A future version of Dial-a-fix will support Internet Explorer 8 by ignoring those unregisterable components.

© DjLizard for DjLizard.net, 2008. | Permalink | 5 comments | Add to del.icio.us
Post tags:

Feed enhanced by Better Feed from Ozh

(Update: see the comments for a possible explanation. Short version: just run the same parts of Dial-a-fix again and you shouldn't get the error. If you still have trouble with Windows Updates, try clicking "Flush SoftwareDistribution".)

© DjLizard for DjLizard.net, 2007. | Permalink | 2 comments | Add to del.icio.us
Post tags: Dial-a-fix, Fixes, MSXML, unspecified error

Feed enhanced by Better Feed from Ozh

Thanks to astute reader Nate Coffey and Dial-a-fix, we've found another DLL registration bug.

The current version of wuaueng.dll provided to Windows 2000 service pack 4 clients has a bug in its DllInstallServer.

In the first picture is a "before" screenshot that shows that all of the SvcHost key values are here. This is a freshly installed Windows 2000 machine that only has Service Pack 4:

In this second picture, I have visited Windows Update, gotten the latest Windows Update client, closed my browser, and then unregistered the DLL using regsvr32 /u:

In this third picture, I have re-registered the DLL using regsvr32 /i, but it caused an error (0×80070057) and only one key was put back. The netsvcs key is lost at this point. In order to fix this, merge this default SvcHost key .reg file.

The error code 0×80070057 is E_INVALIDARG, or invalid parameters/arguments.

The current version of Dial-a-fix will accidentally trigger this because of the malformed DllInstallServer in wuaueng.dll. Once a new, fixed version of the Windows Update client is pushed out, Dial-a-fix will be able to help you again. I'll be filing this as a bug with Microsoft – I hope they fix it.

Edit: be sure to read Superfail part 2 for the solution for afflicted machines.

© DjLizard for DjLizard.net, 2007. | Permalink | 8 comments | Add to del.icio.us
Post tags: Fixes, Incompetence, Windows 2000, Windows Update, wuaueng.dll

Feed enhanced by Better Feed from Ozh

That was ridiculously easy to remove using RogueRemover and Spybot, but neither were able to find the odd infection left behind:

If you search your drives for folders called 'bak' you may find backup copies of executables from several popular software packages such as Adobe (several products), Nero, Apple (iTunes and Quicktime), Incredimail, Realplayer, Java, and even Norton Antivirus. If you move the contents of each bak folder to its parent directory and overwrite, the infection is gone. Thanks, stupid virus, for making backup copies before infecting files.

The best way to find these folders is like this:
Start > Run > cmd.exe (to get a command prompt)
dir /a /b /s bak

You'll get a list of affected applications. Go into each 'bak' folder and move whatever is in there one level up.

cd bak
move *.* ..

(yes you want to overwrite)

Thanks, WinBudget, or whatever the fuck you are.

Edit: I also found out that WinBudget sticks one or more entries in Internet Explorer's trusted zone list. One is called whataboutadog (dot com) and one is whataboutarabit (sic) (dot com).

© DjLizard for DjLizard.net, 2007. | Permalink | 10 comments | Add to del.icio.us
Post tags: RogueRemover, Spybot Search and Destroy, Spyware

Feed enhanced by Better Feed from Ozh

I decided to create another user as a test and I found out that the new user could double click just fine, so that means the problem probably lies in HKEY_CURRENT_USER. It was immediately obvious:

HKEY_CURRENT_USER
Control Panel
Mouse

DoubleClickHeight and DoubleClickWidth were blank. Not 0, but blank. Why were they blank?! The system was heavily infected but I don't see why a virus/spyware object would set this. Maybe they thought it was funny. I sure didn't. I tried everything else before figuring this out.

(I think) this means that every double click is counted as an accidental double click because these settings seem to control how far apart your double clicks can be before it counts as a drag. If you set it really high (and your double click rate is really low) you can drag an icon all the way across the screen and click again and it will cancel the drag and activate the object!

Also, why are these REG_SZ instead of REG_DWORD? Is there some point to it being a string?

After I fixed this problem, I went over to a co-worker's machine and blanked out the values.

…

© DjLizard for DjLizard.net, 2007. | Permalink | 4 comments | Add to del.icio.us
Post tags: Weird

Feed enhanced by Better Feed from Ozh

Don't forget about FREE Dial-a-fix support at Lunarsoft.net! Even if I'm too busy to be around, the regulars there know Dial-a-fix better than anyone and can definitely lead you in the right direction. Also, they'll help you with general computer/tech support problems too, not just with Dial-a-fix.

