Okay... I need help BAD!

[Yes We Did]

Okay, I have gone through a complete system reinstall... that took around 18 hours to fully complete. I completely wiped my hard drive clean, installed avast and adaware. My system is completely free of virus and worms and trojans.

So... here is my problem.

When I start up my computer (Toshiba Satellite 6 months old) The first thing that happens is I get a message saying that the Windows Defender interface has stopped working and has to close down.

I also cannot open up any images by double clicking them or access the System Folder or Performance Information areas in the control panel without explorer restarting. And of course, that means I cannot access them.

Now, it was working fine, so I set a system restore point and everything worked perfectly. So, I installed one other program (that was previously working perfect) and that's when the problems began this time. So, I did a system restore to before I did the installation, and it removed it. However, the program that I installed prior to that, which worked before, now doesn't work either.

This whole scenario has played out three times now. And of course, my toshiba flash cards don't work either.

So... since I'm worm/virus free, I am wondering if this has to be a hardware issue. Do you know of any EASY TO USE free programs I can use to check what is going on?

I'm not very good with the technical aspects of computers, so I need something that will just scan my system and tell me where the erros is. The toshiba people have been no help. They just told me to do a system restore.... At least i think that's what she said... She's somewhere in India I think.

Any help would be greatly appreciated.

Here are the error reports

Flash Cards:

Problem signature
Problem Event Name: APPCRASH
Application Name: TCrdMain.exe
Application Version: 2.0.0.6
Application Timestamp: 47958c48
Fault Module Name: gdiplus.dll
Fault Module Version: 5.2.6001.18065
Fault Module Timestamp: 48180344
Exception Code: c0000005
Exception Offset: 0002c45b
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: 8654
Additional Information 2: b7ad9fe7b1c10342b4a0169e35a18b02
Additional Information 3: 3d30
Additional Information 4: 7b2d29fd4257fb5fa0455d8525790e51

Extra information about the problem
Bucket ID: 1025272779


Defender:

Problem signature
Problem Event Name: APPCRASH
Application Name: MSASCui.exe
Application Version: 1.1.1600.0
Application Timestamp: 47918de2
Fault Module Name: gdiplus.dll
Fault Module Version: 5.2.6001.18065
Fault Module Timestamp: 48180344
Exception Code: c0000005
Exception Offset: 0002c45b
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160

Extra information about the problem
Bucket ID: 921729680


Explorer:

Problem signature
Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 6.0.6001.18164
Application Timestamp: 4907e242
Fault Module Name: gdiplus.dll
Fault Module Version: 5.2.6001.18065
Fault Module Timestamp: 48180344
Exception Code: c0000005
Exception Offset: 0002c45b
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160

[RoyGBiv]

1. Common element ...

gdiplus.dll

Now here's the weird thing. After googling for some information, I found one person have similar problems to yours, and they reported that the issue was a bad FONT. How that can be the case, I have absolutely no idea at all, and their solution seems overly complex.

Specifically, it was the font: ukai.ttf which is located in the C:\Windows\Fonts\ directory.

Well, after figuring out what that .dll is, I guess it could be a font, but that issue was probably specific to that person's system. This is a library for the GDI graphics interface.

Thinking more and will get back if no one else has chimed in.

[charlie]

8. I saw that

What's really weird is that I saw a reference to GDIPlus bombing on a malformed object call from an application when I was noodling around MS's site earlier today. Danged if I can find it again, though. That place is full of mirrors and mirages. Probably a developer's reference anyway.

I'll second your video driver recommendation. Even if it wasn't the graphics subsystem, video drivers are so often culprits it doesn't hurt to try updating them anyway.

If that doesn't work, I would try replacing GDIPlus -- insert clanging bells and red flags here -- I know doodly about Vista, so I don't know if this is safe or proper advice, but it's what I'd do. The problem is Vista will probably fight tooth and nail against any attempt to delete or replace. And if you do manage it, it'll likely dump a copy as corrupt as the first. In any case, it'll probably take a root-privileged CLI to delete it. If Vista is like XP, it'll get replaced pretty quick. Or the OS will throw up prompts for the install disk.

