Please run windows update your system is lacking critical sha 2 code october 2020
Please run windows update your system is lacking critical sha 2 code october 2020
Обновления для Windows (обсуждение и решение проблем)
Твердотельные накопители (SSD) по понятным причинам не подвержены внешним воздействиям, однако последние годы рынок наводнили дешевые SSD сомнительного качества. Если HDD выходят из строя в силу своей механической природы, то бюджетные SSD страдают от перегрева, некачественной флэш-памяти, кривых прошивок (firmware) и т.д. Разумеется, при прочих равных SSD гораздо надежнее HDD, однако если вы понятия не имеете накопитель какой фирмы и с какими характеристиками установлен в вашем компьютере (ноутбуке, планшете), то не стоит сбрасывать его со счетов.
Таким образом, в любом случае необходимо проверить целостность файловой системы, а также целостность самих файлов на системном разделе. Делается это с помощью команды ChkDsk C: /f /r (в командной строке от имени Администратора; для начала проверки потребуется перезагрузить компьютер). Если какие-то файлы повреждены или отсутствуют, то соответствующие записи о них будут удалены из файловой таблицы. Ознакомиться с результатами проверки можно в журнале системы. Для этого кликните правой кнопкой на Компьютере > Управление. Далее выбираем Просмотр событий > Журналы Windows > Приложение. Там вас интересует событие с кодом 1001.
Примечание: на механических накопителях (HDD) полная проверка системного раздела может занять несколько часов.
Примечание для пользователей Windows 7: удостоверьтесь, что у вас установлено KB2966583, прежде чем выполнять эту команду.
Примечание для пользователей Windows 8, 8.1, 10: если ScanHealth показал наличие каких-либо проблем, но сообщает о возможности исправления, то выполните DISM /Online /Cleanup-Image /RestoreHealth (пользователи Windows 7 могут не беспокоиться, у них ключ ScanHealth совмещает в себе обе эти команды).
С учетом того, что установка обновлений связана с активным использованием CPU, RAM, HDD \ SSD, лучше подстраховаться и проверить температуру своего железного друга. Утилит для мониторинга температур существует великое множество, однако далеко не все они умеют создавать искусственную нагрузку. А именно температуры под нагрузкой и надо смотреть, поскольку в состоянии покоя частоты существенно ниже номинальных и даже наглухо забитая система охлаждения справится с отводом тепла. Наиболее удобным можно считать стресс-тест из состава AIDA64, который позволяет нагрузить все компоненты компьютера, однако вы можете использовать любое другое ПО для тестирования и мониторинга температур.
Тема по обсуждению охлаждения компьютера находится здесь.
В Windows XP эта фишка называлась «Восстановление системы», в Windows 7 и выше ее переименовали в «Защиту системы», но суть ее осталась той же: сохраняются предыдущие версии файлов, что позволяет вернуть систему к рабочему состоянию (не всегда, но часто). Проверить настройки «Защиты системы» можно, открыв свойства Компьютера. Проверьте, чтобы «Защита системы» была включена и работала корректно (создайте сами контрольную точку и посмотрите что из этого получится). Там же можно настроить количество свободного места, которое будет отдано под контрольные точки. За переполнение диска можете не беспокоиться. В случае превышения заданного лимита будет автоматически удалена самая старая контрольная точка при создании новой.
Пользователям Windows 10 настоятельно рекомендуется проверить также функцию автоматического бэкапа реестра и включить ее, если она отключена!
На портале Microsoft Docs (это хранилище документации Майкрософт для пользователей, разработчиков и ИТ-специалистов) в разделе «Manage connections from Windows 10 operating system components to Microsoft services» есть пошаговая инструкция по отключению обновлений в Windows 10. Прокрутите текст вниз, почти до самого до самого конца, вам нужна секция №29 (Windows Update).
KB3179573 пробейте, что за обновление. По наблюдениям оно затормаживает вкл/выключение ноутбука, но это не точно.
И KB3172605 туда же.
