Avast, Windows 10 pro 64-bit and System File Checker

[avant-guvnor]

I have uninstalled Avast free edition 2016.11.2.2262 from a Windows 10 Pro 64-bit PC using avastclear.exe v.11.2.2738.0.

I have run the System File Checker on this PC, which reports the following:
Windows Resource Protection found corrupt files but was unable to fix some
 of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
 example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
 supported in offline servicing scenarios.

I have checked the CBS.log and see the following lines:
2016-05-29 18:27:52, Info                  CSI    00004d66 [SR] Repairing 2 components
2016-05-29 18:27:52, Info                  CSI    00004d67 [SR] Beginning Verify and Repair transaction
2016-05-29 18:27:52, Info                  CSI    00004d68 Manifest hash for component [l:73 ml:140]"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba" does not match expected value.
 Expected:{l:32 b:714cddc73198abfd1a1a7dccbbca0808eda040d50b048b7e421d7afb8e2ac6b8}
 Found:{l:32 b:b77d27df43c464ca24067666962175bd050201195a9a3e9f4021c89abb2c29c0}.
2016-05-29 18:27:52, Info                  CSI    00004d69 Unable to load manifest for component [l:73 ml:140]"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba"
2016-05-29 18:27:52, Info                  CSI    00004d6a [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (TRUE)
2016-05-29 18:27:52, Info                  CSI    00004d6b Manifest hash for component [l:71 ml:140]"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0" does not match expected value.
 Expected:{l:32 b:4379430502b6887d62d4283c0bfcb6aaf7b65e2d559321ca9b05a5c80c3f4357}
 Found:{l:32 b:d6b86bd6da85aef647b9c45e336c2ca37eda2e509c81bcf41b9bf06ca7c4f148}.
2016-05-29 18:27:52, Info                  CSI    00004d6c Unable to load manifest for component [l:71 ml:140]"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0"
2016-05-29 18:27:52, Info                  CSI    00004d6d [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (TRUE)

These refer to Avast C runtime libraries.

Please advise on how I completely remove Avast (files and registry keys/values) from my system and so, eliminate the sfc corruption messages.

PLEASE NOTE: This is consistent for 2 other Windows 10 Pro 64-bit PCs I administer, both of which were running Avast free edition 2016.11.2.2262, but does NOT occur on a fourth Windows 8.1 Pro 64-bit PC, which was also running Avast free edition 2016.11.2.2262.

[Eddy]

Only way to remove avast completely is doing it manually.
Remove all folders, files and registry entries.

[avant-guvnor]

Only way to remove avast completely is doing it manually.
Remove all folders, files and registry entries.

I would like to remove the offending folders and files but as you are probably aware, even as an administrator I do not have permission to delete from the C:\Windows\WinSxS and C:\Windows\WinSxS\manifests folders as I am not Trusted Installer.

Any other ideas?

[Eddy]

You need to login to Windows as the real administrator, not as a user with admin rights.

[bob3160]

This may help you:
http://www.ghacks.net/2014/11/12/how-to-enable-the-hidden-windows-10-administrator-account/

[avant-guvnor]

I enabled the built-in windows 10 administrator account, but I am still unable to delete Avast related folders from C:\Windows\WinSxS due to not being Trusted Installer.

This really is absurd, that an end-user should be required to manually remove troublesome Avast files from system folders in the first place.

Any other ideas?

[REDACTED]

You have to take Ownership of these files first, then delete them. As you can see, the security works ....
See: http://www.askvg.com/guide-how-to-take-ownership-permission-of-a-file-or-folder-manually-in-windows/

[avant-guvnor]

So, I have finally taken ownership of the offending Avast files and deleted them. Avast support have suggested I follow the advice given in this thread.

However, I have run the System File Checker again, but sadly it reports the same:
Windows Resource Protection found corrupt files but was unable to fix some
 of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
 example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
 supported in offline servicing scenarios.

The CBS.log still has references to Avast, which is causing the Windows Resource Protection corruption message. See the following lines from the CBS.log:
2016-05-30 14:44:50, Info                  CSI    00004eae [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (FALSE)
2016-05-30 14:44:50, Info                  CSI    00004eaf [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch amd64, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (FALSE)
2016-05-30 14:44:50, Info                  CSI    00004eb0 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (FALSE)
2016-05-30 14:44:50, Info                  CSI    00004eb1 [SR] Cannot verify component files for Avast.VC140.MFC, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (FALSE)
2016-05-30 14:44:50, Info                  CSI    00004eb2 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (FALSE)
2016-05-30 14:44:50, Info                  CSI    00004eb3 [SR] Cannot verify component files for policy.11.0.Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:12]"win32-policy", manifest is damaged (FALSE)

I do not know how to fix this now. I have also asked Avast support, who have offered nothing in fixing this issue. This is just not acceptable.

Any other ideas would be much appreciated.

[bob3160]

If you've contacted support, post the Support # here and we'll try to expedite it.

[avant-guvnor]

If you've contacted support, post the Support # here and we'll try to expedite it.

#346999

Thank you.