[RoyGBiv]

9. Here's a fun thing ...

It's likely completely unrelated to the OP's problem, but I discovered it while looking around.

OpenOffice comes with its own version of gdiplus.dll. It stores it in its local folder and calls on it when needed rather than the Windows version. I have no idea why, just found it interesting.

I've never been able to figure out if Microsoft's entire website has any structure to it at all. I'm sure it does, but I'll be damned if I know what it is.

[charlie]

14. That does seem kind of odd

The DLL has been available on Windows since way back, but they opt to roll their own. Weird. Maybe it's some goofy leftover from long ago MS/Sun wars. I can see Gates refusing to bake in some feature because Sun wanted it, or Sun didn't want to fork over cash for a license. Or something. Those two really enjoyed pissing on each others boots.

[Why Syzygy]

16. LOL! The KB

was one of our support tools when I supported MSN. It used to be a lot simpler. IIRC, we searched the error code. There weren't a zazillion server versions in those days. I'm sure MS techs use it.

I use the google search/toolbar. It allows right click > search google for "highlighted word/phrase".
It also has an optional highlight feature which can be used on any page, even if a search wasn't executed.

[RoyGBiv]

2. Drivers ...

Are all of your drivers for the machine installed? It may be necessary to reinstall these after a system restore, which seems ridiculous, but there ya go.

[Why Syzygy]

6. This site

says they have a "free" download for gdiplus.dll. I don't know if it's trustworthy.
http://www .dll-files.com/dllindex/dll-files.shtml?gdiplus
(link disabled for safety)

It has all kinds of "thank yous". ?

Wouldn't you go through the MS KB?

[RoyGBiv]

7. I would ...

... go through MS Knowledge Base I mean.

I got a dll from one of those sites once because I couldn't find it anywhere else. I never had a problem (that I know about) but my anxiety level was high the entire time. I had something I *had* to do and had a corrupted dll, so that was my temporary solution until I could really fix it later.

[charlie]

10. It's dicey doing that

Apart from the trust factor, libraries often come in suites and are dependent on other libraries that must be of compatible version releases. Libraries can be mismatched though all members have the correct names, and cause all kinds of havoc.

[Why Syzygy]

12. Thanks.

Confirms my suspicions.

[Why Syzygy]

3. It is a problem with the gdiplus.dll file

Looking through MS KB. Can you run Windows Update?

http://support.microsoft.com/search/default.aspx?catalog=LCID%3D1033&query=gdiplus.dll&mode=r
Haven't found anything specific yet.

I googled and got a lot of tech forum hits. I don't trust links posted in just every forum.

[Yes We Did]

15. Yes... says I'm up to date

[Why Syzygy]

17. There is almost certainly an issue

with your apps calling gdiplus.dll.

tcrdmain.exe is a TOSHIBA Flash Cards\r from Toshiba Corporation\r belonging to TOSHIBA Flash Cards\r

msascui.exe is a process belonging to Microsoft Windows Defender Antispyware which protects your computer against Internet-bound threats such as spyware and trojans which can be distributed through e-mail or attack directly to the computer allowing unauthorized access to your computer.\r This program is important for the stable and secure running of your computer and should not be terminated.\r

Are you able to confirm in Add/Remove programs that you have SP 1?

Here's the critical download that appears to be the resolution.
http://www.microsoft.com/downloads/details.aspx?familyid=9b51deb8-3873-4146-977f-7e3d0840a4c5&displaylang=en

[Yes We Did]

19. says update does not apply to my system

thanks though

[Why Syzygy]

21. y/w . sorry that didn't help

You have a couple of other suggestions in the thread.

[Why Syzygy]

4. MS has a critical patch

It could be related to fonts because it deals with graphics.