© DjLizard for DjLizard.net, 2007. | Permalink | 4 comments | Add to del.icio.us
Post tags: anti-spyware, Symantec

Feed enhanced by Better Feed from Ozh

Most technicians are familiar with the issue where optical drives disappear from My Computer, only to be found in Device Manager with an exclamation point on them, indicating a problem.

Most technicians also have no idea what filter drivers are, or how this can happen, so I'm here to explain this and show you the proper way to repair a driver whose filter chain is broken.

I've noticed that most people completely blast all of the filter drivers away until it works, and although that works, it's really not the best way to go about things, especially since the other filters might be working properly. Also, don't you want to know the why and the how? This problem can apply to more than just optical drives.

Background information

A filter driver intercepts requests/communication in order to extend or replace functionality in the driver or hardware that it is filtering. There are three types of filter that you should know about: bus filter drivers, upper filter drivers, and lower filter drivers.

A bus filter driver extends functionality (usually for proprietary features) on a bus driver, such as ACPI. An ACPI filter driver, for example, could add additional power management modes or communicate with proprietary modifications to ACPI (such as in laptops).

An upper filter driver filters data between the main driver and the application/operating system service. Microsoft's example: a keyboard filter driver could perform additional security checks before passing the data along to the application or OS/module that is receiving the data.

A lower filter driver filters data between the hardware itself and the main driver, providing extra security/stability or translating proprietary communication into a standard language for the main driver. A good example of this is when you press a button on a piece of hardware: you may have only pressed the button once, but internally, the button may have made electrical contact repeatedly within mere milliseconds, sending more than one signal when only one was intended. A filter driver can recognize that this isn't intended behavior, and can refine the data to expected specifications (it turns multiple contacts into the intended 1 contact). This way, the main driver receives a stream of cleaned/stable data, and from the end user's perspective, everything is OK. Since hardware is physical and anything can go wrong, filter drivers are quite necessary for operating system sanity.

There are two ways to install a filter driver in Windows: at the class level, and at the device level. If you install a keyboard class filter driver, EVERY keyboard you ever install will be filtered by it. If you only install it on the device level (which is done by unique device ID), then it will only filter the exact device that you put it on originally and all other devices, even in the same class, will be unaffected.

Troubleshooting

Here's the part everyone is really reading this for. How do you know when you have a filter driver problem, and how do you properly solve it?

If you go into Device Manager and see a device with an exclamation point on it (CD-ROM or not) you should not immediately try to remove and refresh it. Double-click the device so you can see the error code. If it's anything other than "the drivers aren't installed for this device", then you should click the Details tab.

Pull down the drop-down box on the Details tab and look at the following four items:

• Device Upper Filters
• Device Lower Filters
• Class Upper Filters
• Class Lower Filters

In each of these sections, there may be zero or more items. Note the name of each item in each section. They are all drivers, so they should be in %systemroot%\System32\Drivers with a .sys extension. If you investigate your CD-ROM drive's filter drivers and notice GEARAspiWDM (for example), then you should find a corresponding GEARAspiWDM.sys file in the %systemroot%\System32\Drivers folder. If you don't find a corresponding file, then you've found a broken driver chain. Your next course of action is to either find the .sys file and put it in System32\Drivers and reboot, or remove the registry entry and reboot. In most cases you'll just be removing the registry entry that is pointing to a non-existent driver.

How does this happen? If you uninstall iTunes (for instance) then it will remove the GEARAspiWDM.sys file and its filter driver entry from the registry. If you then System Restore to a date prior to this uninstallation, it may or may not put back the .sys file but it will definitely put back the registry entry, and thus the filter chain will be broken. This can happen with any device, as all are capable of hosting filter drivers above or below the main driver. Again, this is not exclusive to that well-known CD-ROM drive problem.

Removing the registry entry

If the missing file came from either of the two "Class" filter categories, drill-down in Regedit to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class. Hit CTRL+F and type the entry as you saw it in Device Manager (i.e., "GEARAspiWDM" — without the .sys part) and try to find it. It should quickly bring you directly to the Upper or Lower filters value that contains this driver's reference. Double click the value that it was found in (in the right-hand pane of Regedit), and remove just the line of the missing file, leaving everything else alone (specifically anything that DOES actually exist in %systemroot%\System32\Drivers). Make sure there's only one item per line and that there are no blank lines and that you are modifying the intended driver. The (Default) value of every class key should describe the class' name in English (i.e., "DVD/CD-ROM Drives")

If the missing file name came from either of the two "Device" filter categories, drill-down to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum. Hit CTRL+F and type the entry as you saw it in Device manager, etc, and remove the line in the same way as explained in the paragraph above this one. If more than one device is using this particular filter, then you will have to search again and remove it from each device.

