[SOLVED] Done numerous DISM Restorehealth scans but still getting sfc sscannow errors

rg2clive said:
I've been googling the best free antivirus programs, and most reckon Avira is the best, which I have used before but can't remember why I changed to Avast, so I might change back to Avira, if necessary.Avast has caused some problems recently.
Click to expand...

I used to use Avira as well, I was very happy with it.
 
Think I remember why I changed from Avira.....too many pop ups.lol. If the problem with Avast can't be fixed, I'll try Avira again or one of the others, but I'm so used to Avast, so I'll wait to see if it CAN be fixed to work without SFC errors first. :smile9:
 
I set up a new Virtual Machine (VM) running Windows 10 and installed Avast, I ran SFC /SCANNOW and no errors were detected. The next thing I looked at was the two manifest files in questions, I compared them to your ones. I verified they were were the same by looking at the SHA256 Base64 hash, this is a way to check the integrity of files, if one tiny thing is different between the two files it would have a totally new hash. But in this case the hash was the same for both files, but SFC is saying there is a hash mist match for the two manifest files:

x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.manifest
--> SHA256 Base64: Y6dofv/Ke+LHsFff9IvxORneYUlXhR2NknCisBewmnU=
--> SHA256 Hex: 63A7687EFFCA7BE2C7B057DFF48BF13919DE614957851D8D9270A2B017B09A75

Code: 
2016-07-03 14:22:46, Info                  CSI    000058d2 Manifest hash for component [l:73 ml:140]"[B]amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396[/B]" does not match expected value. 
 Expected:{l:32 b:[COLOR="#0000FF"]e29526d5e7a9622ae55d4b1fa9001d5ca922450833b0e71fe760ed78089c573a[/COLOR]}
 Found:{l:32 b:[COLOR="#FF0000"]7b77f2780d21c3a7cf3c6ae32d31a7c46c217eae321e897c22d5c4f29f34675d[/COLOR]}.
2016-07-03 14:22:46, Info                  CSI    000058d3 Unable to load manifest for component [l:73 ml:140]"amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396"
2016-07-03 14:22:46, Info                  CSI    000058d4 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch amd64, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
2016-07-03 14:22:46, Info                  CSI    000058d5 Manifest hash for component [l:71 ml:140]"

amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.manifest
--> SHA256 Base64: e3fyeA0hw6fPPGrjLTGnxGwhfq4yHol8ItXE8p80Z10=
--> SHA256 Hex: 7B77F2780D21C3A7CF3C6AE32D31A7C46C217EAE321E897C22D5C4F29F34675D

Code: 
[B]x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c[/B]" does not match expected value. 
 Expected:{l:[COLOR="#0000FF"]32 b:3aa52bd279cf7742e92b8cc464155b15bb4abe60d65463958aad243a2634f538[/COLOR]}
 Found:{l:32 b:[COLOR="#FF0000"]63a7687effca7be2c7b057dff48bf13919de614957851d8d9270a2b017b09a75[/COLOR]}.
2016-07-03 14:22:46, Info                  CSI    000058d6 Unable to load manifest for component [l:71 ml:140]"x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c"
2016-07-03 14:22:46, Info                  CSI    000058d7 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]"win32", manifest is damaged (TRUE)
2016-07-03 14:22:46, Info                  CSI    000058d8 [SR] Repair complete

The part in red, is the hash it found on the manifest files. According to the results from my tests on the VM, they are the same.

The way that SFC verify the integrity of a manifest file is through the COMPONENTS registry hive, this is the export from your machine:
Code: 
[HKEY_LOCAL_MACHINE\COMP\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396]
"S256H"=hex:[COLOR="#0000FF"]e2,95,26,d5,e7,a9,62,2a,e5,5d,4b,1f,a9,00,1d,5c,a9,22,45,08,33,b0,e7,1f,e7,60,ed,78,08,9c,57,3a[/COLOR]

[HKEY_LOCAL_MACHINE\COMP\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c]
"S256H"=hex:[COLOR="#0000FF"]3a,a5,2b,d2,79,cf,77,42,e9,2b,8c,c4,64,15,5b,15,bb,4a,be,60,d6,54,63,95,8a,ad,24,3a,26,34,f5,38[/COLOR]

The part in blue is what SFC was expecting for the manifest file, which matches the value in the registry.

I went to look for these registry values in my VM but they didn't exist! So I cant compare the results.

Now you are probably more interested in a fix than my analysis. What we will do now is change the values of the registry keys to the hash we pulled from the manifests. As we know the manifest hash is correct, I believe the hash in the registry is incorrect.

