Author Topic: Avast, Windows 10 pro 64-bit and System File Checker  (Read 63391 times)

0 Members and 1 Guest are viewing this topic.

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #75 on: July 13, 2016, 12:48:35 AM »
I have exactly the same problem, I uninstalled Avast and run SFC, but in vain.


Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch amd64, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
Repair complete
Committing transaction


I restored my system with my previous backup and disabeled the automatic update in Avast  internet security until you resolve this issue.

Many thanks.
NourinE

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #76 on: July 13, 2016, 12:56:55 AM »
I have windows 8.1

I tried to reproduce your issue on Windows 8.1 and 10 x64 but was unable to reproduce the issue.

Firstly, as I have explained, the issue is not occurring on my Windows 8.1 Pro 64-bit PCs, only Windows 10 Pro 64-bit PCs.

Secondly, not reproducing this on 10 x64 is probably due to you not installing the same set of components as I do, so you are not replicating my Avast installation/setup.
NourinE

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #77 on: July 13, 2016, 01:31:59 AM »
I'll give it a shot


We currently don't support removal of these CRT files as they are shared among most of our products. However, if you are determined to eradicate them, you can take ownership of them (only them!) and delete them:
C:\Windows\WinSxs\Manifest\*_avast.*
C:\Windows\WinSxs\*_avast.*


Also, you need to delete the following registry keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\*_avast.*

Don't forget to reboot your system afterwards.
NourinE

REDACTED

  • Guest
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #78 on: July 15, 2016, 09:51:41 AM »
Hello,

I deal with Windows Update and CBS(SFC Corruptions) on a daily basis over at Sysnative forums.

This issue that is occuring is due to the following registry keys in the COMPONENTS hive:

HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

There are two issues (from what I have seen) one is that SFC is saying the manifest is missing the other is saying it is damaged. The missing error appears to come from after uninstalling avast, the damaged is due to a mistmatch of the two hashes.

A little background first: When SFC runs to check the integrity of the WinSxS files and folders(The component store) it will first verify that the manifest is not corrupt or missing. The way that SFC will check to see if the manifest is corrupt is by looking at a value within the COMPONENTS hive that is associated with the WinSxS folder. If the hash does not match it will return that the manifest is damaged, if the registry key in the COMPONENTS hive exists but it cant find the key it will show as missing.

This is a deeper analysis on the manifest is damaged issue:

Lets take the two manifest files that are causing this issue, along with the current SHA256(Hex) values:

x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.manifest
--> SHA256 Hex: 63A7687EFFCA7BE2C7B057DFF48BF13919DE614957851D8D9270A2B017B09A75

Code: [Select]
2016-07-03 14:22:46, Info                  CSI    000058d2 Manifest hash for component [l:73 ml:140]"[B]amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396[/B]" does not match expected value.
 Expected:{l:32 b:[COLOR=blue]e29526d5e7a9622ae55d4b1fa9001d5ca922450833b0e71fe760ed78089c573a[/COLOR]}
 Found:{l:32 b:[COLOR=red]7b77f2780d21c3a7cf3c6ae32d31a7c46c217eae321e897c22d5c4f29f34675d[/COLOR]}.
2016-07-03 14:22:46, Info                  CSI    000058d3 Unable to load manifest for component [l:73 ml:140]"amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396"
2016-07-03 14:22:46, Info                  CSI    000058d4 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch amd64, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
2016-07-03 14:22:46, Info                  CSI    000058d5 Manifest hash for component [l:71 ml:140]"

amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.manifest

--> SHA256 Hex: 7B77F2780D21C3A7CF3C6AE32D31A7C46C217EAE321E897C22D5C4F29F34675D

Code: [Select]
[B]x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c[/B]" does not match expected value.
 Expected:{l:[COLOR=blue]32 b:3aa52bd279cf7742e92b8cc464155b15bb4abe60d65463958aad243a2634f538[/COLOR]}
 Found:{l:32 b:[COLOR=red]63a7687effca7be2c7b057dff48bf13919de614957851d8d9270a2b017b09a75[/COLOR]}.
2016-07-03 14:22:46, Info                  CSI    000058d6 Unable to load manifest for component [l:71 ml:140]"x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c"
2016-07-03 14:22:46, Info                  CSI    000058d7 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
2016-07-03 14:22:46, Info                  CSI    000058d8 [SR] Repair complete

The part in red, is the hash it found on the manifest files.

The way that SFC verify the integrity of a manifest file is through the COMPONENTS registry hive
Code: [Select]
[HKEY_LOCAL_MACHINE\COMP\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396]
"S256H"=hex:[COLOR=blue]e2,95,26,d5,e7,a9,62,2a,e5,5d,4b,1f,a9,00,1d,5c,a9,22,45,08,33,b0,e7,1f,e7,60,ed,78,08,9c,57,3a[/COLOR]

[HKEY_LOCAL_MACHINE\COMP\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c]
"S256H"=hex:[COLOR=blue]3a,a5,2b,d2,79,cf,77,42,e9,2b,8c,c4,64,15,5b,15,bb,4a,be,60,d6,54,63,95,8a,ad,24,3a,26,34,f5,38[/COLOR]

The part in blue is what SFC was expecting for the manifest file, which matches the value in the registry.

