Many issues this morning... please help

Find the answers to Adaptive Defense and Endpoint Protection queries in this forum. The experts will help you out!
User avatar
JamesJohn
Registered user
Registered user
Posts: 6
Joined: Fri, 13 Mar 2015, 10:45

Re: Many issues this morning... please help

Post by JamesJohn » Fri, 13 Mar 2015, 19:14

DasDonster1 wrote:
JamesJohn wrote:Hello Guys,

Regarding to the people who still have the COMCTL32.dll error, here is the fix for restore correctly the DLL file. If you can't boot in your PC step to number 5.

In my case i found that the system have multiples COMCTL32.dll files along Windows folder with different sizes.

I run SFCfix witch has a very similar function of the windows SFC, this program attempts to fix the errors that Windows SFC can't fix by restoring them from your Windows DVD. Simply run the SFCfix and when asked insert Windows DVD.

When SFCfix stop scanning for errors it shows the report and in my case i found that 2 COMCTL32.dll were still corrupted/missing at Winsxs folder.

5) In my case the report shows that the corrupted DLL files were here:
C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2

In the first folder it was a file, and in the second folder no file was there.
Since the COMCTL32.dll files are all different i get these files from the respective folders of a fresh windows and i copied them to a USB Pen. I also copy the manifest files witch have the same name of the folders and are located at C:\Windows\winsxs

In order to Paste these (4) files,since Windows don't let you to this, you need to boot with a LIVE CD like Ubuntu and copy the COMCTL32.dll files to the respective folders and the manifest files to C:\Windows\winsxs.

After this, I reboot windows in safe mode and i made the registration of the DLL files simply running CMD with Administration rights. Type this in CMD:
cd C:\Windows\System32
regsvr32 comctl32.ocx
regsvr32 comctl32.dll
cd C:\Windows\SysWOW64
regsvr32 comctl32.ocx
regsvr32 comctl32.dll
At least one of this commands will be succeed.

In the link above are the files i used to both foldes.
http://s000.tinyupload.com/index.php?fi ... 7719143562

This is not the most easy fix but i found that is the only one.
After this i reboot and start windows again in safe mode anxdfollowed panda instructions over here and all get normal again:
1. Download the following zip file (password: panda)
2. Run the resulting folder in the affected PC
3. Open cmd as admin
4. Sc stop psinprot
5. Sc stop psinaflt
6. Sc stop nanoservicemain
7. From the cmd window, browse in the extracted folder to the path “ quarantinefix\tool “ and run testerNano.exe
The cmd window will close. The process is silent, the testerNano.exe won’t be seen on the task manager, so please wait a few seconds for the tool to finish, and then you can go to the quarantine folder to check there are no files there.
Please, let us know if you have any additional problem.

This SFC method may be applied for others DLL files, you only need to detect them and replace it with files from a fresh Windows installation from a PC that you may have.

Do this at your own responsibility.
JamesJohn,

I am not clear on what you say is step #5? I have a PC running Windows Vista. It won't boot into safe mode, or to the command prompt. Selecting any of the options available the system just goes to a black screen. You have to hold in the PC's reboot button to restart to try again, to no avail.

Thanks!
DasDonster1

Sorry for the confusion Try to follow Camelgroup post Fri, 13 Mar 2015, 16:41

If you need the SFCfix just find it on Google, panda can't solve problems of their mess but can delete files that can restore systems to life (the file i upload).
Or try here: http://s000.tinyupload.com/index.php?fi ... 6392792389

User avatar
JamesJohn
Registered user
Registered user
Posts: 6
Joined: Fri, 13 Mar 2015, 10:45

Re: Many issues this morning... please help

Post by JamesJohn » Fri, 13 Mar 2015, 19:21

ruipamaral wrote:
Camelgroup wrote:Sure, you need to go back a page to JamesJohns Post, there is a file on there called SFCFix, run this file from an elevated command prompt,

it will take about 30 mins to run (or at least did on ours) it will come back with a list of corrupted files (if that is the problem)

you will then need to get copys of these files (lucky i had a server with the save version sat on a vm)

copy the files onto a usb stick (pref in there folders)

you then need to boot the server on a live cd (I used Hirens boot CD and mini XP)

once you have booted into mini XP replace the files that SFCFix has listed as corrupted (take backups of anything you replace!!! just in case!) once you have replaced the files reboot

at this point my server was working, as the issue with ours was that we could not run an exe files without getting the error 0xc0000135

I hope this helps someone, i have been pulling my hair out since this happened on Wednesday..

Cheers
Daz

Very Very Thanks..

On my server i have the same file into diferent directories ex:


real server (affected):
C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll
virtual server:
C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6\comctl32.dll

can I make a copy?

Regards,
Rui
You should definitely overwrite the file in the real server. Just in case make a backup of the replaced file.

User avatar
JamesJohn
Registered user
Registered user
Posts: 6
Joined: Fri, 13 Mar 2015, 10:45

Re: Many issues this morning... please help

Post by JamesJohn » Fri, 13 Mar 2015, 19:28

Camelgroup wrote:OK managed to find the files listed and followed Johns instruction, our SQL server is working once more,

if anyone is have this issue with server 2008 this fix will sort it,

massive props to John,

panda you fail.... anyone know a good security package?
No problem, i'm happy to know that worked for more people than me ;)

I think this method (list corrupt files with SFCfix and replace them from a clean Windows) should repair any system with missing or corrupted .dll files, it worth's a chance.

After this just follow panda instructions to get the quarantine files back to the right place. In my case i think i'm fully functional again.

