Windows 7 and mscoree.dll error

[jakkwb]

When I get past the login screen, I get this error message:

"Mpnotify.exe - bad image"
c:\windows\system32\mscoree.dll is either not designed to run on Windows or it contains an error..."

I OK it.

So when I try to load control panel (in any mode), I get this box" explorer.exe - application error. The instruction at blahblah referenced meory at blahblah. The memory could not be read. Click OK to terminate the program." When I click OK, Control Panel goes away.

I cannot get into control panel. I don't know if this is 32 or 64 bit windows. Help!

The mscoree.dll file is there in the system32 folder.

[Niclo Iste]

From what I've looked into it seems you have one of the following or a combination of them. A faulty PGP installation. A faulty or wrong version of .NET installed like 32 or 64bit. A recently removed infection or one that has manifested itself. Which of these pertains to you and could you give details?

[jakkwb]

hmm..tough question. First off its not my laptop. It doesn't "seem" or act like it has a virus...Windows version is Home Premium 32 bit. Thats all the info I can supply right now.

Is there another way to get to control-panel-programs-and-features? I get the memory error every time I open control panel.

I'll run another scan on it and see what it finds.

[MobilePCPhysician]

Try booting into safe mode. From safe mode, run an updated antivirus check. Download and install Malwarebytes, (malwarebytes.org) free edition, update the definitions, and do a full scan.

Microsoft recommends doing a system file check. Click on run, type "sfc /scannow", without the quotes.

[jakkwb]

In safe mode, Malwarebytes and a virus scan both found nothing....

SFC did give an error - just a moment and I'll post what it was...

[jakkwb]

sfc - "Windows resource protection found corrupt files but was unable to fix some of the them. Details are in cbs.log"

I can open the CBS logfile. I have several lines near the end that read "cannot repair member file"

I can give exact details if needed.

[Niclo Iste]

The file names can lead us in the direction of where the problem is.

[jakkwb]

OK, here is a paste of the files giving problems: (kind of large)

2010-08-31 09:44:53, Info CSI 000001b0 [SR] Verify complete
2010-08-31 09:44:53, Info CSI 000001b1 [SR] Repairing 3 components
2010-08-31 09:44:53, Info CSI 000001b2 [SR] Beginning Verify and Repair transaction
2010-08-31 09:44:53, Info CSI 000001b3 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_d24 f28ce089d2c7f\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}

2010-08-31 09:44:53, Info CSI 000001b4 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001b5 Hashes for file member \SystemRoot\WinSxS\x86_netfx-mscoree_dll_31bf3856ad364e35_6.2.7600.16513_none_7 daed23956119a9f\mscoree.dll do not match actual file [l:22{11}]"mscoree.dll" :
Found: {l:32 b:wRQnrZqv9ue8jAGRy90Tob/KzRe4pV6RjpbNSFTUMg8=} Expected: {l:32 b:RulxXzzQnzL76qU3mZHp59rMvSQHwtBh/aOgTwUQgTM=}

2010-08-31 09:44:53, Info CSI 000001b6 [SR] Cannot repair member file [l:22{11}]"mscoree.dll" of NetFx-MSCOREE_DLL, Version = 6.2.7600.16513, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001b7 Hashes for file member \SystemRoot\WinSxS\x86_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_40 cecc845ce1dd88\dfshim.dll do not match actual file [l:20{10}]"dfshim.dll" :
Found: {l:32 b:dlE43hCaESZHSiWS6dzfno/9A37sHoZuwcpc7T2OpR4=} Expected: {l:32 b:9j97kPD8O98pbu9p5wVh7SGOKgjF2OaRM9XscZfbUPo=}

2010-08-31 09:44:53, Info CSI 000001b8 [SR] Cannot repair member file [l:20{10}]"dfshim.dll" of NetFx-DFSHIM_DLL, Version = 6.2.7600.16513, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001b9 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_d24 f28ce089d2c7f\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}

2010-08-31 09:44:53, Info CSI 000001ba [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001bb [SR] This component was referenced by [l:198{99}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~6.1.7600.16385.Windo wsFoundationDelivery"

2010-08-31 09:44:53, Info CSI 000001bc Hashes for file member \??\C:\Windows\System32\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}

2010-08-31 09:44:53, Info CSI 000001bd Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_d24 f28ce089d2c7f\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}

2010-08-31 09:44:53, Info CSI 000001be [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted

2010-08-31 09:44:53, Info CSI 000001bf Hashes for file member \SystemRoot\WinSxS\x86_netfx-mscoree_dll_31bf3856ad364e35_6.2.7600.16513_none_7 daed23956119a9f\mscoree.dll do not match actual file [l:22{11}]"mscoree.dll" :
Found: {l:32 b:wRQnrZqv9ue8jAGRy90Tob/KzRe4pV6RjpbNSFTUMg8=} Expected: {l:32 b:RulxXzzQnzL76qU3mZHp59rMvSQHwtBh/aOgTwUQgTM=}