2019 SHA-2 Code Signing Support requirement for Windows and WSUS
Summary
To help protect the security of the Windows operating system, updates were previously signed (using both the SHA-1 and SHA-2 hash algorithms). The signatures are used to authenticate that the updates come directly from Microsoft and were not tampered with during delivery. Because of weaknesses in the SHA-1 algorithm and to align to industry standards, we have changed the signing of Windows updates to use the more secure SHA-2 algorithm exclusively. This change was done in phases starting in April 2019 through September 2019 to allow for smooth migration (see the «Product update schedule» section for more details on the changes).
Customers who run legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) are required to have SHA-2 code signing support installed on their devices to install updates released on or after July 2019. Any devices without SHA-2 support will not be able to install Windows updates on or after July 2019. To help prepare you for this change, we released support for SHA-2 signing in starting March 2019 and have made incremental improvements. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to securely deliver SHA-2 signed updates. Please see the «Product update schedule» section for the SHA-2 only migration timeline.
Background details
The Secure Hash Algorithm 1 (SHA-1) was developed as an irreversible hashing function and is widely used as a part of code-signing. Unfortunately, the security of the SHA-1 hash algorithm has become less secure over time because of the weaknesses found in the algorithm, increased processor performance, and the advent of cloud computing. Stronger alternatives such as the Secure Hash Algorithm 2 (SHA-2) are now strongly preferred as they do not experience the same issues. For more information about of the deprecation of SHA-1, see Hash and Signature Algorithms.
Product update schedule
Starting in early 2019, the migration process to SHA-2 support began in stages, and support will be delivered in standalone updates. Microsoft is targeting the following schedule to offer SHA-2 support. Please note that the following timeline is subject to change. We will continue to update this page as needed.
Stand Alone security updates KB4474419 and KB4490628 released to introduce SHA-2 code sign support.
Windows 7 SP1
Windows Server 2008 R2 SP1
Stand Alone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.
Stand Alone update, KB4493730 that introduce SHA-2 code sign support for the servicing stack (SSU) was released as a security update.
Windows Server 2008 SP2
Stand Alone security update KB4474419 released to introduce SHA-2 code sign support.
Windows Server 2008 SP2
Stand Alone security update KB4474419re-released to add missing MSI SHA-2 code sign support.
Windows Server 2008 SP2
Windows 10 updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only. No customer action required.
Windows 10, version 1709
Windows 10, version 1803
Windows 10, version 1809
Windows Server 2019
Required: For those customers using WSUS 3.0 SP2, KB4484071 must be manually installed by this date to support SHA-2 updates.
Required: Updates for legacy Windows versions will require that SHA-2 code signing support be installed. The support released in April and May (KB4493730 and KB4474419) will be required in order to continue to receive updates on these versions of Windows.
All legacy Windows updates signatures changed from SHA1 and dual signed (SHA-1/SHA-2) to SHA-2 only at this time.
Windows Server 2008 SP2
Windows 10 updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only. No customer action required.
Windows 10, version 1507
Windows 10, version 1607
Windows Server 2016
Windows 10, version 1703
Required: Updates for legacy Windows versions will require that SHA-2 code signing support be installed. The support released in March (KB4474419 and KB4490628) will be required in order to continue to receive updates on these versions of Windows. If you have a device or VM using EFI boot, please see the FAQ section for additional steps to prevent an issue in which your device may not start.
All legacy Windows updates signatures changed from SHA-1 and dual signed (SHA-1/SHA-2) to SHA-2 only at this time.
Windows 7 SP1
Windows Server 2008 R2 SP1
Legacy Windows update signatures changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required.
Windows Server 2012
Windows 8.1
Windows Server 2012 R2
Stand Alone security update KB4474419 was re-released to add missing EFI boot mangers. Please make sure that this version is installed.
Windows 7 SP1
Windows Server 2008 R2 SP1
Windows Server 2008 SP2
Signatures on the Certificate Trust Lists (CTLs) for the Microsoft Trusted Root Program changed from dual-signed (SHA-1/SHA-2) to SHA-2 only. No customer action required.
All supported Windows platforms
Windows Update SHA-1 based service endpoints are discontinued. This only impacts older Windows devices which have not updated with appropriate security updates. For more information, see KB4569557.
Windows 7
Windows 7 SP1
Windows Server 2008
Windows Server 2008 SP2
Windows Server 2008 R2
Windows Server 2008 R2 SP1
Microsoft retired content that is Windows-signed for Secure Hash Algorithm 1 (SHA-1) from the Microsoft Download Center. For more information, see the Windows IT pro blog SHA-1 Windows content to be retired August 3, 2020.
