Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing and corrupted api-ms-win-downlevel-*.dll files


  • Please log in to reply
6 replies to this topic

#1 nicknax

nicknax

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Perth, Western Australia
  • Local time:05:04 PM

Posted 08 January 2015 - 06:51 AM

Hello. I'm having issues with my Windows 7 Ultimate x64 SP1 (6.1.7601) system and would sure like some help!

 

I stupidly ignored two reboot requests from Avira Antivirus on the night of the 5th and now when I log in to my system I get the following problems:

 

Numerous programs fail to load. Catalyst Control Center, Softperfect RAM Disk 3.3.3, Classic Start Menu and Wordpad (so far) generate an error in the form below (always referencing a "api-ms-win-downlevel-*.dll" file):

        wordpad.exe - System Error

        The program can't start because api-ms-win-download-ole32-l1-1-0.dll
        is missing from your computer. Try reinstalling the program to fix this
        problem.

Microsoft Mouse and Keyboard Center fails at startup with the following error:

        There is a problem with the Mouse and Keyboard Center software
        installation. To fix the problem, you must remove Mouse and Keyboard
        Center software, and then run Mouse and Keyboard Center setup again.
        For information about how to add or remove a program, see Windows
        Help

and programs relying on Microsoft Management Console (Device Manager, Computer Management etc.) fail with:

        Not enough storage is available to complete this operation

Various other programs run but are flakey or have limited functionality, for example:

 

* Windows Explorer - No drag and drop, and clicking on a folder now opens a new Explorer window, and all folders display the 'read only' attribute via Properties (though neither they or files within them are actually read-only).
* Safely Remove Hardware - Shows "..." instead of device names, which does nothing obvious when clicked on.
* TeraCopy - Crashes when copying large files or a large number of files. (In one instance the file list showed "memory corrupt" errors for almost every other file).
* Windows Update - Windows can not search for new updates (error code 8024000E)

Something else I noticed is that columns in 'Programs and Features' had been reset to show only Name and Size.

A check of Avira shows the following "suspicious" system files were quarantined:

Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Date/Time:    5/01/2015, 20:19

Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
Source:    C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Date/Time:    5/01/2015, 19:33

I tried a System Restore but that resulted in a reboot loop after the restart (which Startup Repair couldn't fix, it reports a "CorruptACL" error) and I could only manage to log back in by using my install disk to undo the restore.

SFC also couldn't restore the files in question - when run from normal or safe mode it reports it couldn't fix all the problems - lots of "Could not reproject corrupted file...; source file in store is also corrupted" entries (where file is one of the api-ms-win-downlevel-* files listed above). When I run SFC from the install disk it reports "There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again".

A subsequent Avira scan found an ANDROID/TowelExploit.A.Gen in my Firefox cache (now also quarantined). Malwarebytes (v1.75.0.1300, db v2015.01.05.05) didn't find any issues and I've since downloaded (via BleepingComputer.com) and tried the following:

 

* Rkill.exe - terminated C:\Windows\SysWOW64\SAgent4.exe (PID: 2344) [WD-HEUR]
* TDSKiller 3.0.0.42 - found no threats
* RootkitBusterV5.0-1180x64.exe - failed to run; created TMRBLog folders and TMRBLog\RootKitBusterDebug20150108_00.log, and an empty log folder.
* HijackThis 2.0.5 - threw an error on first run and opened this page http://free.antivirus.com/us/?function%3DmodRegistry%5FIniGetString%26params%3DsFile%3Dsystem%2Eini%2C+sSection%3Dboot%2C+sValue%3DShell%26errorno%3D5%26errortxtInvalid+procedure+call+or+argument%26winver%3DWindows+NT+6%2E01%2E3505%26iever%3D9%2E11%2E9600%2E17501%26hjtver%3D2%2E0%2E5 at which Firefox reported "NoScript filtered a potential cross-site scripting (XSS) attempt from [chrome:]". Was able to generate a log file and startup.txt.

On the night in question I did the following:

 

* Auto-ran setup.exe from an LG P7 android phone to install a USB driver, then installed 'LGMobile Support tool' (downloaded directly from the LG Australia site) and used that to (officially) upgrade the phone's OS. That process ultimately installed LG SP USB Driver v1.0, LG USB WML Modem Driver v1.0 and LG United Mobile Drivers v3.12.1.0. I also installed (then uninstalled) LG PC Suite from the same source. The only "suss" downloaded I made was 'TowelRoot v4.4.2' (tr.apk) from the author's site, which I copied from my desktop to my phone via usb (none of which triggered a response from Avira at the time).
* Updated Adobe Flash Player ActiveX and NPAPI to v16.0.0.235 via Adobe site.
* Had Agent Ransack searching all files on my data drive for a text string (I'd done that in the past with no ill effect,) which popped up quite a few (of what I took to be...) PUP warnings and false positives by Avira.
* A Windows Update, which installed and ran 'Windows Malicious Software Removal Tool x64 - December 2014 (KB890830). I normally don't install this.

