Avast, Windows 10 pro 64-bit and System File Checker

Avast Free Antivirus / Premium Security
1

I have uninstalled Avast free edition 2016.11.2.2262 from a Windows 10 Pro 64-bit PC using avastclear.exe v.11.2.2738.0.

I have run the System File Checker on this PC, which reports the following:
Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

I have checked the CBS.log and see the following lines:
2016-05-29 18:27:52, Info CSI 00004d66 [SR] Repairing 2 components
2016-05-29 18:27:52, Info CSI 00004d67 [SR] Beginning Verify and Repair transaction
2016-05-29 18:27:52, Info CSI 00004d68 Manifest hash for component [l:73 ml:140]“amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba” does not match expected value.
Expected:{l:32 b:714cddc73198abfd1a1a7dccbbca0808eda040d50b048b7e421d7afb8e2ac6b8}
Found:{l:32 b:b77d27df43c464ca24067666962175bd050201195a9a3e9f4021c89abb2c29c0}.
2016-05-29 18:27:52, Info CSI 00004d69 Unable to load manifest for component [l:73 ml:140]“amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba”
2016-05-29 18:27:52, Info CSI 00004d6a [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (TRUE)
2016-05-29 18:27:52, Info CSI 00004d6b Manifest hash for component [l:71 ml:140]“x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0” does not match expected value.
Expected:{l:32 b:4379430502b6887d62d4283c0bfcb6aaf7b65e2d559321ca9b05a5c80c3f4357}
Found:{l:32 b:d6b86bd6da85aef647b9c45e336c2ca37eda2e509c81bcf41b9bf06ca7c4f148}.
2016-05-29 18:27:52, Info CSI 00004d6c Unable to load manifest for component [l:71 ml:140]“x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0”
2016-05-29 18:27:52, Info CSI 00004d6d [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (TRUE)

These refer to Avast C runtime libraries.

Please advise on how I completely remove Avast (files and registry keys/values) from my system and so, eliminate the sfc corruption messages.

PLEASE NOTE: This is consistent for 2 other Windows 10 Pro 64-bit PCs I administer, both of which were running Avast free edition 2016.11.2.2262, but does NOT occur on a fourth Windows 8.1 Pro 64-bit PC, which was also running Avast free edition 2016.11.2.2262.

2

Only way to remove avast completely is doing it manually.
Remove all folders, files and registry entries.

3

I would like to remove the offending folders and files but as you are probably aware, even as an administrator I do not have permission to delete from the C:\Windows\WinSxS and C:\Windows\WinSxS\manifests folders as I am not Trusted Installer.

Any other ideas?

4

You need to login to Windows as the real administrator, not as a user with admin rights.

5

This may help you:
http://www.ghacks.net/2014/11/12/how-to-enable-the-hidden-windows-10-administrator-account/

6

I enabled the built-in windows 10 administrator account, but I am still unable to delete Avast related folders from C:\Windows\WinSxS due to not being Trusted Installer.

This really is absurd, that an end-user should be required to manually remove troublesome Avast files from system folders in the first place.

Any other ideas?

7

You have to take Ownership of these files first, then delete them. As you can see, the security works …
See: http://www.askvg.com/guide-how-to-take-ownership-permission-of-a-file-or-folder-manually-in-windows/

8

So, I have finally taken ownership of the offending Avast files and deleted them. Avast support have suggested I follow the advice given in this thread.

However, I have run the System File Checker again, but sadly it reports the same:
Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

The CBS.log still has references to Avast, which is causing the Windows Resource Protection corruption message. See the following lines from the CBS.log:
2016-05-30 14:44:50, Info CSI 00004eae [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (FALSE)
2016-05-30 14:44:50, Info CSI 00004eaf [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch amd64, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]“win32”, manifest is damaged (FALSE)
2016-05-30 14:44:50, Info CSI 00004eb0 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (FALSE)
2016-05-30 14:44:50, Info CSI 00004eb1 [SR] Cannot verify component files for Avast.VC140.MFC, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (FALSE)
2016-05-30 14:44:50, Info CSI 00004eb2 [SR] Cannot verify component files for Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:5]“win32”, manifest is damaged (FALSE)
2016-05-30 14:44:50, Info CSI 00004eb3 [SR] Cannot verify component files for policy.11.0.Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:12]“win32-policy”, manifest is damaged (FALSE)

I do not know how to fix this now. I have also asked Avast support, who have offered nothing in fixing this issue. This is just not acceptable.

Any other ideas would be much appreciated.

9

If you’ve contacted support, post the Support # here and we’ll try to expedite it.

10

#346999

Thank you.

11

Reported and help requested. Let’s see if that helps. :slight_smile:

12

We currently don’t support removal of these CRT files as they are shared among most of our products. However, if you are determined to eradicate them, you can take ownership of them (only them!) and delete them:
C:\Windows\WinSxs\Manifest*_avast.*
C:\Windows\WinSxs*_avast.*

Also, you need to delete the following registry keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners*_avast.*

Don’t forget to reboot your system afterwards.

13

Firstly, I am not determined to eradicate anything except system corruption. I am getting System File Checker corruption, which refers to Avast files (and is occurring on more than 1 Windows 10 Pro 64-bit PC). See the original post for the related problematic files/manifests.

The logical approach to fixing the corruption issue, which is caused by Avast free edition and Avast C runtime libraries, and recommended by Microsoft Support, was to remove Avast.

Secondly, I have already performed the removal you suggest here, which still does not fix the corruption issue. See my later post.

What I really want to know is how this corruption issue has occurred and how I can fix it. It is a recent problem, only appearing in the last 2 or 3 weeks, affects all my Windows 10 Pro 64-bit PCs and seems related to the 2016.11.2.2262 SafeZone Browser background update.