After you've discovered and removed the offending filter driver entry from the registry, restart the computer. All should be well again at this point, if it was indeed just a filter driver problem. Try not to attempt to remove and reinstall the driver before at least rebooting first, as it should be fixed on the next system startup.

© DjLizard for DjLizard.net, 2007. | Permalink | 23 comments | Add to del.icio.us
Post tags:

Feed enhanced by Better Feed from Ozh

If you open a folder full of movies and pictures, you can almost guarantee COM Surrogate will crash constantly until it gets through every file you have (and it trudges through every subdirectory to do so).

In Explorer, click Organize > Folder and Search Options (or Tools > Folder Options), then go to the View tab. Checkmark Always show icons, never thumbnails.

Edit: As Simon has pointed out in the comments below, the main cause is usually third-party software (of which I was afflicted when I wrote this post). I'm sure one of those retarded codec packs causes it for most people (dear god people, stop using codec packs and just get VLC Player).

Simon Zerafa stated:

The main culprit seems to be older versions of Nero (the Vista Upgrade advisor flags these as incompatible with Vista) and DivX players.

It seems to be caused by third party players and applications that patch those functions in XP / Vista to allow previews in Explorer.

Updating the affected software to Vista compatible versions seem to be the best course of action. Failing that, find Vista-compatible alternatives.

© DjLizard for DjLizard.net, 2007. | Permalink | 18 comments | Add to del.icio.us
Post tags:

Feed enhanced by Better Feed from Ozh

I had to find out whether the pin list problem was the cause or the effect, so I began searching the internet for the location of the pin list. It's nearly impossible to find this information.

After a half hour of digging around with Sysinternals Filemon and Regmon, I wasn't getting anywhere. I used Sysinternals strings.exe on shell32.dll (which I had previously discovered is where the pin list calls & code are stored) and finally found out where the pin list is stored: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
The value Favorites contains the pin list itself. I found that on this Vista machine, there was nothing wrong with the Favorites value. It was the ProgramsCache value that had become corrupted. After deleting the key and restarting Explorer, the pin list came back up and all of the CPU usage went away. Problem solved. (This all works the same in Windows XP.)

© DjLizard for DjLizard.net, 2006. | Permalink | 3 comments | Add to del.icio.us
Post tags: Beta, Operating systems

Feed enhanced by Better Feed from Ozh

© DjLizard for DjLizard.net, 2006. | Permalink | 2 comments | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh

http://wiki.DjLizard.net/Dial-a-fix_beta

Get support at Lunarsoft.net.

© DjLizard for DjLizard.net, 2006. | Permalink | 2 comments | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh

Hope this helps someone.

© DjLizard for DjLizard.net, 2006. | Permalink | 7 comments | Add to del.icio.us
Post tags: Operating systems

Feed enhanced by Better Feed from Ozh

We, as Microsoft do, recommend that those who are still running Windows XP SP1 or SP1a upgrade to Windows XP Service Pack 2 as soon as possible.

© fredvries for DjLizard.net, 2006. | Permalink | No comment | Add to del.icio.us
Post tags: Operating systems

Feed enhanced by Better Feed from Ozh

These are the steps I usually use to fix it:

(edit): 0) Make sure you're using the latest build of Dial-a-fix.
1) Reboot so you're starting with a clean slate.
2) Run all of DAF section #5 (Registration center).
3) Run DAF section #3 (WU/WUAU).
4) Start > Run > rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 %systemroot%\inf\au.inf
(Note: the above command is one huge line — it has been wrapped for easier reading)
5) Immediately merge this .reg file: win2ksvchost.reg
6) Reboot.
7) Try Windows Update again. If it fails, try clicking "Flush SoftwareDistribution" in Dial-a-fix (and answer No) and then try Windows Update again.

Some combinations of the above steps usually fix it. Each machine seems to freak out a bit differently, so your results may vary.