If you change the hash inside the registry to the one on the actual file, the error will go away. What I would like from avast is confirmation that these manifest files are actually correct and the registry value is incorrect, or vis versa.

Deleting any registry keys found within the SOFTWARE hive will not stop the manifest is missing error, the way to fix this one is to remove the following COMPONENTS keys:
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

Does the avast removal tool clean up the COMPONENTS hive?

I have successfully fix the manifest is damaged issue, but changing the hash in the components hive.

Let me know if you need any more information.

Offline Patrick99

  • Jr. Member
  • **
  • Posts: 38
    • RTI
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #79 on: July 15, 2016, 08:18:28 PM »
What Windows OS are you using that contains the COMPONENTS registry hive? I am not seeing that in the Windows 10 registry

EDIT: Ran a registry cleanup and now see COMPONENTS hive in regedit
« Last Edit: July 16, 2016, 12:57:55 AM by Patrick99 »
Patrick
Win 10 64 bit Version 1803 (OS Build 17134.345)

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #80 on: July 16, 2016, 12:22:32 AM »
What Windows OS are you using that contains the COMPONENTS registry hive? I am not seeing that in the Windows 10 registry

neither do I! on Windows 8.1
NourinE

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #81 on: July 16, 2016, 12:25:19 AM »
I searched for this in the registry 'amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396', but I didn't find it, either.
NourinE

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #82 on: July 16, 2016, 12:39:35 AM »
for me this is where my problem is:

2016-07-13 17:37:11, Info                  CSI    0000090a [SR] Cannot verify component files for Avast.VC110.CRT, Version = 11.0.60610.1, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:2036b14a11e83e4a}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2016-07-13 17:37:11, Info                  CSI    0000090d [SR] Cannot verify component files for Avast.VC110.CRT, Version = 11.0.60610.1, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:2036b14a11e83e4a}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
NourinE

REDACTED

  • Guest
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #83 on: July 16, 2016, 01:08:31 AM »
The COMPONETS Hive gets loaded when its needed, for example when Windows Updates runs it will load the hive, when SFC runs it loads the hive etc.

The hive is located inside of C:\Windows\System32\config

The easiest way to load the hive is is to type into the search box(next to the start menu) windows features, select "turn windows features on and off", leave this window open.

I created a tutorial yesterday that will resolve this issue:
https://www.sysnative.com/forums/windows-update/20590-windows-10-avast-causing-corrupt-manifest-files-fix.html

Offline N@URINE

  • Full Member
  • ***
  • Posts: 167
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #84 on: July 16, 2016, 01:50:32 PM »
many many thanks Go The Power
it really worked like magic.  ;)
NourinE

Offline drake127

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #85 on: July 16, 2016, 03:02:11 PM »
To answer Go The Power's question, all manifests are correct. The reason why Windows complains about them is the fact that we added additional signatures to them. Unfortunately, in case of VC110, we used old catalog files. In case of VC140, we ommited to clean COMPONENTS cache.

The reason I didn't comment about a fix is that MS released new version of the runtime. New Avast versions will distribute only VC140 runtime (14.0.24210.0) with overriding policy making both VC110 and VC140 (14.0.23506.0 and 14.0.23918.0) obsolete. This makes it tricky to fix VC110 error as I would like to avoid having to distribute this runtime in following versions. As for VC140, I intend to completely remove it which should solve the issue.

Offline Patrick99

  • Jr. Member
  • **
  • Posts: 38
    • RTI
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #86 on: July 24, 2016, 09:57:09 PM »
Removed the manifests in question. Later had to do a repair install of Windows 10 for other reasons. Now Avast SecureLine refuses my license file and will not work. Submitted a ticket but I suspect it is because the Avast110 manifests have been removed.
Patrick
Win 10 64 bit Version 1803 (OS Build 17134.345)

Offline drake127

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #87 on: July 24, 2016, 10:16:05 PM »
That sounds likely. We plan to release emergency update for build 2272 but for now you have two options:
1) Repair your installation, this should reinstall VC110 runtime.
2) Update to latest beta (2275+) where SecureLine does not use VC110 runtime anymore.

Offline Patrick99

  • Jr. Member
  • **
  • Posts: 38
    • RTI
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #88 on: July 24, 2016, 10:23:34 PM »
Yes, I installed the beta version before reading your latest post and the problem has solved itself. A repair install would have just re-started the whole SCF scannow debacle. Whew!

I also updated my submitted ticket with relevant information and pointers to this discussion asking that the ticket now be considered closed.
Patrick
Win 10 64 bit Version 1803 (OS Build 17134.345)

Offline drake127

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: Avast, Windows 10 pro 64-bit and System File Checker
« Reply #89 on: July 25, 2016, 06:24:10 PM »
Hi again,
we released emergency update #358 fixing VC110 runtime on build 2272 (and its business equivalent). It should be delivered to computers within 12 hours. Please, let me know if everything is ok.