Windows Server 2000
Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8
Windows Server 2012
Windows 8.1
Windows Server 2012 R2
Windows 10
Windows 10 Server
Current status
Windows 7 SP1 and Windows Server 2008 R2 SP1
The following required updates must be installed and then the device restarted before installing any update released August 13, 2019 or later. The required updates can be installed in any order and do not need to be reinstalled, unless there is a new version of the required update.
Servicing stack update (SSU) (KB4490628). If you use Windows Update, the required SSU will be offered to you automatically.
SHA-2 update (KB4474419) released September 10, 2019. If you use Windows Update, the required SHA-2 update will be offered to you automatically.
Important You must restart your device after installing all the required updates, before installing any Monthly Rollup, Security-only update, Preview of Monthly Rollup, or standalone update.
Windows Server 2008 SP2
The following updates must be installed and then the device restarted before installing any Rollup released September 10, 2019 or later. The required updates can be installed in any order and do not need to be reinstalled, unless there is a new version of the required update.
Servicing stack update (SSU) (KB4493730). If you use Windows Update, the required SSU update will be offered to you automatically.
The latest SHA-2 update (KB4474419) released September 10, 2019. If you use Windows Update, the required SHA-2 update will be offered to you automatically.
Important You must restart your device after installing all the required updates, before installing any Monthly Rollup, Security-only update, Preview of Monthly Rollup, or standalone update.
Frequently Ask Questions
General information, planning and issue prevention
The SHA-2 code-signing support was shipped early to ensure that most customers would have the support well in advance of Microsoft’s change to SHA-2 signing for updates to these systems. The stand-alone updates include some additional fixes and are being made available to ensure that all of the SHA-2 updates are in a small number of easily identifiable updates. Microsoft recommends that customers that maintain system images for these OSes to apply these updates to the images.
Starting with WSUS 4.0 on Windows Server 2012, WSUS already supports SHA-2-signed updates, and no customer action is needed for these versions.
Only WSUS 3.0 SP2 needs KB4484071installed to support SHA2 only signed updates.
Assume you run Windows Server 2008 SP2. If you dual-boot with Windows Server 2008 R2 SP1/Windows 7 SP1, the boot manager for this type of system is from the Windows Server 2008 R2/Windows 7 system. In order to successfully update both of these systems to use SHA-2 support, you must first update the Windows Server 2008 R2/Windows 7 system so that the boot manager is updated to the version that supports SHA-2. Then, update the Windows Server 2008 SP2 system with SHA-2 support.
Similar to the dual-boot scenario, the Windows 7 PE environment must be updated to SHA-2 support. Then, the Windows Server 2008 SP2 system must be updated to SHA-2 support.
Run Windows setup to completion and boot into Windows prior to installing August 13, 2019 or later updates
Open an administrator command prompt window, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
Before installing any additional updates, install the August 13, 2019 re-release of KB4474419 and KB4490628 for Windows 7 SP1 and Windows Server 2008 R2 SP1.
Restart the operating system. This restart is required
Install any remaining updates.
Install the image on the disk and boot into Windows.
At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
Before installing any additional updates, install the September 23, 2019 re-release of KB4474419 and KB4490628 for Windows 7 SP1 and Windows Server 2008 R2 SP1.
Restart the operating system. This restart is required
Install any remaining updates.
Yes, you will need to install the required updates before proceeding: SSU (KB4490628) and SHA-2 update (KB4474419). Also, you are required to restart your device after installing the required updates before installing any further updates.
Windows 10, version 1903 supports SHA-2 since it’s release and all updates are already SHA-2 only signed. There is no action needed for this version of Windows.
Windows 7 SP1 and Windows Server 2008 R2 SP1
Boot into Windows prior to installing any August 13, 2019 or later updates.
Before installing any additional updates, install the September 23, 2019 re-release of KB4474419 and KB4490628for Windows 7 SP1 and Windows Server 2008 R2 SP1.
Restart the operating system. This restart is required
Install any remaining updates.
Windows Server 2008 SP2
Boot into Windows prior to installing any July 9, 2019 or later updates.