2010-08-31 09:44:53, Info CSI 000001c0 [SR] Cannot repair member file [l:22{11}]"mscoree.dll" of NetFx-MSCOREE_DLL, Version = 6.2.7600.16513, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001c1 [SR] This component was referenced by [l:128{64}]"Package_for_KB958488~31bf3856ad364e35~x86~~6.2.76 00.16513.NetFx4"

2010-08-31 09:44:53, Info CSI 000001c2 Hashes for file member \??\C:\Windows\System32\mscoree.dll do not match actual file [l:22{11}]"mscoree.dll" :
Found: {l:32 b:wRQnrZqv9ue8jAGRy90Tob/KzRe4pV6RjpbNSFTUMg8=} Expected: {l:32 b:RulxXzzQnzL76qU3mZHp59rMvSQHwtBh/aOgTwUQgTM=}

2010-08-31 09:44:53, Info CSI 000001c3 Hashes for file member \SystemRoot\WinSxS\x86_netfx-mscoree_dll_31bf3856ad364e35_6.2.7600.16513_none_7 daed23956119a9f\mscoree.dll do not match actual file [l:22{11}]"mscoree.dll" :
Found: {l:32 b:wRQnrZqv9ue8jAGRy90Tob/KzRe4pV6RjpbNSFTUMg8=} Expected: {l:32 b:RulxXzzQnzL76qU3mZHp59rMvSQHwtBh/aOgTwUQgTM=}

2010-08-31 09:44:53, Info CSI 000001c4 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"mscoree.dll"; source file in store is also corrupted

2010-08-31 09:44:53, Info CSI 000001c5 Hashes for file member \SystemRoot\WinSxS\x86_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_40 cecc845ce1dd88\dfshim.dll do not match actual file [l:20{10}]"dfshim.dll" :
Found: {l:32 b:dlE43hCaESZHSiWS6dzfno/9A37sHoZuwcpc7T2OpR4=} Expected: {l:32 b:9j97kPD8O98pbu9p5wVh7SGOKgjF2OaRM9XscZfbUPo=}

2010-08-31 09:44:53, Info CSI 000001c6 [SR] Cannot repair member file [l:20{10}]"dfshim.dll" of NetFx-DFSHIM_DLL, Version = 6.2.7600.16513, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

2010-08-31 09:44:53, Info CSI 000001c7 [SR] This component was referenced by [l:128{64}]"Package_for_KB958488~31bf3856ad364e35~x86~~6.2.76 00.16513.NetFx4"

2010-08-31 09:44:53, Info CSI 000001c8 Hashes for file member \??\C:\Windows\System32\dfshim.dll do not match actual file [l:20{10}]"dfshim.dll" :
Found: {l:32 b:dlE43hCaESZHSiWS6dzfno/9A37sHoZuwcpc7T2OpR4=} Expected: {l:32 b:9j97kPD8O98pbu9p5wVh7SGOKgjF2OaRM9XscZfbUPo=}

2010-08-31 09:44:53, Info CSI 000001c9 Hashes for file member \SystemRoot\WinSxS\x86_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_40 cecc845ce1dd88\dfshim.dll do not match actual file [l:20{10}]"dfshim.dll" :
Found: {l:32 b:dlE43hCaESZHSiWS6dzfno/9A37sHoZuwcpc7T2OpR4=} Expected: {l:32 b:9j97kPD8O98pbu9p5wVh7SGOKgjF2OaRM9XscZfbUPo=}

2010-08-31 09:44:53, Info CSI 000001ca [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"dfshim.dll"; source file in store is also corrupted

2010-08-31 09:44:53, Info CSI 000001cb Repair results created:
POQ 77 starts:

POQ 77 ends.

2010-08-31 09:44:53, Info CSI 000001cc [SR] Repair complete

[Niclo Iste]

Looks like a bad .net installation. I'd start with a repair installation of it if possible.

[jakkwb]

Dot net does not show up in Add/remove programs, even under updates (I found a way to get to this screen without it giving me the above mentioned memory error). I did find this "Microsoft .Net Framework 4 Client profile..) I uninstalled it, rebooted, same error messages.

So, I found a Microsoft removal tool for all of the dot net packages. Ran it, it said it succeeded. Rebooted. Same error message. But, when I go to Windows updates, how come the dot net package does not appear if it has been uninstalled?

This wreaks.

[Niclo Iste]

http://www.microsoft.com/downloads/d...displaylang=en

This is the installer for .net 4.0

[jakkwb]

ok thanks. Running the 4.0 install right now.

[jakkwb]

No change. The properties for the mscoree.dll file did not change at all since the upgrade to net 4.0.

[Niclo Iste]

I was reviewing your logs and it also traces back to update package KB958488. Which coincidentally is a hotfix for .net 4.0 however other people have had it mess up as well. Nothing so far as an exact issue has been found in my research but I may find something still.

I'm curious is KB958488 listed and can you remove it? You'll have to check the box for updates to be shown in your add/remove programs.

[jakkwb]

Interesting. That update shows up in the list, but all it shows is the number and date. Thats it. I'm canning it right now...