Here's the site that points to GDI as related to gdiplus.dll

http://www.liutilities.com/products/wintaskspro/dlllibrary/gdiplus/

A report of the threat:

http://www.msisac.org/advisories/2008/2008-016.cfm

MS fix:

http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx

Have you run Windows Update since the reinstall? The fix may be a part of the current update.

[RoyGBiv]

5. Windows Update ...

That would be my suggestion.

Good sleuthing.

[Why Syzygy]

13. Danka. Gotta run 'em down!

:rofl:

I've been planning an excursion into personal pc support.
Now, I know the first thing they're gonna do! Windows Update.

Don't you regret not running Wimpdose :sarcasm:

[Why Syzygy]

11. Here's another

switch setting. The Fault Module name is different, so I don't know if it relates. Also, I'm Vista novice, so I'm not sure what the switch is. Did you install adaware? If the Windows Update doesn't resolve, what was the one program you installed?


i solved the problem. it was a DEP setting.
i remember changing DEP settings and it was after that ad aware 2007 would not work

i accedentaly changed the setting from "Turn on DEP for essential Windows programs and services only"
to
"Turn on DEP for all programs and services except those i select:"

so i changed the settings back to the default and now it runs perfectly.

[charlie]

18. Hey, Vista has a built-in system integrity scan

It does repairs, too. Might be worth a try:

http://www.howtogeek.com/howto/windows-vista/verify-the-integrity-of-windows-vista-system-files/

[Yes We Did]

20. it says it cannot find the file.... this sucks. n/t

[charlie]

22. Well, that shouldn't be

I've got it on my XP box. This is weird. Try typing this into the command line:

dir c:\windows\system32\sfc.exe

And see if you still get the "file missing" message.

Or you can use windows explorer to navigate to the location, provided you've got windows explorer set to show hidden system files. Either way, you'll find out if the file really is missing.

[Yes We Did]

23. how do i do that? n/t

[charlie]

25. Do it the same way you initially tried to run SFC

Here are instructions on raising an Administrator command line that are a bit clearer than the earlier link.

http://www.geekstogo.com/forum/Windows-Vista-run-command-prompt-administrator-t146674.html

When you get it open, just go ahead and try running SFC one more time. Type this:

sfc /?

and press Return.

If you get a screen full of instructions, you're ready to go. Type this:

sfc /scannow

and make sure you have something interesting to do before you press Return, because it might take a while to finish.

If neither of those does anything, use the commands in my previous post.

If Windows still complains about a missing file, use your system Find feature to look for sfc.exe on the C: drive. It's a way long shot, but it might be in an odd location. Not likely, but it doesn't hurt to find out.

[Yes We Did]

27. I was able to find them... just using the regular search...

and by clicking search in hidden files... there's a bunch. Now what?

[charlie]

29. A bunch?

How many? Is there one located in c:\windows\system32?

If not, make note of the location of one of the others. Make sure you get the full path, c:\program files\sfc\sfc.exe, for example.

If sfc.exe is located in c:\windows\system32, use the instructions in post #25 to run it.

If it's elsewhere, do the same, but instead of typing this:

sfc /scannow

use the full path to the other location, like this:

c:\program files\sfc\sfc /scannow

Press Return and watch for whatever messages it leaves when it finishes (it might tell you to reboot, among other things).

[Yes We Did]

31. There are 19 of them.

two are modified today, and they are located in Backup (C:/Windows/winsxs

the rest haven't been modified since before I got the computer
they'e in x86microsoft.windows.gdiplus_6595c64144ccf1df_(bunch of numbers) )C:/windows/winsxs

all i did was go into search, tell it to search everywhere including hidden and system files

[charlie]

32. Try the ones in Backup

Open an Administrator command window (link in post #25) and enter this:

c:\windows\winsxs\sfc /?

Don't bother typing it, just swipe across the command above, right-click and select Copy. Go to the Administrator window, right-click and select Paste. The command should now be in the window. Press Return.

If you get a screen full of instructions on how to use SFC, you're ready to go. Next, enter this:

c:\windows\winsxs\sfc /scannow

and press Return. Good luck.