[bob3160]

If you've contacted support, post the Support # here and we'll try to expedite it.

#346999

Thank you.

Reported and help requested. Let's see if that helps.

[drake127]

We currently don't support removal of these CRT files as they are shared among most of our products. However, if you are determined to eradicate them, you can take ownership of them (only them!) and delete them:
C:\Windows\WinSxs\Manifest\*_avast.*
C:\Windows\WinSxs\*_avast.*

Also, you need to delete the following registry keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\*_avast.*

Don't forget to reboot your system afterwards.

[avant-guvnor]

We currently don't support removal of these CRT files as they are shared among most of our products. However, if you are determined to eradicate them, you can take ownership of them (only them!) and delete them:
C:\Windows\WinSxs\Manifest\*_avast.*
C:\Windows\WinSxs\*_avast.*

Also, you need to delete the following registry keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\*_avast.*

Don't forget to reboot your system afterwards.

Firstly, I am not determined to eradicate anything except system corruption. I am getting System File Checker corruption, which refers to Avast files (and is occurring on more than 1 Windows 10 Pro 64-bit PC). See the original post for the related problematic files/manifests.

The logical approach to fixing the corruption issue, which is caused by Avast free edition and Avast C runtime libraries, and recommended by Microsoft Support, was to remove Avast.

Secondly, I have already performed the removal you suggest here, which still does not fix the corruption issue. See my later post.

What I really want to know is how this corruption issue has occurred and how I can fix it. It is a recent problem, only appearing in the last 2 or 3 weeks, affects all my Windows 10 Pro 64-bit PCs and seems related to the 2016.11.2.2262 SafeZone Browser background update.

[drake127]

That's interesting. Do you still have those files or did you irreversibly delete them? I cannot answer why SFC still detects our CRT if you removed all of its files. I tried to reproduce your issue on Windows 8.1 and 10 x64 but was unable to reproduce the issue. This makes me wonder if you really hadn't those manifest somehow broken.

Can you try to reinstall Avast? It might fix it by reinstalling CRT again.

[avant-guvnor]

That's interesting. Do you still have those files or did you irreversibly delete them? I cannot answer why SFC still detects our CRT if you removed all of its files. I tried to reproduce your issue on Windows 8.1 and 10 x64 but was unable to reproduce the issue. This makes me wonder if you really hadn't those manifest somehow broken.

Can you try to reinstall Avast? It might fix it by reinstalling CRT again.

All of the following were permanently deleted:
C:\Windows\WinSxs\Manifest\*_avast.*
C:\Windows\WinSxs\*_avast.*
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\*_avast.*

I have now reinstalled Avast 2016.11.2.2262 with my usual component selection:


Next I restore my .avastconfig settings and reboot.

Then I login to my Avast account and always get this error:
Unexpected Error
An unexpected error occurred on the server, we are working on the solution.
Refresh

another reboot usually fixes this issue.

Finally I have run sfc /scannow which results in:
Windows Resource Protection found corrupt files but was unable to fix some
 of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
 example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
 supported in offline servicing scenarios.

Here are the offending lines in the CBS.log:
2016-05-31 14:33:04, Info                  CSI    00004e9d [SR] Beginning Verify and Repair transaction
2016-05-31 14:33:04, Info                  CSI    00004e9e Manifest hash for component [l:73 ml:140]"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba" does not match expected value.
 Expected:{l:32 b:714cddc73198abfd1a1a7dccbbca0808eda040d50b048b7e421d7afb8e2ac6b8}
 Found:{l:32 b:b77d27df43c464ca24067666962175bd050201195a9a3e9f4021c89abb2c29c0}.
2016-05-31 14:33:04, Info                  CSI    00004e9f Unable to load manifest for component [l:73 ml:140]"amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba"
2016-05-31 14:33:04, Info                  CSI    00004ea0 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (TRUE)
2016-05-31 14:33:04, Info                  CSI    00004ea1 Manifest hash for component [l:71 ml:140]"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0" does not match expected value.
 Expected:{l:32 b:4379430502b6887d62d4283c0bfcb6aaf7b65e2d559321ca9b05a5c80c3f4357}
 Found:{l:32 b:d6b86bd6da85aef647b9c45e336c2ca37eda2e509c81bcf41b9bf06ca7c4f148}.
2016-05-31 14:33:04, Info                  CSI    00004ea2 Unable to load manifest for component [l:71 ml:140]"x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0"
2016-05-31 14:33:04, Info                  CSI    00004ea3 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]"win32", manifest is damaged (TRUE)
2016-05-31 14:33:04, Info                  CSI    00004ea4 [SR] Cannot verify component files for policy.11.0.Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:12]"win32-policy", manifest is damaged (FALSE)
2016-05-31 14:33:04, Info                  CSI    00004ea5 [SR] Repair complete

This fiasco all started with my post Manage Accounts crashes GUI dated 12/04/2016 and the subsequent background fixes and the forced SafeZone browser background install, which has screwed things up for me on all my Windows 10 Pro 64-bit PCs. It does not affect any of my Windows 8.1 64-bit PCs that I administer.