Add/Remove Program has black vert. lines

noahdfear,

I have no idea what "Internet Explorer Default Page" is. The entry, in Add/Remove, right after the black lines is Shockwave. A quick search on my system finds both Shockwave 8 and 10. I will remove both and see what happens. This is the log from the last time sfc seemed to work:

Warning 3/27/2005 11:44:36 PM Browser None 8021 N/A KIDSDELL
Information 3/27/2005 10:23:50 PM Tcpip None 4201 N/A KIDSDELL
Information 3/27/2005 10:23:50 PM bcm4sbxp None 9 N/A KIDSDELL
Warning 3/27/2005 10:23:48 PM bcm4sbxp None 4 N/A KIDSDELL
Warning 3/27/2005 5:23:51 PM Tcpip None 4226 N/A KIDSDELL
Information 3/27/2005 1:51:48 PM Tcpip None 4201 N/A KIDSDELL
Information 3/27/2005 1:51:48 PM bcm4sbxp None 9 N/A KIDSDELL
Warning 3/27/2005 1:51:46 PM bcm4sbxp None 4 N/A KIDSDELL
Information 3/27/2005 11:44:18 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:43:43 AM bcm4sbxp None 9 N/A KIDSDELL
Information 3/27/2005 11:44:12 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:12 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:12 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:12 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:12 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 Mike KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:11 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:07 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:07 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:07 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7035 SYSTEM KIDSDELL
Information 3/27/2005 11:44:06 AM Service Control Manager None 7036 N/A KIDSDELL
Information 3/27/2005 11:43:46 AM eventlog None 6005 N/A KIDSDELL
Information 3/27/2005 11:43:46 AM eventlog None 6009 N/A KIDSDELL
Information 3/27/2005 2:13:01 AM eventlog None 6006 N/A KIDSDELL
Information 3/27/2005 1:03:45 AM Tcpip None 4201 N/A KIDSDELL
Information 3/27/2005 1:03:45 AM bcm4sbxp None 9 N/A KIDSDELL
Warning 3/27/2005 1:03:44 AM bcm4sbxp None 4 N/A KIDSDELL
Error 3/27/2005 12:02:49 AM DCOM None 10010 Mike KIDSDELL


Thanks!
Mike

 

Shockwave uninstalled with no change. I rebooted, no change. I installed newest version, no change. Sounds like a broken record, huh?

 

Mike,

We need to look specifically at the entries for Windows File Protection and what files were replaced.

I also recommend ruling out virus/malware as valid7 suggested with an online scan or two.

RAV
Trend Micro

And a download and scan with either MWAV and/or Ewido Security Suite wouldn't hurt a bit either.

 

noahdfear,

I ran the scans that you suggested along with Norton's, Panda ActiveScan, and Ad-Aware. Found was the Trilon.A trojan in file C:\Windows\System32\netia32.dll. None of the scans could fix the trojan. Can I safely delete this? I hesitate when it comes to the Windows folder.

As far as the files that were replaced by WFP, I'll need a little guidance on that. The first entries for WFP aren't until 4-16-05. This is well after the first sfc attempt that cleared things up for awhile.

Thanks!

Mike

 

Hi Mike,

Yes, you can safely delete that file. Search also for netia32.inf and delete it too.
That file shouldn't be causing the sort of problem you're experiencing, but I'm not saying it isn't and you sure don't want it anyway. That file has also been associated with these recent Zipzappromos infections, which usually causes popups and reportedly dials out to a 'diego garcia' at a cost of 3.99 to connect and 1.49 a minute for dialup users. Unsure as of yet just what it's doing while connected. I would suspect you'd be experiencing popups if your machine was infected, but just to make sure, because the responsible files and run entries are hidden and undetectable otherwise, please download GetLogXP.zip. Save it to your desktop. If it saves as attachment.php, right click and rename to GetLogXP.zip You may need to enable viewing extensions for known file types to see the zip and php extensions. To do that, open My Computer and click Tools on the menu, then folder options. Click the view tab of the window that opens, uncheck the box to Hide extensions...... and click OK. Now right click the zip and extract the GetLogXP.bat file to your desktop. Double click the file to run it. It will open GetLogXP.txt and place a copy on your desktop. Post the contents of that log. May take more than one post.

As an after thought, I'd like to see a HijackThis log too, but I'd prefer to keep this thread in the XP forum at this point, so post it and the GetLogXP logs in a new thread in the Security>Removing Spyware and Viruses forum.

Darnit.....those event logs push out the older ones and there's a good chance by now even the WFP entries from the 24th are gone To view the info, just double click the WFP entries. Clicking the button directly below the up/down arrows will copy the event information to the clipboard so you can then right click and paste, in a reply here or to notepad for saving/posting later. If you like, just post all of the WFP entries you have and we'll have a look at them.

 

noahdfear,

I deleted the dll file but could not find the netia32.inf file. I don't think that I am infected since I have no popup problems on this system. That's a plus! I have downloaded and ran the two programs that you suggested. The GetLogXP thread can be found here. The highjackthis log can be found here.

