Windows 10: Since Update KB4480966; d2d1.dll a Trojan?

Could well be a false positive, but..


HitmanPro results:
C:\Windows\SysWOW64\d2d1.dll Malware ( > Bitdefender . . . : Trojan.Agent.DNAY)
C:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.17134.523_none_93af86c5e6560604\d2d1.dll -> Quarantined


Initially it attempted to repair the file, but appears to have failed. Tried sfc scannow and DISM /Online /Cleanup-Image /CheckHealth, but need help in understanding the results. For example, sfc mentions the "/OFFLOGFILE flag" and I have no idea what that means. DISM reports "The component store is repairable.", yet there's no clue as to how to repair it.






Any help much appreciated. Thank you.

:)

 

d2d1.dll not working


Hi, I have been having some troubles starting programs because of an error with d2d1.dll. The programs crash on startup with the error 'd2d1.dll is either not designed to run on Windows or it contains an error'. I have tried SFC /scannow and it says there are corrupt files that need repairing but it fails to do so. I looked at the logs and it seems to be d2d1.dll as well as memory diagnostics tool. I have also tried replacing the file but it won't let me in system 32 as its being used by other programs or processors. How do I resolve this as it's affecting multiple applications. Thanks.

 

d2d1.dll and KB4015438

I'm not able to open Windows live mail and Photo because it says "windows\system32\d2d1.dll is either not designed to run or contains an error" error code 0xc000012f

I ran the sfc /scannow and below are some of the results. This issue started after the KB4015438 updated. I have tried to remove this update and it wont remove

2017-03-30 21:12:10, Info CSI 000048a1 [SR] Cannot repair member file [l:8]'d2d1.dll' of Microsoft-Windows-D2D, version 10.0.14393.693, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, file is missing

2017-03-30 21:12:10, Info CSI 000048a2 [SR] This component was referenced by [l:80]'Package_1638_for_KB4015438~31bf3856ad364e35~amd64~~10.0.1.2.4015438-3521_neutral'

2017-03-30 21:12:10, Info CSI 000048a3 Hashes for file member \??\C:\WINDOWS\SysWOW64\d2d1.dll do not match actual file [l:8]'d2d1.dll' :

Found: {l:32 nDWZqC01RY+QaXGSqs/CjqC40Y70viX5/VfHCm+NSJM=} Expected: {l:32 LKZid2j/Z8beHJK5N7VPj+VCK8sRLhGn2jm1herqbj4=}

2017-03-30 21:12:10, Info CSI 000048a4 [SR] Could not reproject corrupted file \??\C:\WINDOWS\SysWOW64\d2d1.dll; source file in store is also corrupted

 

10.0.10586.306 version of d2d1.dll problem

At my place of work we customize images by booting to Audit mode, installing everything, sysprepping/generalizing, then uploading the resulting .wim to Windows Deployment Services. We then PXE boot machines and they install the image from Windows Deployment
Services.

Fine. The process works great.

Ever since the May 2016 updates, the process has stopped working during the installation from Windows Deployment Services part. During Windows installation/setup, the process gets to the "Getting files ready for installation..." part and errors out with
the Error Code 0x80070570.

If I check the setupact.log, there seems like two files causing this error:

Oart.dll from KB3115084

and

d2d1.dll from KB3156421

This is the error in the log from the d2d1.dll specific error, but, the oart.dll file produces the same type of error:

2016-05-18 14:54:09, Info [0x0606cc] IBS Calling WIMApplyImage (flags = 0x180)...

[1004] [UncompressFile1116) -> file corrupted in block at offset 000002020C6C2040] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ResExtract472)

[1004] [ResExtract474) -> UncompressFile failed] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004]

[1004] [UncompressFile1116) -> file corrupted in block at offset 000002020C6C2040] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ResExtract472)

[1004] [ResExtract474) -> UncompressFile failed] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004]

[1004] [UncompressFile1116) -> file corrupted in block at offset 000002020C6C2040] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ResExtract472)

[1004] [ResExtract474) -> UncompressFile failed] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004]

[1004] [UncompressFile1116) -> file corrupted in block at offset 000002020C6C2040] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ResExtract472)

[1004] [ResExtract474) -> UncompressFile failed] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004]

[1004] [UncompressFile1116) -> file corrupted in block at offset 000002020C6C2040] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ResExtract472)

[1004] [ResExtract474) -> UncompressFile failed] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] RestoreFileData2804)

[1004] RestoreFileData2831)

[1004] RestoreFileDataCallback1810)

2016-05-18 15:01:01, Error [0x0600af] IBS ApplyWIMCallback: Error applying E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll. GLE [1392][gle=0x00000570]

[1004] E:\Windows\WinSxS\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.10586.306_none_1f298dcdef350641\d2d1.dll (Error = 1392)

[1004] ProcessWimQueueNode96)

[1004] DequeueWimData304)

[1004] ImageWorkerThread203)

[1004] GetImageErrorCode2833)

[1004] RestoreFileNodeList1936)

[1004] RestoreFilesCallback3638)

[1004] EnumImageDataEntries1047)

[1004] RestoreAllData985)

[1004] WIMApplyImageInternal704)

2016-05-18 15:01:01, Error [0x0606cc] IBS WIMApplyImage failed; hr = 0x80070570[gle=0x00000570]

2016-05-18 15:01:01, Error [0x0600a1] IBS DeployImage:Image application failed; hr = 0x80070570[gle=0x00000057]

2016-05-18 15:01:01, Error [0x060082] IBS Callback_ImageTransfer:Failed to lay down the OS image; hr = 0x80070570[gle=0x00000057]

2016-05-18 15:01:01, Info IBSLIB PublishCriticalError: Publishing critical error message [Windows cannot install required files. The file may be corrupt or missing. Make sure all files required for installation are available, and restart the
installation. Error code: 0x80070570]

Is anyone else seeing this?

Is there something wrong with these files?