Before installing any additional updates, install the September 23, 2019 re-release of KB4474419 and KB4493730 for Windows Server 2008 SP2.
Restart the operating system. This restart is required
Install any remaining updates.
Issue recovery
If you are seeing error 0xc0000428 with the message “Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.” please follow these steps to recover.
Start the operating system using recovery media.
Before installing any additional updates, install update KB4474419 that is dated September 23, 2019 or a later date using Deployment Image Servicing and Management (DISM) for Windows 7 SP1 and Windows Server 2008 R2 SP1.
At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
Restart the operating system.
Halt deployment to other devices and do not restart any devices or VMs that have not already restarted.
Identify devices and VMs in restart pending state with updates released August 13, 2019 or later and open an elevated command prompt
Find the package identity for the update you want to remove by using the following command using the KB number for that update (replace 4512506 with the KB number you are targeting, if it is not the Monthly rollup released August 13, 2019): dism /online /get-packages | findstr 4512506
Use the following command to remove the update, replacing
with what was found in the previous command: Dism.exe /online /remove-package /packagename:
You will now need to install the required updates listed in the How to get this update section of the update you are trying to install, or the required updates listed above in the Current status section of this article.
Note Any device or VM you are currently receiving an error 0xc0000428 or that is starting into the recovery environment, you will need to follow the steps in the FAQ question for error 0xc0000428.
If you encounter these errors, you need to install the required updates listed in the How to get this update section of the update you are trying to install, or the required updates listed above in the Current status section of this article.
If you are seeing error 0xc0000428 with the message “Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.” please follow these steps to recover.
Start the operating system using recovery media.
Install the latest SHA-2 update (KB4474419) released on or after August 13, 2019, using Deployment Image Servicing and Management (DISM) for Windows 7 SP1 and Windows Server 2008 R2 SP1.
Reboot into the recovery media. This restart is required
At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
Restart the operating system.
If you encounter this issue, you can mitigate this issue by opening a command prompt window and run the following command to install the update (replace the placeholder with the actual location and file name of the update):
This issue is resolved in KB4474419 released October 8, 2019. This update will install automatically from Windows Update and Windows Server Update Services (WSUS). If you need to install this update manually, you will need to use the workaround above.
Note If you previously installed KB4474419 released September 23, 2019, then you already have the latest version of this update and do not need to reinstall.
[PC] How to Resolve Most Easy Anti-Cheat Errors
Easy Anti-Cheat is the name of the anti-cheat service used for Vermintide 2. This article contains the most commonly produced Easy Anti-Cheat errors, and how to resolve them.
Contents
Easy Anti-Cheat Is Not Installed
Easy Anti-Cheat can be installed or repaired using the EasyAntiCheat_Setup executable located in the Vermintide 2 ‘installers’ directory. The path to this directory on your PC will be similar to this:
C:\Program Files (x86)\Steam\steamapps\common\Warhammer Vermintide 2\installers\EasyAntiCheat
Game Security Violation Detected (#0000000D) [LightingService.exe]
The LightingService executable belongs to a program called ASUS Aura Sync, which is considered suspicious by Easy Anti-Cheat due to it’s use of an old, exploitable driver. This consequently results in the ‘Game Security Violation Detected (#0000000D) [LightingService.exe]’ error.
We recommend that you disable ASUS Aura Sync via the Windows Task Manager prior to launching Vermintide 2.
Access is Denied
This error has been known to occur when a player has an RGB controller such as ASUS Aura Sync or RGB Fusion running on their PC. These are considered to be suspicious by Easy Anti-Cheat due to their use of old, exploitable drivers and may produce the error above.
We recommend that you disable any RGB controllers via the Windows Task Manager prior to launching Vermintide 2.
Error Code: 23
This error indicates missing dependencies such as DirectX, GPU drivers, Windows updates, Visual C++ Redistributables. We recommend that you run through the solutions listed below:
Error: Copy Failed With 32
This error indicates something on your PC is blocking the Easy Anti-Cheat service from performing one of it’s operations. In most cases, an Anti-Virus or similar program is responsible.
Please ensure the appropriate Anti-Virus and Firewall exceptions are in place for both Vermintide 2 and the Easy Anti-Cheat service.
