add/remove programs not working

Discussion in 'Malware Help (A Specialist Will Reply)' started by yanqui, Mar 5, 2008.

  1. yanqui

    yanqui Private E-2

    I checked existing threads and none of them apply here. When I open Add/Remove programs, it begins to populate, but then I get an error message. The exact wording is as follows:

    "Run a DLL as an app has encountered a problem and needs to close..."blah, blah;

    It doesn't happen every time. And it doesn't always happen at the same stage of the remove, but mostly now at the end when I'm closing it.

    But as I was writing this, to see if I could give any more error message wordings, I haven't been able to reproduce it. It may be fixed from the "before you post try this" efforts. But here are the logs anyway, and, no, i cannot update to the latest java because some of the things we use at work don't work on the latest java, and the payoff is too high with regard to being able to remotely administer some things.

    Oh, and one more thing--combofix forgot to change my time back to 12-hour time.
     

    Attached Files:

    Last edited: Mar 5, 2008
  2. abri

    abri MajorGeek

    Hi yanqui,
    Welcome to Major Geeks!


    1) Please disable your guest account if this has not already been done.


    2) Open your Windows Live Messenger, go to Help -> Customer Experience Improvement Program and turn it off. That will stop you getting all the sqm files.


    3) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger

    4) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab


    Optionally fix the following if they are not related to programs you installed or need.

    O4 - HKCU\..\Run: [Photozig Albums Media Detector] C:\Program Files\Photozig Albums\pzAlbumsDetect.exe
    O16 - DPF: {21F16767-8DA7-4113-BEB0-F161B313407F} (XMirage Control) - http://www.myfamily.com/plugins/ue/Install_UE.exe
    O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://216.231.165.211/support/files/activeXViewer/activexviewer.cab

    After you click fix, just close hijackthis.

    5) Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    [/quote]

    6) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
    • Click the Empty Selected button.
      • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main ATF Cleaner menu to close the program.


    7) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Avenger log.


    Let me know how things are running now?

    abri
     
  3. yanqui

    yanqui Private E-2

    I can't find the manage attachments button. Did I turn that off?

    I don't have a guest account, actually I don't have any "accounts" set up. I think I had already turned off Customer Experience IMprovement or whatever, some time before. I couldn't find the Photozig thing; I want to keep the my family and the Crystal Reports items.
     
  4. abri

    abri MajorGeek

    Hi Yanqui,
    When you click on Post Reply here, normally if you scroll down there's a Manage Attachments button down below the box where you write your message. There are sometimes problems with attachments here, so please try it again and see if it works. Be sure to click on the Remember Me button when you first log on to Major Geeks.
    abri
     
  5. yanqui

    yanqui Private E-2

    It's in Firefox that the button doesn't show up. In IE it works fine, but I didn't know that. So here are the attachments. Also, my clock is still on 24-hour time; would running combofix again fix that?

    and thanks for all your time and effort.

    So far the computer itself is running well, but that dll as app thing is a pain.
     

    Attached Files:

  6. abri

    abri MajorGeek

    Hi yanqui,

    You should be able to set your clock back to the time you want by going to Start / Control Panel / Regional and Language. On the Regional Options tab click the Customize button then on the next form click the Time tab. Then change the Time format to what you want. It explains there what the lower case and upper case letters will do. Upper case H is giving you 24 hour clock settings.

    As for your original problem, is the following exactly what the error says?

    "Run a DLL as an app has encountered a problem and needs to close..."

    abri
     
  7. yanqui

    yanqui Private E-2

    Got the clock fixed; never would have looked there, thanks!

    The error box starts as you suggested, and then when I click OK or CLOSE or whatever, I get teh following:
    in the dialog box title box, RUNDLL.
    text of message, exactly this:

    An exception occurred while trying to run "C:\windows\system32\shell32.dll,Control_RunDLL "C:\windows\system32\appwiz.cpl", Add or Remove Programs"

    the only difference between what I see and what I typed here is that windows is all caps. I've googled and googled and found several ideas but cannot come up with something that actually fixes it.
     
