guard64.dll- hashes of an image file are not valid

6882 on Windows 10 gets this error also.

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume2\Windows\System32\guard64.dll

Also see this event:

Microsoft-Windows-Security-Mitigations/KernelMode Process '\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome Beta\Application\chrome.exe' (PID 10540) was blocked from loading the non-Microsoft-signed binary '\Windows\System32\guard64.dll'.

Full Event:

- - 12 0 3 6 0 0x8000000000000000 234861 Microsoft-Windows-Security-Mitigations/KernelMode - 85 \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome Beta\Application\chrome.exe 512 "C:\Program Files (x86)\Google\Chrome Beta\Application\chrome.exe" --type=renderer --field-trial-handle=1668,5339440160561480337,4635973246286476559,131072 --disable-features=AutofillUpstream,FileHandlingAPI,GenericSensorExtraClasses,OmniboxExperimentalKeywordMode,SystemKeyboardLock,WebBluetoothNewPermissionsBackend,WebContentsForceDark,WebPaymentsExperimentalFeatures,WebRtcHideLocalIpsWithMdns,WebRtcRemoteEventLog,WebShare,WebXRIncubations --lang=en-US --disable-client-side-phishing-detection --device-scal 4748 2021-02-11T09:08:57.170496300Z 236157505460240986 8 8 0 11060 2021-02-11T09:08:57.170498100Z 8 4 29 \Windows\System32\guard64.dll

It is a bit sloppy of Comodo and Windows notices it but the guard54.dll still gets loaded and CIS functions as intended.

It is a bit sloppy but there is no security or other issue. CIS works stable and as intended.

Hi All,

guard64.dll is used to check other injections. It is expected behavior, such error can appear in this process and is not an issue.

1 Like

I had these alerts more recently, specifically when launching Edge but it turned out to be related to the exploit protection tweaks I’d made via windows app & browser control.

Hello

When I look in Windows event observer, I have a lot of entries concerning guard64.dll : hash problem. Code integrity found that the image of the file is not valid.

Can you tell me where it comes from ?

Thank you for your responses.

The bad image error is something you can ignore. It has been around since 2009. Futuretech explains it briefly here:

Windows will notice there is no hash provided as it would like see. It is not a security issue nor does it effect functioning. But it is sloppy Comodo does not fix this. You can safely disregard these events being logged.

I just realized this is the issue that has been affecting my system for the past 7 months, I just chose to ignore it until today. When this happens, my system locks up, I can see the HDD (SSD) light full lit up for about 30 seconds - anything I’m doing is frozen (gaming, browsing, typing, etc.). Only today I decided sift through Event Viewer to see the file “guard64.dll” associated with several Audit Failure and Audit Success events for that entire minute.

Based on what I read in this thread, I’m less fearful of a compromised system however as I mentioned, it’s super annoying having the system lock up every day, sometimes a couple times a day. Is there no solution for this?

Hi MajorPayne,

Thank you for reporting, we will check this and get back to you.

Thanks
C.O.M.O.D.O RT

Hi MajorPayne,

Could you please check your inbox for Pm ? and respond.

Thanks
C.O.M.O.D.O RT

Sorry but your issue has nothing to do with the event logs for guard dll as it would not cause freezing.

Understood. Even after reinstalling Comodo, this system is still randomly locking up, so I’ll probably just wipe it and reinstall the O/S.

I have read the prior responses to this thread informing readers that this is not a problem, however something has changed to make it a problem.

Some time in the past week I started getting a pop-up when booting the system before I got to log in. The title is:

[b]AvLaunch.exe - Bad Image[/b]

In the body of the pop-up the icon left of the message body is a red circle with a white X.

The message in the body is:

C:\Windows\system32\guard64.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status: 0xc000002.

Upon browsing the system event log Applications and Services Logs\Microsoft\Windows\CodeIntegrity\Operational I find a pair of messages that repeat approximately twice a minute. The first message of each pair is an Error:

- System
  • Provider

[ Name] Microsoft-Windows-CodeIntegrity
[ Guid] {4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}
EventID 3004
Version 1
Level 2
Task 1
Opcode 104
Keywords 0x8000000000000000

  • TimeCreated
    [ SystemTime] 2022-08-02T15:12:21.4334493Z
    EventRecordID 87934

  • Correlation
    [ ActivityID] {aa3123f9-a5a9-0004-705d-42aaa9a5d801}

  • Execution
    [ ProcessID] 21084
    [ ThreadID] 26112
    Channel Microsoft-Windows-CodeIntegrity/Operational
    Computer <>
    Security

  • EventData

    FileNameLength 52
    FileNameBuffer \Device\HarddiskVolume4\Windows\System32\guard64.dll
    SecureRequired 0x80000000
    RequestedSigningLevel 12
    ProcessNameLength 49
    ProcessNameBuffer \Device\HarddiskVolume4\Windows\System32\upfc.exe