A ‘Selective Startup’ can also help diagnose whether a background application is resulting in your issue. This can be performed by:
If the error no longer persists after having performed the Selective Startup, you will need to re-enable each of your usual background applications one-by-one until the error reoccurs, to determine which is interfering with Easy Anti-Cheat.
Additionally, please check that the Easy Anti-Cheat service is enabled by:
Error Code: 30004 (Unexpected Error. (WaitForSingleObject Failed: 2))
This error indicates that your current Windows installation is in a corrupted state. We recommend that you run through the solutions listed below:
Error Code: 30005 (CreateFile Failed with 32.)
This error indicates something on your PC is blocking the Easy Anti-Cheat service from performing one of it’s operations. In most cases, an Anti-Virus or similar program is responsible.
Please ensure the appropriate Anti-Virus and Firewall exceptions are in place for both Vermintide 2 and the Easy Anti-Cheat service.
A ‘Selective Startup’ can also help diagnose whether a background application is resulting in your issue. This can be performed by:
If the error no longer persists after having performed the Selective Startup, you will need to re-enable each of your usual background applications one-by-one until the error reoccurs, to determine which is interfering with Easy Anti-Cheat.
Additionally, please check that the Easy Anti-Cheat service is enabled by:
Error Code: 30005 (CreateService Failed with 1072.)
This error indicates something on your PC is blocking the Easy Anti-Cheat service from performing one of it’s operations. In most cases, an Anti-Virus or similar program is responsible.
Please ensure the appropriate Anti-Virus and Firewall exceptions are in place for both Vermintide 2 and the Easy Anti-Cheat service.
A ‘Selective Startup’ can also help diagnose whether a background application is resulting in your issue. This can be performed by:
If the error no longer persists after having performed the Selective Startup, you will need to re-enable each of your usual background applications one-by-one until the error reoccurs, to determine which is interfering with Easy Anti-Cheat.
Additionally, please check that the Easy Anti-Cheat service is enabled by:
Error Code: 30005 (StartService Failed with 1450.)
This error indicates that your version of Windows is not up-to-date. This is most common with Windows 7, but is possible with other versions.
Please ensure you have the latest updates for Windows installed.
(0xC0020015)
This error indicates something on your PC is blocking the Easy Anti-Cheat service from performing one of it’s operations. In most cases, an Anti-Virus or similar program is responsible.
Please ensure the appropriate Anti-Virus and Firewall exceptions are in place for both Vermintide 2 and the Easy Anti-Cheat service.
It should be noted that SpyBot is a common culprit for this error. Disabling or removing SpyBot should immediately resolve this issue.
A ‘Selective Startup’ can also help diagnose whether a background application is resulting in your issue. This can be performed by:
If the error no longer persists after having performed the Selective Startup, you will need to re-enable each of your usual background applications one-by-one until the error reoccurs, to determine which is interfering with Easy Anti-Cheat.
Unknown File Version (vermintide.exe)
This error is usually isolated to those using BullGuard Anti-Virus.
Choosing to add the Vermintide 2 directory as an exception should immediately resolve this issue, and can be done by:
Untrusted System File
Please note: For those with ‘Untrusted System File’ errors referencing the wldap32 or nvd3dumx DLLs, please see the sections underneath instead.
This error occurs when a DLL on your PC has become corrupted and is consequently considered to be «untrusted» by Easy Anti-Cheat. We recommend that you run through the solutions below:
Untrusted System File: C:\Windows\System32\wldap32.dll
This error occurs when the wldap32 DLL on your PC has become corrupted and is consequently considered to be «untrusted» by Easy Anti-Cheat. We recommend that you run through the solutions below:
Untrusted System File: C:\Windows\System32\nvd3dumx.dll
This error occurs for Windows 7 users with NVIDIA GPUs specifically, and would have appeared after the most recent NVIDIA driver update.
This error is due to changes in how Microsoft handles drivers, and means the Windows 7 updates below must be installed to ensure compatibility:
No Game Executable Entry Was Found in the Catalogue. (Vermintide2.exe)
This error is usually isolated to those using BullGuard Anti-Virus.
Choosing to add the Vermintide 2 directory as an exception should immediately resolve this issue, and can be done by: