[SOLVED] Manifest damage - SFCFix

Mike P · Sep 12, 2016

Hi,
got problem with Windows 7 64bit, freezes on "WELCOME".
Ran sfc /scannow - got info couldn't fix, then ran SFCFix and got Warning: Manifest damage on component...
I attache the files, SFCFix.zip file here

HTML:

https://www.sendspace.com/file/mse9o1

Next steps should I run on Normal mode (I've got to restart few times to run) or can I on Safe mode?
Best regards, Mike

Aura · Sep 17, 2016

Hi Mike,

Do you still need assistance with that issue?

Mike P · Sep 19, 2016

Hi,
thanks for reply.
Yes, the problem still exist.

Aura · Sep 19, 2016

Let's get a fresh CheckSUR log. Follow the instructions below please.

System Update Readiness Tool (SURT) - Scan
Follow the instructions below to run a scan with the System Update Readiness Tool (SURT) and provide a log;

Download the right version of SURT for your system;
- Your version of Windows is: Windows 7 SP1 x64
Once downloaded, execute the installer, and go throught the installation (this process can take around 15-20 minutes);
On completion, a log will be created in C:\Windows\Logs\CBS\CheckSUR.log;
Attach this log in your next reply;

Alternatively, if these instructions are unclear for you, you can follow the tutorial below.

System Update Readiness Tool (SURT)

Mike P · Sep 20, 2016

CheckSUR.log in attachment, waiting for next steps :)

Aura · Sep 20, 2016

Alright so SURT didn't report any corrupt file (no manifest), let's see what SFC have to say.

System File Checker (SFC)
Follow the instructions below to run a SFC scan on your system and to provide the CBS log in your next reply;

On Windows Vista & 7, click on the Windows Start Menu, then enter cmd in the search box, right-click on the cmd icon and select

Run as Administrator
On Windows 8, drag your cursor in the bottom-left corner, and right-click on the metro menu preview, then select Command Prompt (Admin);
On Windows 8.1 and Windows 10, right click on the Windows logo in the bottom-left corner and select Command Prompt (Admin);
Enter the command below and press on Enter;
Code:
```
sfc /scannow
```
Note: There's a space between "sfc" and "/scannow";
Once the scan is complete, enter the command below and press on Enter
Code:
```
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
```
A file called cbs.txt will have appeared on your Desktop. Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Note: Please note that the CBS.log is volatile, which means that if you don't upload it after the SFC scan is completed, it won't have the information from the scan anymore. So archive it and upload it as soon as you can.

Mike P · Sep 20, 2016

Here you go:
cbs.txt - Google Drive

Aura · Sep 20, 2016

SFC didn't detect any corruption either :) It looks like SFCFix reported corruption that was previously present on your system, but it has been fixed since then. So you're good :)

Mike P · Sep 20, 2016

Since 12 September I have installed these Windows Updates:
KB2310138 (Microsoft Security Essentials),
KB2553432, KB3118309(Office 2010),
KB3118313 (Outlook 2010),
KB3115467 (PowerPoint 2010),
KB3118316 (Excel 2010),
KB3182373 (Silverlight),
KB3184122, KB3185911, KB3172605, KB3175024 (Win7 x64)
KB3185319 (Internet Explorer 11).
Maybe one of these update repaired that, is that possible?
Today windows started without freeze. I'll check within days if it will freeze again or not.

Strange situation - on my second laptop (Win 7 x64) similar situation appeared few days ago (windows froze on "Welcome" screen and after only 1 reboot worked good - got 1 CBS & SFC total detected corruption count), but from 2 days didn't freeze. This situation was from about 2 weeks now.

Mike P · Sep 21, 2016

The problem repeats. I have to restart computer 4-5 times to start up Windows in Normal Mode. In Safe Mode starts at once.

Event Log shows error at startup:

- Event ID: 7026. The following boot-start or system-start driver(s) failed to load: DtlDrvProtect

- Event ID: 7001. Computer browser service depends server service failed start

With a Cleanboot I could run Windows normal.

Aura · Sep 21, 2016

Follow the instructions below.

MiniToolBox

Download MiniToolBox and move the file to your Desktop;
Right-click on MiniToolBox.exe and select

Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
Check the following options:
- Flush DNS;
- Report IE Proxy Settings;
- Reset IE Proxy Settings;
- Report FF Proxy Settings;
- Reset FF Proxy Settings;
- List content of Hosts;
- List IP Configuration;
- List Winsock Entries;
- List Last 10 Event Viewer Errors;
- List Installed Programs;
- List Devices - Only Problems;
- List Users, Partitions and Memory size;
Once this is done, click on Go and wait for the scan to complete;
Once the scan is complete, a log will open. Please copy/paste the content of the output log in your next reply;

Mike P · Sep 21, 2016

Thanks for reply.
Here you are. Log in attachment.
If you don't know something, let me know and I'll translate.