The second message of each pair is Information:

- System
  • Provider
    [ Name] Microsoft-Windows-CodeIntegrity
    [ Guid] {4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}
    EventID 3089
    Version 2
    Level 4
    Task 1
    Opcode 130
    Keywords 0x8000000000000000

  • TimeCreated
    [ SystemTime] 2022-08-02T15:12:21.4334515Z
    EventRecordID 87935

  • Correlation
    [ ActivityID] {aa3123f9-a5a9-0004-705d-42aaa9a5d801}

  • Execution
    [ ProcessID] 21084
    [ ThreadID] 26112
    Channel Microsoft-Windows-CodeIntegrity/Operational
    Computer <>
    Security

  • EventData

    TotalSignatureCount 1
    Signature 0
    CacheState 0
    Hash Size 32
    Hash 46525CA8C5A1EA4EABDB6E09C561E16E1F8A644DFE58A5DF410B4F61EC7995E6
    PageHash false
    SignatureType 1
    ValidatedSigningLevel 4
    VerificationError 7
    Flags 0
    PolicyBits 8
    NotValidBefore 2018-12-04T00:00:00.0000000Z
    NotValidAfter 2021-12-03T23:59:59.0000000Z
    PublisherNameLength 31
    PublisherName Comodo Security Solutions, Inc.
    IssuerNameLength 46
    IssuerName COMODO RSA Extended Validation Code Signing CA
    PublisherTBSHashSize 32
    PublisherTBSHash C6DCBA6192A502EB4E7CAEBEA466BE00C8ABBF2269740FAA6156A5341BA0A2BE
    IssuerTBSHashSize 48
    IssuerTBSHash FCD8DD15125F14B84FEC55838806355EC3787407188BAC83C2C0D6C841ADF9AC76EE83ECCC5C9463F1F88FC5295A31EE

In browsing the properties of this file I observe that the signing certificate expired 12/3/2021. I would provide certificate details but Microsoft has disabled text cut/paste on the certificate window and the certificate export function only supports binary and character-encoded binary formats.

This long lasting issue is not listed on the “Bug List” so it seems to be no real problem.

Hi rw53,

Sorry for the inconvenience.
Kindly provide the below detail:

  1. CIS version
  2. Win version along with system bit type
  3. Any software except CIS/OS involved? If so - name, & exact version.
  4. Are you using Avast antivirus along with CIS ? or Is there anyother security product installed on your machine along with CIS?
  5. Any other information, eg your guess at the cause, how you tried to fix it etc.
  6. Any related screenshot.

Thanks
C.O.M.O.D.O RT

From post #79,

Install comodo firewall on another pc. The first time an error occurred. I tried [b]SFC[/b], DISM, and installed all VC++ 2005~2019 Event log errors stop increasing after removing the comodo firewall

It is my understanding that sfc checks system files for integrity, and replaces with good files if any bad ones found.
So, would that not cause problems for Comodo if Comodo’s purpose built guard64.dll is replaced with standard system dll, ie make it (comodo) a bit of a NOP,
or at least cause some other problem.

So, I would suggest that the audit failure could be cause of a bit more than a cosmetic / no effect type mischief maker.

EDIT: Does the audit failure disappear after sfc is run ?, if so then does that neuter CIS, or cause the problems that others have described ?
It is often suggested that sfc [system file checker] is used (command line as Admin) where OS is having problems [where it is at least possible that comodo will get broken too].

EDIT: By the way, in comodo Support menu [above About], there is a Diagnostics option to try detect and repair the comodo installion,
it is a good idea to try this with internet access where it seem to try download any broken files [or at least report the problems found],
it sometimes says “problems were found but could not be fixed”, quite often a second try at diagnosts says “no problems found” (try 2nd Diagnostics after a re-boot).

What Audit Failure looks like in Windows Event Log [Click Me, TWICE]

https://i.postimg.cc/Gh31L1p2/Audit-Failure.jpg

Someone suggested in reply to me that I provide more details, especially if I were running Avast. In fact, I am running avast (antivirus only, not their firewall which I believe is inferior to Comodo w/resp. to my needs and desires), and it was avast that was generating this message and disabling that dll. I discovered this by searching for the file named in the error box margin and reading its properties. I tried whitelisting the Comodo dll in Avast to no avail, but shortly thereafter the problem went away and I removed the file path from the Avast whitelist. Everything is fine now.

I suspect that Avast was blocking Comodo. If so, and if this was deliberate I believe it was a very unethical business practice on the part of Avast. Someone at Avast must have realized this and fixed it.

I suspect that Avast was blocking Comodo. If so, and if this was deliberate I believe it was a very unethical business practice on the part of Avast. Someone at Avast must have realized this and fixed it.
More likely that Avast detected the audit failure and disabled guard64.dll because of this [and later became aware that it was part of Comodo, perhaps became aware due to your attempt to whitelist it].

So its a fake file to act as bait for virus injection?