© DjLizard for DjLizard.net, 2006. | Permalink | 27 comments | Add to del.icio.us
Post tags: Beta, Operating systems

Feed enhanced by Better Feed from Ozh

The DjLizard.net software support forum is also there. If you have any issues, suggestions, or questions about my software, feel free to post there (anonymous posting is allowed, but registration is recommended).

© DjLizard for DjLizard.net, 2006. | Permalink | 2 comments | Add to del.icio.us
Post tags: Affiliates, Operating systems

Feed enhanced by Better Feed from Ozh

I've had two Windows 2000 Professional machines in as many days that are unable to download updates. The usual Dial-a-fix Windows Update fix routines changed little about the situation. I found out that BITS couldn't start because SENS couldn't start because EventSystem couldn't start. On the second machine, EventSystem was starting, but then SENS was the final failure point. (NetMan and several other services that usually run under SvcHost were also failing with the Event 700x error listed below.)

The event log gets flooded with Event 7000 (SENS), Event 7001 (BITS), Event 4097 (EventSystem), and DCOM event 10005.

7000:

The System Event Notification service failed to start due to the following error:
The executable program that this service is configured to run in does not implement the service.

7001:

The Background Intelligent Transfer Service service depends on the System Event Notification service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.

4097:

The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 42 of .\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

10005:

DCOM got error "The dependency service or group failed to start. " attempting to start the service BITS with arguments "" in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

The fix is to change the "netsvcs" REG_MULTI_SZ in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost. You can save the following block of text as a .reg file and double-click it to import it (it's for Windows 2000 only). Then restart the computer. All of the services that failed before should now work fine, and Windows Update should work again (and/or Dial-a-fix will finally be able to help).

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
"netsvcs"=hex(7):45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,\
00,72,00,6d,00,6f,00,6e,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,\
4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,52,00,61,\
00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,00,6d,00,61,00,6e,00,\
00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,63,00,65,00,73,00,73,\
00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,\
61,00,63,00,63,00,65,00,73,00,73,00,00,00,54,00,61,00,70,00,69,00,73,00,72,\
00,76,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,00,00,57,00,5a,00,\
43,00,53,00,56,00,43,00,00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"wugroup"=hex(7):77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,00,00,00
"BITSgroup"=hex(7):42,00,49,00,54,00,53,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\BITSGroup]
"DefaultRpcStackSize"=dword:00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\wugroup]
"CoInitializeSecurityParam"=dword:00000001

Here is a link to the .reg for right-click-save purposes. (If you single-click on it and it looks funny, that's because it's Unicode).

Also take a look at the update to this article.

© DjLizard for DjLizard.net, 2006. | Permalink | 54 comments | Add to del.icio.us
Post tags: Operating systems

Feed enhanced by Better Feed from Ozh

© DjLizard for DjLizard.net, 2006. | Permalink | 3 comments | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh

Edit: Oops, I had forgotten to give 'Auto-scroll' anchors, so it was floating around when you resize the log pane. This has been fixed and I re-uploaded the file. Please re-download :)

This is unofficially Release Candidate 1. Are there any problems left that I should address before releasing it, or any quick tools I should create at the last minute? I'm about read to start re-writing the wiki entries and prepping for release!

Changelog:

* Added new policies: DoNotAllowXPSP2, UpdatesDisableNotify
* Added Auto-scroll capability to log pane
* Made the text of the "Flush SoftwareDistribution" confirmation dialog clearer
* Fixed some typos
* Cleaned up some internal code structures

Here's a bonus program: TheNotifier. I need everyone who uses Windows 2000 Professional, XP, Server 2003, or Vista to run this program. All it does (for now) is:
* Lists all Winlogon/Notify entries
* Lets you jump to a Winlogon/Notify registry entry
* Allows you to filter out the "known-good" entries

What I need people to do is:
1) Checkmark "Hide known".
2) Comment on this post and let me know the Key and the DLLName of anything that still shows up after hiding known (unless someone already posted yours, or unless it's blank – blank is good).

That's pretty much it. This is going to help me with a future spyware-removal application. Thanks!

Edit: forgot to mention – there is now a DjLizard.net software forum over at Lunarsoft.net.

