MSI.dll is either corrupted or bad

[julio99]

When I try and open Programs and Features on my Windows 7x64 laptop it crashes momentarily with the proverbial, "explorer.exe is stopping" and explorer.exe is now restarting and I get to try and open Programs and features again. I went to the Event Viewer to troubleshoot what was causing this and it appears to be the MSI.dll according to the details in Event Viewer. Is there anyway to stop this stopping and starting by fixing whatever the problem is?

 

[TrainableMan]

Try System File Checker

If that doesn't work then boot up to the W7 DVD and do a System Restore.

I also suggest you boot to Safe Mode and run a full virus scan just to check if maybe a virus corrupted your system files.

 

[julio99]

Try System File Checker

If that doesn't work then boot up to the W7 DVD and do a System Restore.

I also suggest you boot to Safe Mode and run a full virus scan just to check if maybe a virus corrupted your system files.

You talkin' sfc /scannow or chkdsk? Why would the virus scan in safe mode be different than in regular with MBAM, because the scan came up clean with NortonIS2013 and MBAM in regular mode.

 

[TrainableMan]

Well some viruses don't hide as well in safe mode because safe mode w/o networking has limited services and startup programs. For an even better check, download and run TDSSKiller & 2 or 3 versions of RKill and run those in safe mode prior to running the full scan. TDSSKiller looks for rootkits and RKill looks for programs that started even in safe mode and Kills them (stops their execution so the A/V can see them). Links to those are available in our Freeware DB. And I'm not saying you do have a virus, just these days it's a good idea to check.

System File Checker is SFC.

Chkdsk looks for bad sectors on your hard drive, which is also good to run if you think the HD may be going bad and corrupting your files, but it won't fix the files if they are already damaged..

 

[julio99]

Well some viruses don't hide as well in safe mode because safe mode w/o networking has limited services and startup programs. For an even better check, download and run TDSSKiller & 2 or 3 versions of RKill and run those in safe mode prior to running the full scan. TDSSKiller looks for rootkits and RKill looks for programs that started even in safe mode and Kills them (stops their execution so the A/V can see them). Links to those are available in our Freeware DB. And I'm not saying you do have a virus, just these days it's a good idea to check.

System File Checker is SFC.

Chkdsk looks for bad sectors on your hard drive, which is also good to run if you think the HD may be going bad and corrupting your files, but it won't fix the files if they are already damaged..

I've ran sfc /scannow and it did what it was supposed to do, but I still have the crash when I open programs and features. I also scanned my system in safe mode. Uninstalled Norton and reinstalled it and ran sfc inbetween. I just don't get it. Did you see the screenshot I sent originally? It's Explorer.exe that is crashing but the faulting module is msi.dll. So what is the fix for that according to Microsoft? Would a new msi.dll do the trick? A replacement I mean? Where would I get one for a windows 7 x64?

 

[TrainableMan]

msi.dll is a system file, I was hoping it was just damaged and would be fixed by sfc /scannow; if the file wasn't corrected then I doubt the problem is actually in msi.dll.

0xc0000005 is an Access Violation like the program is trying to get somewhere it isn't allowed.

I'm not aware of a magic guide that says if you get this error the fault is always this. Errors are rarely simple and require research and a lot of trial and error.

-Viruses cause a lot of errors so I had you check that.
- Bad Drivers also cause most errors, are all your drivers up-to-date? Windows updates all been applied?
-Corrupt files can be an issue, did you run the chkdisk you mentioned?
-I also mentioned putting in the W7 DVD and running a repair, that might fix it. Did you do that?
-Bad RAM can cause problems, you might run memtest86+ to test that.
-Your registry might be corrupted. You might create a new logon ID with administrator privileges and then logon with that account and see if it gets the same error when you go to Pgms&Features.

When is the last time you added any hardware? What was it?

New software? What was it?

Change anything in your BIOS?

P.S. we don't work for Microsoft and we don't get paid, though on rare occasions a MS employee could join and post.

