False Positives: Drivers from working computer copied over still showing as "unsigned drivers" by sigverif

Question

I tried installing an old game from the disc (Bet on Soldier). It said it would not work on my OS, only XP and 95, but I went ahead anyway.

After install it required a restart. It could not boot until I disabled driver signature enforcement.

I remembered a similar thing happened a while back when I tried to play the demo of the game, so I'm pretty sure the game's installer is making a bad change to a Windows file somewhere, probably with an out-of-date driver signature.

I ran sigverif and it found three unsigned drivers in c:\windows\system32\

msvcp110.dll

msvcr110.dll

vccorlib110.dll

However, the date modified for each of those files was not today, but several years ago (5/11/2012), so it seems unlikely. I followed all the procedures I could find on these forums:

1. I ran sfc /scannow. It repaired one file: mscormmc.dll. Edit: Also tried DISM /online /cleanup-image /checkhealth and it reported no corruption detected, and completed successfully:

Version 10.0.17763.1

Image Version: 10.0.17763.379

No component store corruption detected.

The operation completed successfully.

2. Downloaded Visual Studio Redistributable 2017 (Edit: Also tried with the 2012 version) and tried repairing, and tried uninstalling then installing again. Made no difference.
3. Copied the specific dll files from my partner's computer (also running up-to-date Windows 10) and using them to replace my versions of those three dll's. Still sigverif finds them to be unsigned. Ran sigverif on my partner's computer and it finds no signature problems with any of her files.

This suggests to me that it has nothing to do with these three dll's, but is actually a reference problem - I think these dll's have the correct signature, and whatever signature database sigverif is checking against has been altered or corrupted and no longer has the correct signatures in its database for these three dll's. Next I tried:

4. I ran cmd as admin, used takeown /f on each of the files, and tried "regsvr32 msvcp110.dll" for each of them, and received this error:

"The module "c:\windows\system32\msvcp110.dll" was loaded but the entry-point DllRegisterServer was not found.

Make sure that "C:\windows\system32\msvcp110.dll" is a valid DLL or OCX file and then try again."

5. Just to see what would happen, I deleted these three dll's and ran sigverif, and it still reported that these were unsigned, but now it listed their date modified as "Unknown" and their version as "None" in the dialog box. I tried deleting another random dll from that directory to see if sigverif would show the same error whenever a dll was missing, but it didn't. It still only found a problem with those three dll's.

So where/how does sigverif or Windows check the driver signatures? Is there a local database on the computer?

I'm guessing it might have something to do with HKEY_LOCAL_MACHINE\Software\Microsoft\Driver Signing registry key. Is there a way I can get Windows to refresh/verify/update this?

Or any other ideas on how to solve this?

Answer 1

Solved: Turns out that game used StarForce Protection for DRM, and the old version it installed had some files that Windows didn't like (probably out of date signatures), such as "sfvfs02.sys" and "sfsync02.sys", both found in "C:\Windows\System32\drivers".

The company that made the DRM offers two possible solutions: Update the old version of StarForce Protection, or Remove:

star-force.com/support/drivers

Of course, I opted to download and run the removal tool, which deleted the problematic drivers from "C:\Windows\System32\drivers", and now my Windows installation boots up and runs just fine. So as I suspected, it was ultimately a simple fix. It just took a while to find it.

Anyone looking to do this, just remember that if you remove StarForce Protection without uninstalling the program that was using it, that program will not work or will automatically reinstall the old, problematic version of StarForce Protection. So maybe try updating instead, and if that doesn't work, then remove and uninstall the DRM-protected program.

Hope this helps someone else in future (maybe future me).

Answer 2

I forgot to mention: I did try the 2012 version as well. I tried it again now for good measure - tried repairing, no change, tried uninstalling and reinstalling, but still no change.

Answer 3

Thank you for the suggestion. Tried to do a repair in place, but at the end of that lengthy process it rebooted and said "Undoing changes to Windows", and once again, could only get it to boot by disabling driver signature enforcement, and when it did boot, the Windows installer program reported that it:

"...couldn't install windows 10

0xC1900101 - 0x40017

The installation failed in the SECOND_BOOT phase with an error during BOOT operation"

Just for thoroughness, I ran sigverif and it actually confirmed all driver signatures were verified - it found no problem. Which is perplexing because A) It presumably should have undone all of the changes it did during the attempted repair, and B) It still won't boot unless driver signature enforcement is disabled, even though apparently all the driver signatures are verified.

Following the suggestions I found online, I unplugged all devices except mouse and keyboard, did a clean boot, disabled third party anti-virus and tried repairing Windows in place again, but same result. Then tried unchecking the update option when repairing, and unplugging my ethernet cable for the repair process (following other suggestions online). Still the exact same result.

Reran sigverif, sfc /scannow, and dism, and all three reported no problems. But still repair in place fails and it won't boot unless I disable driver signature enforcement.

Answer 4

Hi,

The msvcp110.dll, msvcr110.dll and vccorlib110.dll may be installed with the Operating System so you could try a "repair install" of Windows 10 - as a general precaution back up any critical files beforehand:

https://www.tenforums.com/tutorials/16397-repai...

Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Answer 5

Hi Inicus

The files, msvcp110.dll, msvcr110.dll and vccorlib110.dll, are code libraries, not drivers and are all part of the 2012 version of that Visual C++ redistributable and not contained in any other version of that, you should try installing that version to see if that resolves this for you . . .

https://www.microsoft.com/en-au/download/confir...