14

That’s interesting. Do you still have those files or did you irreversibly delete them? I cannot answer why SFC still detects our CRT if you removed all of its files. I tried to reproduce your issue on Windows 8.1 and 10 x64 but was unable to reproduce the issue. This makes me wonder if you really hadn’t those manifest somehow broken.

Can you try to reinstall Avast? It might fix it by reinstalling CRT again.

15

All of the following were permanently deleted:
C:\Windows\WinSxs\Manifest*_avast.*
C:\Windows\WinSxs*_avast.*
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners*_avast.*

I have now reinstalled Avast 2016.11.2.2262 with my usual component selection:

http://i751.photobucket.com/albums/xx157/mvilleuk/Avast/ce2dc156-dd64-4f3a-b010-db4530758cf3.jpg

Next I restore my .avastconfig settings and reboot.

Then I login to my Avast account and always get this error:
Unexpected Error
An unexpected error occurred on the server, we are working on the solution.
Refresh

another reboot usually fixes this issue.

Finally I have run sfc /scannow which results in:
Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

Here are the offending lines in the CBS.log:
2016-05-31 14:33:04, Info CSI 00004e9d [SR] Beginning Verify and Repair transaction
2016-05-31 14:33:04, Info CSI 00004e9e Manifest hash for component [l:73 ml:140]“amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba” does not match expected value.
Expected:{l:32 b:714cddc73198abfd1a1a7dccbbca0808eda040d50b048b7e421d7afb8e2ac6b8}
Found:{l:32 b:b77d27df43c464ca24067666962175bd050201195a9a3e9f4021c89abb2c29c0}.
2016-05-31 14:33:04, Info CSI 00004e9f Unable to load manifest for component [l:73 ml:140]“amd64_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_53c8344321b452ba”
2016-05-31 14:33:04, Info CSI 00004ea0 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch amd64, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (TRUE)
2016-05-31 14:33:04, Info CSI 00004ea1 Manifest hash for component [l:71 ml:140]“x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0” does not match expected value.
Expected:{l:32 b:4379430502b6887d62d4283c0bfcb6aaf7b65e2d559321ca9b05a5c80c3f4357}
Found:{l:32 b:d6b86bd6da85aef647b9c45e336c2ca37eda2e509c81bcf41b9bf06ca7c4f148}.
2016-05-31 14:33:04, Info CSI 00004ea2 Unable to load manifest for component [l:71 ml:140]“x86_avast.vc140.crt_fcc99ee6193ebbca_14.0.23918.0_none_9b756b1a36307bc0”
2016-05-31 14:33:04, Info CSI 00004ea3 [SR] Cannot verify component files for Avast.VC140.CRT, version 14.0.23918.0, arch x86, versionScope neutral, pkt {l:8 b:fcc99ee6193ebbca}, type [l:5]“win32”, manifest is damaged (TRUE)
2016-05-31 14:33:04, Info CSI 00004ea4 [SR] Cannot verify component files for policy.11.0.Avast.VC110.CRT, version 11.0.60610.1, arch x86, versionScope neutral, pkt {l:8 b:2036b14a11e83e4a}, type [l:12]“win32-policy”, manifest is damaged (FALSE)
2016-05-31 14:33:04, Info CSI 00004ea5 [SR] Repair complete

This fiasco all started with my post Manage Accounts crashes GUI dated 12/04/2016 and the subsequent background fixes and the forced SafeZone browser background install, which has screwed things up for me on all my Windows 10 Pro 64-bit PCs. It does not affect any of my Windows 8.1 64-bit PCs that I administer.

16

By the way, I am not alone with this issue. Just seen this recent thread:
http://www.tenforums.com/performance-maintenance/50851-help-sfc-after-dvd-upgrade-10-please.html

17

Firstly, as I have explained, the issue is not occurring on my Windows 8.1 Pro 64-bit PCs, only Windows 10 Pro 64-bit PCs.

Secondly, not reproducing this on 10 x64 is probably due to you not installing the same set of components as I do, so you are not replicating my Avast installation/setup.

18

A little note :

SFC appends things to CBS.log but is not creating it.
Those entries can only be there if not everything from avast has been removed.
Unless there is somewhere a flaw in Windows that thinks not everything is removed.

19

I would gladly completely remove Avast from the affected PCs. Sadly, I am not the developer of this software and as such, I am not in a position to know whether everything Avast related has been removed.

Currently, I have been advised to re-install Avast (see reply #13), which I have done (see reply #14).

20

I too have the same problem. I am using Avast Pro v 11.2.2262 on 2 desktop machines and 1 laptop. The 2 desktops were upgraded from Win 7 Pro ultimate 64 to Win 10 Pro 64 about 3 weeks back and the laptop form Win 8.1 Home 64 to Win 10 Home 64. Having run sfc /scannow 2 or 3 times on all these machines, I always get the same result indicating corrupted files which cannot be repaired. The files in question are always AVAST.VC140.CRT files as per the original post.

Over the years I have learned that error messages are frequently long on “error” and short on “message”. At the end of the sfc scan it mentions “corrupted” files. But in the cs log the incriminated files are not labeled as “corrupted”. Rather it says “Unable to load manifest” & “Cannot verify” for these Avast files. Are these files really corrupted ?

Windows 10 has apparently added more stringent checking and controls for apps which have not received the latest version of Microsoft’s “certification” for use with Win 10.

Could it be that this is the issue?

Could an Avast moderator make a comment as to whether or not this could be what is at issue here?

In advance thanks,
Richard