 

Before wasting anyone's time in the "Virus, Trojan, Spyware, and Malware Removal Logs" forum I'd like to first try find out if my system has an active infection that I need to remove before proceeding or if I'm only left with somehow trying to repair the damage already done.

Any help/advice would be greatly appreciated.
 



BC AdBot (Login to Remove)

 


#2 nicknax

nicknax
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Perth, Western Australia
  • Local time:05:04 PM

Posted 09 January 2015 - 04:33 PM

Those missing system files are causing me grief - I can't print, need to rename files as .rar to unzip, and the list of programs I'm finding that rely on those system files is growing fast, so I decided to bite the bullet and do a repair reinstall:

setup.exe - System Error
The program can't start because api-ms-win-downlevel-user32-l1-0.dll is missing from your computer.
Try reinstalling the program to fix this problem.
Install Windows
Windows could not load the required file WinSetup.dll. The file may be
corrupt. To install Windows, restart the installation. Error code 0x7E

The irony. Clean install then - always a joy - but I figured I should take a break after firing up CCleaner to export a list of installed programs and seeing...

CCleaner64.exe - System Error
The program can't start because api-ms-win-downlevel-user32-l1-1-0.dll is missing from your computer.
Try reinstalling the program to fix this problem.

Btw I didn't end up rooting my mobile phone. I wish I could say the same about my computer. B)



#3 dariosky

dariosky

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:04 AM

Posted 10 January 2015 - 06:57 AM

I just found your post, after some days with the exact same problem as your.

I have an Windows 7 home premium x64 with Avira and after a reboot on Januart the 7th I found explorer.exe not starting and lot of programs complaining about missing api-ms-win-downlevel-* files...

I tryed to get them from a windows 8 PC cause I don't have a windows 7 around, and now have explorer working but some app complaining with wrond dll version with 0xc000007b errors.



#4 BCHelper

BCHelper

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:04 AM

Posted 12 January 2015 - 11:25 AM

Hi,

Does anyone have a screenshot or further informations about the detection name?

 

Please send the suspicious files to the Avira Protecion Lab for further analyze - you can reach the form to upload files on the Avira website.



#5 nicknax

nicknax
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Perth, Western Australia
  • Local time:05:04 PM

Posted 16 January 2015 - 02:21 PM

@dariosky Sorry to hear. Not fun is it! :( From what I read you'll just be delaying the inevitable clean install in trying to get those dll working. Even if your source exact Windows 7 versions of those files you'll still be left with clean up the corrupted backups of those files in WinSxS. Best of luck to you.

 

@BCHelper I did do a full scan again before reinstalling and Avira found nothing (nor did any other tool I tried I might add) but in my haste I didn't think to upload the files unfortunately.



#6 seagal82

seagal82

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 23 January 2015 - 03:33 AM

Hi @nicknax

 

I think I am having the exactly same problem here!!

 

such as 

 

* Windows Update - Windows can not search for new updates (error code 8024000E)
* Windows Explorer - No drag and drop, and clicking on a folder now opens a new Explorer window, and all folders display the 'read only' attribute via Properties (though neither they or files within them are actually read-only).
* Programs relying on Microsoft Management Console (Device Manager, Computer Management etc.) fail with: "Not enough storage is available to complete this operation"
*  CCleaner64.exe - System Error

 

though I thought this was happening to me due to mistake treatments by Avira I took after a system scan :(

(though I found several ppl suffered quite the same phenomenon and they claimed its after a Window update reboot @@ )

 

 

Actually I managed to copy those api-xxx-.dll & dfshim.dll(one of the error message says this won't work properly) from a good-working-win7 ,

but after reboot, although nothing "api-xxx-.dll not working" messages never comes up again,

things still are bad (File Explorer, Windows update, CCleaner errors ...etc.)

 

So ...have you solved this problem yet?

Or you just suffered too much and had enough and just reinstalled a whole new win7 system ?! :(


Edited by seagal82, 23 January 2015 - 03:39 AM.


#7 dariosky

dariosky

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:04 AM

Posted 23 January 2015 - 04:25 AM

At the end I managed to recover the api-downlevel file from another Windows 7 and all the problem you mention are now solved and I'm back in business...






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users