I have unchecked almost all windows startup services (Nvidia and Intel are only checked) to boot and there is no problem with freezing. One of the services must be the cause of the problem.

Meanwhile I reduced winsxs folder (5GB).

Aura · Sep 22, 2016

Did you ever install a program called "DriveTheLife"? Now it's called Driver Talent.

Mike P · Sep 23, 2016

I can't remember, but rather not. Even if it would be done once.

Aura · Sep 23, 2016

Go in your Device Manager.

Device Manager
Follow the instructions below for your version of Windows to open the Device Manager;

On Windows XP, right-click on My Computer, then go to the Hardware tab and click on Device Manager;
On Windows Vista and Windows 7, open the Windows Start Menu, right-click on Computer and select Properties;
On Windows 8, bring your cursor in the bottom-left corner of the screen, wait for the metro preview to show then right-click on it and select Device Manager;
On Windows 8.1, right-click on the Windows logo in the bottom-left corner of the screen and select Device Manager;
From the System window, click on Device Manager in the left pane;

From there, there should be a device listed under Unknown Devices or else, called DtlDrvProtect. Right-click on it and select Delete.

Mike P · Sep 23, 2016

There is no DtlDrvProtect, only "Other devices":
! external bluetooth devices
! external bluetooth devices
On driver tab -> driver details -> There are no required driver files for this device or files not loaded.

If I delete these two after reboot Windows search drivers again. So this won't help.
If this is a bluetooth driver maybe would be easier to remove it and install new ones but I used to have problems with bluetooth connections earlier?

MTB log found:

1. System errors:
Error: (09/21/2016 02:47:36 PM) (Source: Service Control Manager) (User: )
Description: Usługa HP Network Devices Support ....

2. CodeIntegrity Errors:
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security

3. Installed Programs:
- 64 Bit HP CIO Components Installer (HKLM\...\{BE930E38-7BB3-45B6-85B2-5251F374F844}) (Version: 6.2.2 - Hewlett-Packard) Hidden
- MSVC90_x64 (HKLM\...\{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}) (Version: 1.0.1.2 - Nokia) Hidden
- MSVC90_x86 (HKLM-x32\...\{AF111648-99A1-453E-81DD-80DBBF6DAD0D}) (Version: 1.0.1.2 - Nokia) Hidden

Ad.1, Ad.2 There is no HP (only Brother now)and Kaspersky (license expired and removed) on computer anymore, how can I delete these entries?
Ad.3 Can I delete it (registry entries)?

Aura · Sep 23, 2016

You can uninstall the HP and Nokia programs if you don't need them. You simply need to grab their UninstallString and run it via the Run box. I can help you with that if needed. As for Kaspersky, if you really uninstalled it, you can delete its folder in Program Files (x86).

Also, follow the instructions below please.

Autoruns - Start-up Entries
Follow the instructions below to give me an Autoruns log containing your start-up entries:

Download Autoruns.zip from the Sysinternals Suite webpage;
Extract the content of the Autoruns.zip folder where you want, then go in the folder, right-click on Autoruns.exe and select Run as Administrator;
Accept the EULA on opening, then wait for all the entries to load;
Click on File then Save and save the file to a location easily accessible as a .arn (Autoruns) file;
Upload the file on Dropbox, Google Drive or OneDrive and post the download URL for it here;

Mike P · Sep 26, 2016

Hi Aura,
thanks for your help.
HP, Nokia and Kaspersky - there were all uninstalled by Add/Remove Programs but left junk folders and registry entries. Removed it manually now (not all but most of them, especially not sure about HP entries because there are too many - don't want to remove good entries by mistake).

Autoruns log:

Code:

https://drive.google.com/file/d/0B5FKloh1s2XNZDAzenJCUll0U2M/view?usp=sharing

Now after Autoruns log I see some HP entries remained that wasn't sure to remove.

Aura · Sep 29, 2016

Sorry for the delay. Open a command prompt with Admin Rights, and enter the command below:

Code:

sc remove DtlDrvProtect

Let me know what message is returned.

Mike P · Sep 30, 2016

ERROR: unknown command

[SOLVED] Manifest damage - SFCFix

Active member

Attachments

Sysnative Staff, Security Analyst

Active member

Sysnative Staff, Security Analyst

Active member

Attachments

Sysnative Staff, Security Analyst

Active member

Sysnative Staff, Security Analyst

Active member

Active member

Sysnative Staff, Security Analyst

Active member

Attachments

Sysnative Staff, Security Analyst

Active member

Sysnative Staff, Security Analyst

Active member

Sysnative Staff, Security Analyst

Active member

Sysnative Staff, Security Analyst

Active member