  8. abri

    abri MajorGeek

    Hi yanqui,

    The problem you're having is a software problem, and I will probably direct you to the Software Forum to get help repairing the file. However, I would like to give you some information about it first. Please read all the way through it to see if you understand it or have any questions before you proceed.

    This is the short version from Tutorials-Win.com:
    Try clicking start and run. Type in appwiz.cpl and click ok. If you get the
    same error you should go to "C:\WINDOWS\system32" and rename appwiz.cpl to
    something else. Then either expand appwiz.cpl from your xp disk or download
    it online somewhere and replace it. Then try it again.

    This is a longer version from Wes - MS MVP at http://forums.techarena.in/showthread.php?t=581395

    appwiz.cpl is Add or Remove Programs.

    Start | Run | Type: appwiz.cpl | Click OK

    Still get the error?

    appwiz.cpl is in %windir%\system32 and is the one that is normally used.

    %windir%\system32 is usually C:\WINDOWS\system32.

    If you still get the error, do a Search on your machine for appwiz.cpl

    See this for...
    HOW TO: Search For Hidden Or System Files In Windows XP
    http://support.microsoft.com/kb/302347

    Try double clicking any other appwiz.cpl files that are found and see if
    they work.

    There are more things to try.

    P.S. RunDll32.exe is what runs .cpl files and .dll files.

    ***************************************

    Thanks Wesley for your advice. I followed it and came up with three search
    hits using advanced options. One is in C:\WINDOWS\$NtServicePackUninstall$,
    one is in C:\WINDOWS\system32 and the third is in
    C:\WINDOWS\ServicePackFiles\i386. When I doubled clicked any of them I got a
    rundll error message. When I right click on them and select "Open with
    Control Panel" I get the same rundll error message.

    ****************************************

    You can try expanding a new appwiz.cpl from your XP CD.

    Open a Command Prompt...
    Start | Run | Type: cmd | Click OK

    Insert your XP CD into your CD drive and enter (Copy and Paste) the
    following command:

    expand d:\i386\appwiz.cp_ %windir%\system32\appwiz.cpl

    Hit your ENTER key.

    NOTE :
    Change d to = your CD drive letter if different than D:

    If you have to, use the CD from the laptop (from another computer)

    ****************************************

    Let me know if any of this helps.
    abri
     
  9. yanqui

    yanqui Private E-2

    I appreciate your help and I did understand all of that. I've tried running it from a command line and got the same error. I sent myself a copy of the file from another machine and replaced the appwiz.cpl, and still got the same error. So I thought that maybe there was a bad program that was keeping the application from running. I haven't tried restoring the file from a disk because it's hard to get my hands on a copy of XP home. My computer was pre-built so I have a restore disk, not an installation disk. I may have a disk somewhere I can use, if I can find it (we recently moved so a lot of stuff hasn't surfaced yet. I guess I'll keep trying, and thanks for your help.

    edit: I replaced the file again and was actually able to uninstall about five or six programs before it finally gave me the message, but it was just the first message, not the long box I referenced in my last post. the technical data contains a lot of dll's and I wonder if I just went through that list and re-registered all those dll's I might come up wiht something.
     
    Last edited: Mar 9, 2008
  10. abri

    abri MajorGeek

    Hi yanqui,
    I'm glad to hear you made some progress. As for your question about re-registering the dll's, I would like to ask you to post about this problem in the Software Forum mentioning not only the errors you've gotten, but what you've tried and this most recent progress. When you move this topic to the Software Forum, more people will be able to give you advice and I think you'll find the help you need more quickly. They will be able to answer your question about re-registering the drivers as well.
    abri
     
  11. yanqui

    yanqui Private E-2

    Good advice, thanks for teh help. Otherwise, did the scans look good?
     
  12. abri

    abri MajorGeek

    Hi yanqui,
    The logs look okay otherwise. Please run the final cleanup instructions:
    abri
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds