe
progra
m
cannot
repair
the
file.

Repaired file file details by copying Repaired file This

from backup \SystemRoot\WinSxS\Manifests\\ entry
[ml:24{12},l:18{9}]"netnb.inf" by indicat
copying from backup es that
a
proble
m
exists
with a
file.
The
SFC.e
xe
progra
m can
repair
this
file by
copyin
ga
versio
n from
a
private
system
store
backu
 p.

Repairing corrupted file Repairing corrupted file This

[ml:520{260},l:36{18}]"\??\C:\Win [ml:520{260},l:36{18}]"\??\C:\Win entry
dows\inf"\[l:18{9}]"netnb.inf" from dows\inf"\[l:18{9}]"netnb.inf" from indicat
store store es that
a
proble
m
exists
with a
file.
The
SFC.e
xe
progra
m can
repair
this
file by
copyin
ga
versio
n from
the
system
store.