I will post the WFP entries shortly. Thanks for your continued help!

Mike

 

noahdfear,

My Event Viewer has entries back to 2-24. The first WFP entries are on 4-16. Here are the details it shows (leaving out the line about "for more information ":

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 4/16/2005
Time: 9:28:36 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan was started.
____________________________________________________

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/16/2005
Time: 9:28:57 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/16/2005
Time: 9:28:59 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/16/2005
Time: 9:29:00 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/16/2005
Time: 9:29:02 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/16/2005
Time: 9:29:02 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_________________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/16/2005
Time: 9:29:04 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/16/2005
Time: 9:37:44 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\ntvdmd.dll has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.1560.
________________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/16/2005
Time: 9:37:45 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\ntvdmd.dll has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.0.
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 4/16/2005
Time: 9:42:40 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan completed successfully.
_____________________________________________________________

WFP entries on 4-23

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 4/23/2005
Time: 5:18:09 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan was started.
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/23/2005
Time: 5:18:41 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
________________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/23/2005
Time: 5:18:44 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_________________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/23/2005
Time: 5:18:44 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_________________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/23/2005
Time: 5:18:45 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/23/2005
Time: 5:18:45 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/23/2005
Time: 5:18:45 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/23/2005
Time: 5:18:45 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
________________________________________________________________

WFP entries on 4-24

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 4/24/2005
Time: 12:11:30 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan was started.
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/24/2005
Time: 12:12:01 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/24/2005
Time: 12:12:02 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/24/2005
Time: 12:12:05 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/24/2005
Time: 12:12:06 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/24/2005
Time: 12:12:06 PM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/24/2005
Time: 12:12:06 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/24/2005
Time: 12:12:06 PM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_______________________________________________________________

Last entries for WFP are on 4-25

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 4/25/2005
Time: 9:41:57 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan was started.
____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/25/2005
Time: 9:42:26 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/25/2005
Time: 9:42:28 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/25/2005
Time: 9:42:29 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/25/2005
Time: 9:42:30 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/25/2005
Time: 9:42:30 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
______________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/25/2005
Time: 9:42:30 AM
User: N/A
Computer: KIDSDELL
Description:
The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject.].
_____________________________________________________________
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 4/25/2005
Time: 9:56:39 AM
User: N/A
Computer: KIDSDELL
Description:
Windows File Protection file scan completed successfully.
_______________________________________________________________

As you can see, it's the same things everytime I run SFC. Any thoughts on the entries?

Mike

 

OK, no help cleaning things up. I did notice that RecordNow is on an uninstall key, which falls between RealPlayer and Shockwave and should probably show in Add/Remove. From what I gathered, the black lines begin under RealPlayer and end before Shockwave. Do you see RecordNow in there? Might want to uninstall/reinstall it. If it's not listed in A/R, you can look for the uninstall string value in the registry at the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RecordNow.exe key, click modify on the entry and then right click copy. Just close the modify window then regedit and click Start>run and right click/paste, hit enter. If you need assistance with that, let us know. We can get the string from an export without you diving into the registry (don't know if you're comfortable there or not).

 

noahdfear,

I found RecordNow (listed as Sonic RecondNow in A/R) and uninstalled it. No need to go to the registry, although I am comfortable doing that. After removing, I checked A/R, no change. I ran SFC, no change. I get the same entries that I posted above. I ran chkdisk and defrag, then reinstalled the Sonic software. You guessed it, no change. This is a stubborn little problem, isn't it? Any other thoughts?

Mike

 

I'm just as stumped as I was from the get-go ..........but not giving up yet
If you don't mind, export the uninstall key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

then post and/or zip it and mail it to me, with WindowsBBS in the subject line. It will have much more information about the installed programs, and maybe I or someone will see something fishy. A list of what all you see in A/R might be helpful to compare with, but not sure the best way to get that. Screenshots maybe?? (I'd kinda like to see these lines anyway)

Is the Add/Remove list the only display problem you've noticed?

Very odd that the three oembios files are replaced every time you run SFC. Think some digging around Dell may be in order.

 

noahdfear,

I appreciate your continued help! Everyone needs a good challenge, right? Considering the length of the Uninstall key, and trying to save some web space here, I have zipped and posted the key and screenshots here. This also gives others an opportunity to look at them. Please notice the scroll bar on the side, in the A/R pages. You can really see just how much space is taken up by the black lines. You'd think I had a couple thousand programs listed. I would have posted the full pictures on the site, but I'm running out of web space. Hopefully, they come out okay. If not, let me know.

The A/R is the only program that I've noticed display problems with. I have also thought about contacting Dell about the oembios file and will now give that a try. Thanks and let me know what you think.

Mike

 

Hi Mike,

Haven't had time to research the oembios thing as of yet, but I did take a few to look through the uninstall log. Still have a hunch the problem is with RecordNow, and I'll explain, then suggest what I'd like for you to try.