SFCFix script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Go to your desktop and right click on the background -> Select New -> Text Document -> Name this file SFCFixScript.txt.
  3. Open up SFCFixScript.txt and copy all of the following text inside the code box below and paste it into SFCFixScript.txt.
    Code: 
    ::
[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396]
"S256H"=hex:7B,77,F2,78,0D,21,C3,A7,CF,3C,6A,E3,2D,31,A7,C4,6C,21,7E,AE,32,1E,89,7C,22,D5,C4,F2,9F,34,67,5D

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c]
"S256H"=hex:63,A7,68,7E,FF,CA,7B,E2,C7,B0,57,DF,F4,8B,F1,39,19,DE,61,49,57,85,1D,8D,92,70,A2,B0,17,B0,9A,75
  4. Click on File -> Save. Close out of SFCFixScript.txt.
  5. Save any open documents and close all open windows.
  6. On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
  7. Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
  8. SFCFix will now process the script.
  9. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  10. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

SFC /SCANNOW
  1. Right click on the
    aa922834-ed43-40f1-8830-d5507badb56c_39.jpg
    button
  2. Click on Command prompt (Admin) => Press Yes on the prompt
  3. Inside the Command Prompt windows copy and paste the following command SFC /SCANNOW
  4. Please wait for this to Finish before continuing with rest of the steps.
Convert CBS.log to CBS.txt
  1. Right click on the
    aa922834-ed43-40f1-8830-d5507badb56c_39.jpg
    button
  2. Click on Run => Inside the run box copy and paste the following command:
    Code: 
    cmd /c copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
  3. Press Enter
  4. Once this has completed please go to your Desktop and you will find CBS.txt, please rename this file to CBS_{Insert forum username here}_{insert todays Date here}.txt For example "CBS_Go The Power_1803.txt"
  5. Please upload CBS_{Username}_{Date}.txt to this thread.
Please Note:: if the file is too big to upload to your next post please upload via Dropbox or One Drive
 
Code: 
SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-07-10 14:34:38.919
Microsoft Windows 10 Build 10586 - amd64
Using .txt script file at C:\Users\Cliff2\Desktop\SFCFixScript.txt.txt [0]



Code: 
Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-07-10 14:34:38.952
Script hash: YN41EonTr0XIa447rMLDVTeox1YoA5BVaJUBCdzkXhw=
----------------------EOF-----------------------

Hope this is right :)
 
Unfortunately that didn't work, I dont think the SFCScript processed correctly, the hash is different to the one I ran. Please try the following:

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

  1. Download SFCFixScript.txt attached to this post, and save this to your Desktop..
  2. Save any open documents and close all open windows.
  3. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  4. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  5. SFCFix will now process the script.
  6. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  7. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.
 

Attachments

Code:
SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-07-11 13:37:14.610
Microsoft Windows 10 Build 10586 - amd64
Using .txt script file at C:\Users\Cliff2\Desktop\SFCFixScript.txt.txt [0]




RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.
RegistryScript:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2016-07-11 13:37:18.071
Script hash: Ytl4LY447JqC9qrxi+JoCASFwgP3DflFodDT1k/A4sw=
----------------------EOF-----------------------SFCFix version 3.0.0.0 by niemiro.
Start time: 2016-07-11 13:37:14.610
Microsoft Windows 10 Build 10586 - amd64
Using .txt script file at C:\Users\Cliff2\Desktop\SFCFixScript.txt.txt [0]




RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.

Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_d58a6d64ab65b396.
Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1_none_1d37a43bbfe1dc9c.
RegistryScript:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2016-07-11 13:37:18.071
Script hash: Ytl4LY447JqC9qrxi+JoCASFwgP3DflFodDT1k/A4sw=
----------------------EOF-----------------------
Code:
 
think it worked sfc scannow came up with no errors....:thumbsup2:

I'll post the log in my next reply in a few mins via Dropbox.
 
Oh another question, if I have to uninstall Avast (incl. using the uninstall tool), at any time for some reason, and reinstall Avast, would everything be ok then?
 
rg2clive said:
Sounds good m8, does that mean problem solved and there's nothing else to do?
Click to expand...

Nothing else to do :)

rg2clive said:
Oh another question, if I have to uninstall Avast (incl. using the uninstall tool), at any time for some reason, and reinstall Avast, would everything be ok then?
Click to expand...

I would like to say yes, but I am unsure here TBH. The reason being is I never had those registry keys created when I installed Avast through my VM. If you like you can try and we can see what happens? I really wanted to look into this issue more, but as I cant reproduce it on my VM it makes it a little tricky. One other thing I was curious about, is if the Avast removal tool actually removes the registry values.
 
Ok, so I should try uninstalling Avast like your suggestion before by uninstalling Avast from Programs, then use the Avast Uninstall Tool which should uninstall all Avast registry values in Safe Mode, then reinstall a new Avast, then after installation do another SFC /SCANNOW to see if it reports any more errors?
 
I think she should leave as it is for now, I looked at the Avast forum and a lot of people have reported this issue I have responded to the thread over at Avast with my findings. Once I have a result I will get back to you :)
 
Avast have acknowledged the issue and they are working on a fix, a member from the Avast team has informed me that the Manifest files are not corrupt. It is an issue with the Components key, like I originally diagnosed.

Your machine should be fine, what we have done is repaired the COMPONENTS keys to the correct values, Avast has confirmed these values are correct.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top