Cumulative Update KB4507453 Windows 10 v1903 build 18362.239 - July 9 Win Update

CountMike said:

Did you replace it with some other AV ?

Hi,
Yeah just installed and activated mbam pro/ premium
Never bothered before seeing I was only benchmarking but now I have a 10 install on each machine with mbam.. on it

I do still have expendable 10 installs to torture mostly offline.

er557 said:

after running sfc /verifyonly, or /scannow for that matter,
this command in admin command prompt will create a file on the desktop with easy to read and scroll view of exact places with errors inluding the time of the scan so you can sift through the irrelevant previous scans.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >%userprofile%\Desktop\sfcdetails.txt

Thanks for that mate...very useful

Anak said:

Yes, it does relate to SFC:
The CBS.persist.log gives a longer timeline of the past performance of your machine and should only be 'dumped' if you are sure that your machine is working okay.

---

So far since this Defender problem has been discovered I've seen one or three or more ways that consistently fix the problem:

• Run SFC then DISM
• RUn SFC, DISM, then SFC again
• Run DISM, then SFC
• With or without reboots in the beginning of running these scans or in between SFC or DISM but it looks like one needs to at least do a reboot after DISM
• Here's one by bastet that Try3 likes. From Try3's Post#99

And there are a few more combinations that will work, it's a tossup of what will work because of the different permutations that each machine carries. If one doesn't work try another. Yeah it's a crapshoot.

Great post mate. That's given me a better insight. Do you think its necessary to fix this Defender problem or do Microsoft usually do an automatic fix through Windows Update?

Hi,
Yep VerifyOnly
RestoreHealth
scannow
Should fix the issue after restart
VerifyOnly again.

Does the CBS Log file that SFC scannow creates get automatically recreated if you delete it? It would be handy to be able to clean the log out after each repair has been done. I don't know if that's recommended though or even possible? Do you delete or clean the log file somehow after you've read it or completed all repairs or just leave it alone to keep being added to when new SFC scans are run?

sportsfan148 said:

sportsfan148 said:

Great post mate. That's given me a better insight. Do you think its necessary to fix this Defender problem or do Microsoft usually do an automatic fix through Windows Update?

Does the CBS Log file that SFC scannow creates get automatically recreated if you delete it? It would be handy to be able to clean the log out after each repair has been done. I don't know if that's recommended though or even possible? Do you delete or clean the log file somehow after you've read it or completed all repairs or just leave it alone to keep being added to when new SFC scans are run?

Thank you.

Fix or wait? That's also a crapshoot.
MS is notorious for draggin' their heels and the longer you wait the higher the percentage goes with having major problems on the 'next' update so, IMHO I believe it would be best to correct the error as soon as possible.

Does the log file get recreated?
If you mean the CBSpersist.log yes, the CBS.log is always present. Once the CBS.log reaches 35 to 40MB the system creates the CBSpersist.log and moves that 35 to 40MB to it.

Then the CBSpersist.log cools its heels until the CBS.log reaches 35 to 40MB again. Then the CBS.log dumps that fresh 35 to 40MB to the CBSpersist.log and it (the CBS.log) starts anew.

Maybe a poor metaphor but think of CBS.log as wash and repeat with CBSpersist.log as rinse and the whole task as wash, rinse, repeat.

Keeping a smaller persist.log would be easier to read and I'm not sure if the CBS log gets recreated if it's deleted I think it does but I've never tried it, and I leave my persist log alone.

Anak said:

Thank you.

Fix or wait? That's also a crapshoot.
MS is notorious for draggin' their heels and the longer you wait the higher the percentage goes with having major problems on the 'next' update so, IMHO I believe it would be best to correct the error as soon as possible.

Does the log file get recreated?
If you mean the CBSpersist.log yes, the CBS.log is always present. Once the CBS.log reaches 35 to 40MB the system creates the CBSpersist.log and moves that 35 to 40MB to it.

Then the CBSpersist.log cools its heels until the CBS.log reaches 35 to 40MB again. Then the CBS.log dumps that fresh 35 to 40MB to the CBSpersist.log and it (the CBS.log) starts anew.

Maybe a poor metaphor but think of CBS.log as wash and repeat with CBSpersist.log as rinse and the whole task as wash, rinse, repeat.

Keeping a smaller persist.log would be easier to read and I'm not sure if the CBS log gets recreated if it's deleted I think it does but I've never tried it, and I leave my persist log alone.

I was asking about the CBS log in particular. It would be handy for reading the CBS log file if it only had details of the last sfc scan

Try3 said:

You can use findstr commands to extract just the entries in the cbs log that you want.
- You never need to look through the entire log.
- SFC entries contain [SR]
- Other Windows functions, such as Windows installer, also write to the CBS log.

To extract all SFC entries into a text file {choose your own path & filename; I include the computer name because I run the same code on several computers}

Code:

findstr.exe /c:"[SR]" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults.Log

To extract all SFC repairs into a text file {choose your own path & filename}

Code:

findstr.exe /c:"[SR] Repair" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults-Repairs.Log

To extract all SFC failures to repair into a text file {choose your own path & filename}

Code:

findstr.exe /c:"[SR] Cannot repair member file" %windir%\Logs\CBS\CBS.log >D:\Desktop\%ComputerName%-SFCResults-Unrepairables.Log"

Note that every line in the output files has its date-time stamp so if the extracts were very long you could just search for the first instance of today's date to start looking through what it has just been up to.

Do also note that Windows sends the cbs.log into archive every so often and starts a new one. The CBSPersist*.Log files are the retained archives [and they might eventually be deleted as well.] {Added later - Anak refers to this above}

Denis

Thanks very much for your detailed explanation. So deleting the CBS log file after each SFC scan or editing out all older and fixed sfc details doesn't sound like its recommended or maybe not even possible. I just thought it might be easier if it just included the current SFC scan. I thought that the CBS log file was just for viewing the the results of sfc scans but from what you have just said other Windows functions, such as Windows installer, also write to the CBS log. I didn't know that.