[Yes We Did]

33. okay... i put in sfc/scannow

that's all i typed. it says beginning system scan. this process will take time

[Yes We Did]

34. It's moving now... 23% and climbing n/t

[charlie]

35. Very good

Waste of time or end of your troubles? We'll know soon :)

Actually, it won't be a waste of time, in any case. If it doesn't do any repairs, then we can be certain GDIPlus isn't the culprit.

[Yes We Did]

37. It says:

Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS.log For example C:\windows\Logs\CBS\CBS.Log

I found the log file but it says access denied

[charlie]

38. Use Windows Explorer

and go to c:\windows\logs\cbs\. Right-click on CBS.log and select "Open with...". Look for Notepad and choose that. Read what it says.

So there was corruption and SFC fixed some of the files. Hopefully, the repairs will be enough to set your system right. Now would be a good time to check if things are behaving better.

You've still got problems though, may be minor, may be major. You'll have to read the log to find out.

[Yes We Did]

39. Says Access Denied

[charlie]

40. Heh. Figures. Administrator's eyes only.

Skip the log for a while and see if things have improved on your PC.

Later, you can do this -- go back to that Administrator window again. Type in:

notepad.exe

Click File --> Open, then navigate to the log file and open it.

[Yes We Did]

41. Nothing improved...

file opened. HOLY SHIT is it BIG! Don't understand a single thing in it... but it sure is fucking huge. I'm going to run it again and see if it gives me a smaller one.

[charlie]

42. Haw!

Probably an entry for every system file in there, there's a squintillion of them. Use Edit --> Find if you want to see if gdiplus.dll was repaired (or needs repairing, since the program said it couldn't fix some of them).

If it turns out gdiplus does need replacing, here's Microsoft's official instructions on how to do it:

http://support.microsoft.com/kb/929833

It involves some hairy command strings, might be something you'll want to save for tomorrow.

Also, you might want to look into how to set SFC to run at boot. Could be the reason some files couldn't be repaired is because they can't be disturbed while in use.

[Yes We Did]

43. It shows 7 of them listed... Here... See...

2009-03-27 11:45:14, Info CSI 0000287b Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.1.6001.22170, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59e05c
2009-03-27 11:45:14, Info CSI 0000287c Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.1.6001.18065, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59dd8c
2009-03-27 11:45:15, Info CSI 0000287d Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.0.6001.22170, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59f64c
2009-03-27 11:45:15, Info CSI 0000287e Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.0.6001.18065, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59f7b4
2009-03-27 11:45:15, Info CSI 0000287f Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.1.6000.20826, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59f91c
2009-03-27 11:45:15, Info CSI 00002880 Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.1.6000.16683, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59fa84
2009-03-27 11:45:15, Info CSI 00002881 Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.0.6000.20826, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59fbec
2009-03-27 11:45:15, Info CSI 00002882 Performing 1 operations; 1 are not lock/unlock and follow:
StageFile (2): flags: 8 app: (null) comp: Microsoft.Windows.GdiPlus, Version = 1.0.6000.16683, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:6595b64144ccf1df}, Type = "win32", TypeName neutral, PublicKey neutral file: "GdiPlus.dll" srcfile: @0xa59fd54
2009-03-27 11:45:15, Info CSI 00002883@2009/3/27:16:45:15.814 CSI Transaction @0x2d70448 destroyed
2009-03-27 11:45:15, Info CBS Exec: Not trying hotpatching because root package is not hotpatch-aware: Package_for_KB938464~31bf3856ad364e35~x86~~6.0.1.5
2009-03-27 11:45:15, Info CSI 00002884 Transaction merge required, do-not-merge flag passed.
2009-03-27 11:45:15, Info CSI 00002885@2009/3/27:16:45:15.815 CSI Transaction @0x2d70448 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id <76>"TI4.29994747:1634435888:4/Package_for_KB938464~31bf3856ad364e35~x86~~6.0.1.5"

[charlie]

44. Crap

I can't say. I don't know how many it should have, though it's likely only one. The others are probably copies brought in by third-party software. But again, I can't say for sure. One of them should be in c:\windows\system32, the original one, the one listed in your trouble reports.