 

[julio99]

Ok Train; I did some more work on finding the Explorer.exe in Windows and I noticed that there were 2 backup explorer.exe files that were leftover from some stupid tweak I did a long time ago and I thought they were harmless, so I never bothered to remove them. I put them on my desktop for the purpose of seeing if my system would run properly with them gone before I deleted them even though they were in backup mode at the time. I decided to scan twice more, once with MBAM and once with SuperAntiSpyware before I went any further. Well, MBAM prefers that you use their scanner in full power as they say their is a driver inside of the program that is specifically for that purpose. Their words, not mine. I guess they know that people sometimes prefer scanning in Safe Mode for a variy of reasons, but they prefer you use their program at full strength with everything running. Anyway, I found that one of the backup Explorer.exe files had a piece of Malware attached called "Heuristics.Reserved.Word.Exploit". I did a little looking around befor I quarantined it and I'm not sure if I understand what exactly this is, but the bonus was no more problem once these 2 backups were gone. I have tried every way possible to re-create the issue and the propblem remains gone, so this is good. Most of the Drivers I use that are important I get from the Acer support page and I use the philosophy of "if it's not broke, don't fix it". Do you set your drivers to be updated by Microsoft at night or whenever or is that something you do by yourself at your convenience?
As far as I know my updates are all set for the default 3:00AM time and all the boxes underneath the time are checked, so I guess windows updates are all set for default. I forget where that setting is that says to install drivers and all at the same time. I thought it might be in Action Center but I didn't see it.
I guess we'll just keep an eye on things and hope that what was done is enough. Thanks again for your help and guidance.

 

[TrainableMan]

So you seem to be working now, that's good.

I personally have my Windows Updates to notify me but do nothing but for most users I recommend you allow windows updates at 3am like you said.

What I don't recommend is allowing it to treat recommended updates the same way, because that is how drivers slip in. To disable this, go to Control Panel > Windows Updates and click Change Settings. Then remove the check beside "Give me recommended updates the same way I receive important updates"

 

[julio99]

I used to have it all the same way you did and I got lazy and moved it up to download but let me choose what to install and then I got lazier and just let it go default. Well, I unchecked it all except for the one. I'll go back to looking over everything that gets put on my machine. I was wondering how IE9 got on my machine. It was delivered as an update right? What a moron I am sometimes. That is where getting lazy got me. Time to get off my butt again and start paying attention. Thanks again Train.

 

[TrainableMan]

Yep, they slipped in IE9 and silverlight as if they were needed.

 

[julio99]

Do you un-install IE9 or do you leave it for posterity and the occasional vulnerability that it brings.

 

[TrainableMan]

Well IE9 is more secure than IE8 and you can't remove IE8 unless you have a European Union W7 N-version so I just leave it. If you don't use any browser then you are very safe; it won't run any exploits if you don't run the application at all and if you ever do use it then best to have the more secure version.

 

[julio99]

Thanks Train. I do have IE9 installed , but I rarely ever open the homepage, but when I was doing those scans with SuperAntiSpyware there were like 100 browser Hijacks all related to IE I would guess 9 because that is what is installed. I deleted them all, so should I bother even making a homepage with that browser or what. When I use CCleaner to get rid of temp files there always seems to be temp files associated to IE, even when it's not used. Maybe you have a solution or suggestion as to what I should do with that browser if I don't use it.

 

[TrainableMan]

I don't use SAS A/V so I'm not familiar with any hijacks. Seems odd it would complain about IE. As for temp files, all browsers use temp files so they may be coming from elsewhere but they aren't of much concern; CCleaner just deletes them for a little more space but these days hard drive space is cheap most people won't notice anyway.

What would I do about IE9, nothing really; there are a few sites that don't seem to work well with my FireFox so I like having it as a back-up just in case. I have Chrome too but I only keep that to play Angry Birds

 

[julio99]

I use PaleMoon which is the Firefox x64 affiliate as my browser. Faster than Firefox with 99and 9tenths of the FF addons work with it. Most of the anti malware and spyware programs all have browser hijack settings geared towards IE as I believe it probably is the easiest homepage to hijack otherwise they would gear it towards FF or Chrome too. I'll just leave IE9 then and use Googs as the homepage. Thanks Train.