TheNotifier changelog:
2006-06-23: v0.0.0.22
* Added macdriveitunespatch.dll, mcpstub.dll, lmiinit.dll, navlogon.dll

© DjLizard for DjLizard.net, 2006. | Permalink | 14 comments | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh

Download: Dial-a-fix 2006-06-18 (md5sum: 7c08efb8840b9bb451e84ee8fba58ab7)
(and secedit.exe, if you need the repair permissions tool)

Changelog:

* Rewrote policy scanner *again* to address all limitations… now it is very informative – now uses a ListView and can even spot policies that are using the wrong REG_type (such as REG_SZ when REG_DWORD was expected) – it is also extremely optimized – only needs 1680 queries to find everything it knows
* Removed one dumb policy (not really restrictive): NoRecentDocsHistory
* Updated Help dialog to have minimize/maximimize/resize functions
* Updated all version numbers to reflect "v0.60"
* Removed "Debug mode" checkmark, as it is useless now that Dial-a-fix correctly reports DLL registration errors (thanks to native registration capability)
* Added "Suppress errors" in its place, to hide all error dialog boxes that would normally appear, but the code for this is not yet complete, so it remains disabled for now
* Flush SoftwareDistribution button and GO button now disable the Tools dialog pane and its GO button so that you can't run two conflicting tasks at once

The new policy scanner kicks ass. Note: don't be alarmed – it will tell you a policy is present even if its value means it isn't enabled. There's no point in having a policy there with an erroneous value, or one that has its value set to disabled (which is the same thing as not having the value). Might as well remove them.

© DjLizard for DjLizard.net, 2006. | Permalink | 2 comments | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh

edit: Yeah, I didn't change the titlebar or the "0.58" in any place else but the version area, no big deal. I'll fix it next time :P

Changelog:

* Merged "Repair Windows Firewall" and "Repair networking interfaces" tools
* Erroneously referred to Windows Installer 2.0 as "InstMsiW" in the notes (the file that comes with DAF Full was the correct one, but named incorrectly) – the correct name is "InstMsiA" (W being Unicode (2k/XP) and A being ANSI (Win9x)), but that does not matter now:
x Removed *all* installers
* Added list of installers to the Notes pane of the Help dialog
* Added webvw.dll to the list of IE7 ignores
* Fixed misspelled policy – ForceActiveDesktop to ForceActiveDesktopOn
* Added new Add/Remove programs policies: NoAddRemovePrograms, NoRemovePage, NoAddPage, NoWindowsSetupPage, NoAddFromCDorFloppy, NoAddFromInternet, NoAddFromNetwork, NoServices, NoSupportInfo
* Added new Explorer policies: NoWebView, NoHardwareTab, DisallowRun, RestrictCpl, DisallowCpl, DisableLocalMachineRun, DisableCurrentUserRun, NoFileAssociate
* Added new IE policies: NoBrowserBars, NoBrowserClose, NoBrowserContextMenu, NoBrowserOptions, NoBrowserSaveAs, NoFavorites, NoFileNew, NoFileOpen, NoFindFiles, NoSelectDownloadDir, NoTheaterMode, NoOpeninNewWnd, NoViewSource, NoNavButtons, NoPrinting, AlwaysPromptWhenDownload
* Added new IE CPL policies: Advanced, Autoconfig, Cache, CalendarContact, Check_If_Default, Connection Settings, Certificates, Colors, Fonts, History, Languages, Links, Messaging, Profiles, Proxy, Ratings, Wallet
* Now checks for net.exe, net1.exe, sc.exe, and regsvr32.exe on startup, and lets the user know of missing files (when applicable). Also speeds up usage of these files (except regsvr32.exe, which is not used by DAF)
* Main dialog now highlights the current item being processed
* Added error handler for -2147312566 (TYPE_E_CANTLOADLIBRARY)
* Added check for MSHTML.TLB
* Policy scanner was rewritten (again) and is about twice as fast, but the painting of the new progress bar slows it down a bit

The installers have been removed for several reasons:
* Language problems (most of the packages I had in DAF full were for English only)
* Scripted install problems (a lot of them don't properly silently install)
* Size (most people were downloading DAF full when all they needed was DAF light to begin with – but this was my fault for not making it clear)
* New packages keep coming out (VC2005 redist, for instance)

I've setup a page of links to these installers in case you need them. It's on the Notes pane of the Help dialog. No more DAF full. Just DAF medium (secedit) and light.

edit: oops, beta update 2, not 3. It's beta 3, but update 2. hah.

edit 2: The policy scanner now finds entries that are present, but turned off. I think I'm going to add a checkmark to toggle this functionality on or off in the next update.

© DjLizard for DjLizard.net, 2006. | Permalink | One comment | Add to del.icio.us
Post tags: Beta

Feed enhanced by Better Feed from Ozh