Only problem, or not, seems that Panda do a scan every time i boot and i get my PC very slow.
Some times during the day panda PSANHOST.exe takes 40% of my CPU usage about 5/10minutes and then is good for 4/5 hours. I don't know if this is normal. Anyway it is not so bad since at least now i can Work.

lukasg
Registered user
Registered user
Posts: 18
Joined: Fri, 13 Mar 2015, 19:58

Re: Many issues this morning... please help

Post by lukasg » Fri, 13 Mar 2015, 20:16

Hi,
I can run the testernano and I see the "Recovery is in progress" window. However, it closes again after a few seconds, and the quarantine folder still has all 309 items in it and nothing have changed regarding the issue. What can I do to restore the files? Is there a log for the testernano program that can tell me what it tries to do?
Btw, I couldn't find any quarantine folder at C:\ProgramData\Panda Security\Panda Security Protection\Quarantine, but it does exist at C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\Quarantine. Does that make a difference?

jpedrocarvalho
Registered user
Registered user
Posts: 2
Joined: Fri, 13 Mar 2015, 20:47

Re: Many issues this morning... please help

Post by jpedrocarvalho » Fri, 13 Mar 2015, 20:53

Hi,
I've just recovered 2 computers with the COMCTL32.DLL (LoginUI) blak screen error. In this state the computer are still accessible throw file share (c$).
I copied the COMCTL32.DLL from a good windows to this directory:

c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2

You need to take ownership, and full control the directory.

After that you can reboot the computer and run the Panda Fix to restore the rest of the files.

Hope this helps.
JP

User avatar
EagleEye
Official moderator
Official moderator
Posts: 72
Joined: Thu, 22 Mar 2012, 18:03

Re: Many issues this morning... please help

Post by EagleEye » Sun, 15 Mar 2015, 15:30

Hello again,

A little bit of recapitulation. Please refer to article below to choose solutions for different scenarios:

http://www.pandasecurity.com/homeusers/ ... ?id=100045

And if you are still experiencing issues after applying restorelf tool (dll errors), available here:

http://www.pandasecurity.com/homeusers/ ... ?id=100046

just let you know that we are currently working on a new version of the tool. As soon as it is available, we will let you know.

Thank you all very much for your patience,

eKnowledge Team
Best regards,
Support Forum Team

User avatar
PandaSupport1
Official moderator
Official moderator
Posts: 517
Joined: Mon, 02 Apr 2012, 18:34
Location: PSI Headquarters

Re: Many issues this morning... please help

Post by PandaSupport1 » Mon, 16 Mar 2015, 10:50

Good morning,

Please, we are interested in doing a remote session for the comctl32.dll issues.

First off all, be 100% sure that you have launched the updated tools previously:
http://www.pandasecurity.com/homeusers/ ... ?id=100046

If the problem still persists, please, download and install the teamviewer tool (http://www.teamviewer.com) and PM me (private message) your teamviewer ID and password details.

We can also try via Logmein.

Please, contact me through PM.

Thanks ;-)
Regards,

Image
Alberto Domínguez
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

KDan
Registered user
Registered user
Posts: 26
Joined: Wed, 11 Mar 2015, 16:58

Re: Many issues this morning... please help

Post by KDan » Mon, 16 Mar 2015, 15:31

JamesJohn wrote:
Camelgroup wrote:OK managed to find the files listed and followed Johns instruction, our SQL server is working once more,

if anyone is have this issue with server 2008 this fix will sort it,

massive props to John,

panda you fail.... anyone know a good security package?
No problem, i'm happy to know that worked for more people than me ;)

I think this method (list corrupt files with SFCfix and replace them from a clean Windows) should repair any system with missing or corrupted .dll files, it worth's a chance.

After this just follow panda instructions to get the quarantine files back to the right place. In my case i think i'm fully functional again.

Only problem, or not, seems that Panda do a scan every time i boot and i get my PC very slow.
Some times during the day panda PSANHOST.exe takes 40% of my CPU usage about 5/10minutes and then is good for 4/5 hours. I don't know if this is normal. Anyway it is not so bad since at least now i can Work.
Is the profile you are using for the server set to "Run a background scan every time the signature file is updated"? There is a check box that can be un-checked to stop the scan after the update happens.

User avatar
PandaSupport1
Official moderator
Official moderator
Posts: 517
Joined: Mon, 02 Apr 2012, 18:34
Location: PSI Headquarters

Re: Many issues this morning... please help

Post by PandaSupport1 » Tue, 17 Mar 2015, 10:11

Good morning,

Please, we are interested in doing a remote session for the comctl32.dll issues. We will try to fix manually some of your issues (if it's possible)

First off all, be 100% sure that you have launched the updated tools previously:
http://www.pandasecurity.com/homeusers/ ... ?id=100046

If the problem still persists, please, download and install the teamviewer tool (http://www.teamviewer.com) and PM me (private message) your teamviewer ID and password details.

We can also try via Logmein.

Please, contact me through PM.
Regards,

Image
Alberto Domínguez
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

Nobody666
Registered user
Registered user
Posts: 5
Joined: Wed, 11 Mar 2015, 19:31

Re: Many issues this morning... please help

Post by Nobody666 » Tue, 17 Mar 2015, 11:24

Hi,
the acutally fix does not works on my Systems (Win7 64). The quarantine Folder has still files from 11.03.
If I use the PS_recovery tool, the quarantine Folder gone empty.
Any suggests?
Best regards,
Marcus

Post Reply

Return to “Adaptive Defense and Endpoint Protection - Issues”