The SWIX64 service failed...

[Bob-II]

I'm seeing this message:

The SWIX64 service failed to start due to the following error:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

If I use SC.exe to lookup the SWIX64 service it points to this file:

c:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys

Searching the Event Viewer logs (Microsoft-Windows-CodeIntegrity/Operational):

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys because the file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

I've uninstalled and re-installed Lenovo System Update twice. It doesn't help, the messages continue.

Anyone seen this recently? (since about late Dec 2016)

Thanks,

Bob

Note - this was originally posted in another forum on forums.lenovo.com, I moved it here, where it makes more sense.

[Bob-II]

Further info:

Lenovo T410

Win 7 SP1-64

Lenovo SU version: 5.07.0045

tvsuhd64.sys file version: 6.1.7600.16385

[richk]

what are you using for antivirus?

From an administrative command prompt, run "SFC /SCANNOW"

[Bob-II]

Windows Defender

Client version: 6.1.7600.16385

Engine version: 1.1.13407.0

Database version: 1.235.1974.0

SFC /scannow from C:\ ( admin prompt) = 100% verified

Just running a full scan with WD (the one I ran last week returned zip, but who knows?)

[richk]

I have never seen this issue and I still sometimes set machines up with windows 7.  When you uninstalled system update, did you have it remove all files?

[Bob-II]

I uninstalled via the control panel link. If it left remanents I don't know.

I ran another uninstall. Checked the SU folders. Clean and all gone. Downloaded a 'fresh' copy from lenovo.com and installed. Install was clean with no errors. Did a reboot for the hell of it. Back into Win 7 and ran SU. It ran clean and downloaded 3 updates. I hid all 3 - don't want these ones. Closed the program.

When I opened Event Viewer the SWIX64 msg was there again.

Ran Regedit at an Admin prompt and searched for SWIX64. The entry (ImagePath) is present with a \??\ in front of the path to tvsuhd64.sys.

Even with this error SU seems to run fine. It downloads and installs updates. For some reason Win 7 thinks the file signature is incorrect. This might be a place to start looking for the problem. Find where Win stores the signatures and update the one for tvsuhd64.sys? Time for more reading.

Thanks for your help.

[Bob-II]

The Windows Defender 'full' scan came back clean.

I got a copy of Sys Internals SigChecker. I'm going to run it against tvsuhd64.sys and see what happens.

The next place to look is the Win 7 store for file hashes. Could be the 'store' file(s) is corrupt or the hash in the store is corrupt (or old, say it never got updated with the recent SU re-installs <- can this even happen?).

This isn't a pressing issue. Lenovo SU seems to function okay. I'd just like to clear the errors from Event Viewer.

Thanks again for your help. I'll post updates here as I find them (if I find them).

[richk]

Clearing event log messages is never fun.  From time to time, I try, but there are usually a couple that I cannot get rid of, finally I give up.

[xarx2]

I've got the exactly same problem with my T510, Win7 x64. I suspect the problem was introduced with Lenovo System Update 5.07.0042, because it started almost immediately after (automatic) update from 5.07.0037. Unfortunately, I cannot return to the version 5.07.0037 because it immediately asks for update and 5.07.0045 is installed then again.

There was no Windows Update before the errors started to occur.

Here is a compressed log from the Windows Event Viewer and Windows Update, the Security Audit Failures and SWIX64 errors had not occurred before 10th January:

(Previous MsiInstaller record on 2016-12-15, .NET)

2017-01-05 23:15:23 Error: System Update service terminated unexpectedly

2017-01-05 23:15:27 MsiInstaller: {25C64847-B900-48AD-A164-1B4F9B774650} (Lenovo System Update)

2017-01-05 23:15:41 ApplicationError: uncsetting.exe (Lenovo System Update, Exception code: 0xe0434352)

2017-01-06 10:00:28 MsiInstaller: Lenovo System Update 5.07.0037 -> 5.07.0042

2017-01-10 8:06:02 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-10 8:06:02 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-12 3:03 Windows Update: KB3212646 (Jan 2017 Security Monthly Quality Rollup for Win7 x64)

2017-01-12 18:10 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-13 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-14 10:03:58 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-14 10:03:58 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-17 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-21 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-21 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-23 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-23 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-25 9:15 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-01-14 9:15:23 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-01-25 9:29-9:30 MsiInstaller: jre1.8.0_121 (Java)

2017-01-25 9:44 MsiInstaller: Flash Player

2017-01-25 10:18-10:21 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (4x)

2017-01-14 10:18-10:21 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.) (2x)

2017-01-28 ApplicationError: LSC.ModulesController.Proxy.exe (Lenovo Control Center, version: 3.3.4.101, Exception code: 0xe0434352)

2017-01-30 20:45:39 MsiInstaller: {25C64847-B900-48AD-A164-1B4F9B774650} (Lenovo System Update)

2017-01-30 20:45:55 ApplicationError: uncsetting.exe (Lenovo System Update, Exception code: 0xe0434352)

2017-01-30 23:19:30 MsiInstaller: Lenovo System Update 5.07.0042 -> 5.07.0045

2017-02-01 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-02-01 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-02-03 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-02-03 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-02-04 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-02-04 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-02-07 Security Audit Failure: Program Files (x86)\Lenovo\System Update\tvsuhd64.sys (2x)

2017-02-07 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.)

2017-02-11 Error: SWIX64 service failed to start (Windows cannot verify the digital signature for this file.) (3x)

(Later MsiInstaller record on 2017-02-03, Avira antivirus)

Best regards,

              Martin.

[Bob-II]

Hi Martin,

I looked back through my EV logs for the first appearance of this event. It started on Dec 23, 2016.

SU is working ok so far, but the messages continue. Hmmm.

There's also a thread at:

https://forum.thinkpads.com/viewtopic.php?f=43&t=122721

The Dec 23 EV log entry:

Log Name: Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
Source: Microsoft-Windows-Application-Experience
Date: 12/23/2016 12:46:54 PM
Event ID: 102
Task Category: None
Level: Information
Keywords:
User: ws3\Bob
Computer: ws3
Description:
The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below.

Driver: System Information Detector
Service: SWIX64
Publisher: Lenovo Group Limited
Location: C:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys
Version: 6.1.7600.16385

-- snip --