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RecordNow.exe
Class Name: <NO CLASS>
Last Write Time: 5/2/2005 - 12:33 PM
Value 0
Name: UninstallString
Type: REG_SZ
Data: C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}



Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9541FED0-327F-4DF0-8B96-EF57EF622F19}
Class Name: <NO CLASS>
Last Write Time: 5/2/2005 - 12:33 PM

Value 14
Name: UninstallString
Type: REG_EXPAND_SZ
Data: MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}

Value 22
Name: DisplayName
Type: REG_SZ
Data: Sonic RecordNow!


What I see in the log is two uninstall keys for RecordNow, both with the same unistall string. One, the latter, shows up in Add/Remove just as the DisplayName shows......Sonic RecordNow!
The first, RecordNow.exe, shows up in the log just after Real Player and just before SchedulingAgent, Sevinst and SGTRAY.EXE, which are entries hidden to A/R, and finally followed by Shockwave. That would correspond to the problem section of Add/Remove. I believe that RecordNow.exe key is the problem. I recommend you again uninstall RecordNow, then delete both the RecordNow.exe and {9541FED0-327F-4DF0-8B96-EF57EF622F19} keys, then run a registry cleaner and remove any entries related to the program. Reboot and check Add/Remove.
I'm not going to get my hopes up though, simply because it may well be that installing that program is supposed to create both of those keys, which the Last Write Time for each suggests. That said, I'll look at the log some more too. With fingers crossed..............

 

noahdfear,

Sorry, no luck. I did hear back from Dell regarding the oembios. Their response included two Microsoft links for A/R problems, both dealing with Win 2000. Here and here. Beyond that, they suggest a repair of Win XP. I not ready for that. I can live with the problem before I do that.

Mike

 

I know what you mean, Mike. Re-installing is not usually something I look forward to either.

Not a bad idea to apply some of the info from at least the second link, Add/Remove Programs dialog box does not appear or is corrupted, to your machine. Start with checking the file version of Mshtml.dll in C:\Windows\system32. If running SP2 and up-to-date with Windows Update, you should have version 6.0.2900.2627

If that's the version you have, unregister then re-register it.

Start>run and paste in;

regsvr32 /u c:\windows\system32\mshtml.dll

then hit enter. Then;

regsvr32 c:\windows\system32\mshtml.dll

Also do;

regsvr32 /u c:\windows\system32\appwiz.cpl
regsvr32 c:\windows\system32\appwiz.cpl

If no help, we'll try the IE Repair and go from there.
regsvr32 /u "c:\program files\common files\system\ole db\oledb32.dll " .....should be version 2.81.1117.0
regsvr32 "c:\program files\common files\system\ole db\oledb32.dll "

 

I checked my version and it was 6.0.2900.2627, so I proceeded with your next suggestion. After entering the first string and hitting enter, I received the following message:

DllUnregisterServer in c:\windows\system32\mshtml.dll failed.
Return code was: 0x8000ffff

Any thoughts? I will be out of town until Monday, but I will try your suggestions when I return. As always, thanks and have a great weekend.

Mike

 

Not sure what to tell you about that error, Mike. I got the exact same error trying to unregister that dll, and tried on my account as well as Admin, within Windows and in safe mode. Even checked the permissions per the MS link. It will however, register fine. Just skip the first command and let us know what happens after doing all the other commands and rebooting.

 

noahdfear,

Sorry for the delay, but I'm back in town again. I tried the first few commands that you gave me. I rebooted and found that nothing had changed. I started on the IE repair and thought I would look at the version number of the oledb32.dll file. Although the correct file version shows, I also have two of these files. Am I suppose to? Here is the info on each:

File 1) created on 10-27-03, modified on 8-4-04, size is 476kb
File 2) created on 8-29-02, modified on 8-4-04, size is 64kb

I will run those commands if you still want me to, but I wasn't sure about having two of them.

Mike

 

Hi Mike,

Double check those filenames. Should be oledb32.dll @ 476KB and oledb32r.dll @ 64KB.

 

noahdfear,

Oops. My mistake. I guess I was hoping too bad that that was the problem. I tried the two commands and there is no change. Any chance I can copy the Control Panel file from my working XP system and paste it to the system with problems? Probably won't help, but I thought I would ask.

Mike

 

You can certainly try that, but I hesitate to guess what the result might be. As a test, I did a search of my computer for appwiz.cpl, which resulted in 9 files found (multibooting and other OS cab files extracted to a storage partition for reference). Of those, 1 is a Win 98 file @ 71KB, 1 a Win ME @ 78KB, 3 XP Pro and 3 XP Home, located in \\windows\system32, \\windows\servicepackfiles\I386 and \\windows\$NTServicePackuninstall$, with the $NTServicePackuninstall$ file being 546KB and the others being 537KB

While running in XP Pro, I can double click any one of those files and open the Add/Remove applet. The 98 and ME files open the applet in the 98 and ME style. All will properly list the programs installed on this Pro installation. The list from the $NTServicePackuninstall$ file differs from the others in that it lists many updates and hotfixes.

I'd say, try opening your copy from the $NTServicePackuninstall$ folder first, then the I386 folder. Then copy the file from your other comp to your desktop, and open it from there.