[Yes We Did]

45. Hey! No Crap!

Dammit! :argh: :argh: :argh:

What do you think? Should I just use the system restore again? I notice the sourcefile all have the first 7 characters in common... that mean they could all be in the same location? I had several fonts that were all almost the same filename... They were all the same maker... could the whole group cause it? I have to say... the timing seems right... it seems like it has been going nuts shortly after i add the fonts. I was able to figure out which ones I added in the last three months. Maybe I should restore and just not add any of them???

[charlie]

49. A disk search would find out how many there are

But the log reports tests and doesn't detail any followup actions, so it's looking like gdiplus.dll, however many there are, are okay.

I'd hold off another restore for a while longer and see about getting current video drivers first. Munged or subpar drivers can cause all sorts of improbable trouble. Downloading and installing a fresh set is a whole lot quicker than restoring the OS. I'd say it's better to give that a shot before tackling the big job and wrangling with Toshiba again.

[charlie]

46. I don't know if that's 7 different files

or 7 instances of tests on the same file. Their version numbers differ, but they're otherwise the same. And if you go by version number, there are actually only 4 files. A disk search for gdiplus.dll would clear that up.

[Yes We Did]

47. got them... now what?

[Yes We Did]

48. HEY! HERE IS SOMETHING!

all of the ones that were modified today (two of them) have a different "filename" than the rest of them.

all the ones not modified today are gdiplus.dll (some with different caps)

the ones modified today say x86_microsoft.windows.gdiplus_(insert 50 numbers and letters here)_gdiplus.dll_423f7010\

oh, and all the rest are application extentions. these other two (modified today) are dll_423f710 file

[charlie]

50. If the ones modified today

end with backslashes, they're probably folders. No program name would contain a slash. And libraries all have the .dll extension.

[Yes We Did]

51. the file names end with _gdiplus.dll_423f7010

[charlie]

52. Have you searched for them?

I wouldn't be surprised if they weren't restore point backup files. The long extensions would make them appear to be something other than libraries (or any other file type) to Windows.

[Yes We Did]

53. I did the search already.

there were only two files that were modified today. they are dll files in the backup folder

[charlie]

54. They aren't being used if they're in backup

The rest then, weren't repaired, either because they didn't need it or they couldn't be repaired. Unless there's something in the log that says otherwise, I'd assume they're fine. If you want to be certain they weren't left untouched because they were currently in use, you could try setting sfc to do a boot time scan. Be aware though, that the command switch to do that causes sfc to run at EVERY boot.

[Yes We Did]

55. Fuck it Charlie.

I'm done... I lost my connection (storming bad) and didn't think I was getting back on... I put in the restoration disk. I'll try it again tomorrow. I'm just going to do what I said above... Just install the fonts from last year and just the 3 I needed from recent ones and see what happens.

Thanks again for all the help. I have been doing this for the last 4 freaking days. Maybe I won't add any fonts and see what happens. If it still fucks up, I'll know to send it back to Toshiba.

Thanks again.

[Yes We Did]

36. Alright... it's done scanning. Now what do I do?

And thank you again for helping me with this.

[Yes We Did]

24. You know what... that's okay.

Of the new fonts I downloaded, I'm only using 3 of them. I'm going to just use the recovery disk again and only add those 3... hopefully it's not one of them. If that doesn't work, it's going back to toshiba.

[Yes We Did]

26. I found it... all of them.

now what?

[charlie]

28. You found SFC?

You're at an Administrator command prompt? Does the title bar on the window say 'Administrator'?

If not, follow the top instructions in my post above. When you are, run SFC, as listed in the same post.

If you get it working, this could be your ticket out. Your situation is the sort of thing the program is made to resolve. Hang in there just a bit longer, it'll be worth it.

[Yes We Did]

30. lol... am i supposed to put spaces between the closing bracket of one...

and the opening bracket of the next?