Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Application(s) unable to start... 0xc0000005


  • Please log in to reply
14 replies to this topic

#1 fgranlund

fgranlund

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 03 January 2018 - 02:28 AM

My Win7 desktop picked up a virus a few days ago (since eradicated) and as a result can't open any of its applications. Even the screensaver generates the error message in the title. I've done a full virus scan, checked the Boot Configuration Data and attempted a Windows Restore - which failed to finish and generated yet another error (0x80070005).

 

I also ran the SFC scan, which determined that my iassdo.dll.mui file (one or more of its several copies, shown as six entries in the CBS log) is corrupted, but found nothing that looks like a global application blocker. I'd like to scan the registry for culprits, but can't run a registry fix tool for the same reason nothing else runs (0xc0000005).

 

One of the forum entries I came across suggested hunting out the registry entry LoadAppInit_DLLs and changing its value from 0 to 1. Sounds harmless enough, but I'd like a second opinion before I tinker with the registry. Would that have any chance of solving my problem? Is the corrupt iassdo.dll.mui file a worthy suspect? Is this a job for Rkill??

 

I eagerly await any insights from those of you who have confronted this particular gremlin before. Thanks!


Edited by hamluis, 03 January 2018 - 06:37 AM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 Jaycan

Jaycan

  • Members
  • 454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:58 PM

Posted 03 January 2018 - 06:03 AM

Hi fgranlund, and a Happy New Year to you,
Have you run a scan with Malwarebytes as is often directed to check for any remaining infections ?
 
Now first step that you need to perform is to check your system files, and M/soft have provided simple methods to do this.

Start your computer and go Program files > Accessories > and find Command Prompt, Now, Right Click on it and select Run As Administrator.
It will bring up a black Command Prompt box. Type sfc /scannow (make sure there is a space between c and /) and then press Enter.

Do not do anything else while the program runs . This will take from 20 to 40 minutes to run and check installed files.

 

You can run Rkill if you wish, but I would also download and run CCleaner or TFC to remove Temp Internet Files. Do not adjust any of CCleaners settings, just run it as downloaded.

 

Let us know how things go.


Edited by Jaycan, 03 January 2018 - 06:06 AM.


Acer Computer with LG Monitor and Toshiba Laptop with Windows 7.1

Windows 64bit  8.1 - Always fully updated

Firefox / Google Chrome / Internet Explorer Browsers

Usually a home helper here or with friends and nimble fingered ladies who would rather sew or dust, but not clean the bugs out of a computer ...


#3 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 03 January 2018 - 04:06 PM

Hi, Jaycan - thanks for your prompt response!

 

The underlying problem here is that although my Win7 system still works, it won't run any non-system applications, like CCleaner or Malwarebytes. I'm able to get online and run some apps via the Windows XP Mode subsystem I was using to run legacy apps, so I was hoping I could run CCleaner on Win7 from XP Mode. But its install routine doesn't allow for installing in another location, like a network drive or my Win7 system, and scanning XP Mode won't fix 7. Any idea how to re-direct the CCleaner installation?

 

I did run the SFC scan, which is where I learned about my corrupt iassdo.dll.mui file, but I've no idea whether that is relevant to this situation. The six entries in the CBS log cited hash mismatches and corrupt source files as the reasons it could't fix it. I'll post the log file if you think it's worth exploring in detail.

 

If we can't get CCleaner to scan the right system, did that simple registry edit I noted in my original post sound like it has any chance of solving the problem? Is it at least safe to try it? I also found an elaborate Windows Repair routine I can run from the installation disc to find and fix missing or corrupted files. . . sounds comprehensive, but how reliable is it?

 

Thanks for your help! I'm really hoping to avoid having to re-install Win7 and all my apps and stuff.



#4 Jaycan

Jaycan

  • Members
  • 454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:58 PM

Posted 03 January 2018 - 06:25 PM

A few minor items that were not included in your post,

Please post the sfc /scannow file, not a link to download something we may have no idea what is contained.
To find sfc /scannow file type cmd, Right Click and select run as administrator, copy and paste the following into command, then press Enter.
findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt

 

This will place a new icon on the desktop titled sfcdetails.
Click on the icon to open the log, then copy it and paste in this topic.
You will have several instances of iassdo.dll.mui

 

Not knowing where (and what) you are posting from, please humour us with a few details. What make, and model computer is the "sick computer" (if known)
Is the sick computer accessing internet via Wireless or Wired (Ethernet) connection direct from a router.
Are you posting this from the "problem computer" or another one. Have you rum Windows Updates recently,and this includes your Antivirus with any other programs.
I did have a Win7 major problem, it was a Toshiba Laptop that I ran mostly direct wired, and on failure it was simpler to get a set of Genuine CD's from Toshiba and reinstall.

 

Also can you find any "Restore Points", which can be a simple way to get back prior to your problems, then we may be able to update and run a few basic programs.



Acer Computer with LG Monitor and Toshiba Laptop with Windows 7.1

Windows 64bit  8.1 - Always fully updated

Firefox / Google Chrome / Internet Explorer Browsers

Usually a home helper here or with friends and nimble fingered ladies who would rather sew or dust, but not clean the bugs out of a computer ...


#5 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 03 January 2018 - 10:34 PM

OK. . . the general questions first.

 

The computer in question is an HP desktop with Intel dual processor (Model E4500) running Win7 SP1 (64-bit) at 2.2GHz with 6GB installed RAM. All known updates are in place, including the virus stalker, browser, et al. Internet access is via an Ethernet router. I am accessing this forum via a Windows XP Mode "virtual machine" subsystem running on the same computer, from which I can also run some - but not all - of the apps on the Win7 system (but very slowly and unreliably, as the subsystem recognizes only 512KB of the 6GB installed RAM).

 

One of the first remedies I tried was Windows Restore, but it wasn't able to finish the task due to error 0x80070005, which I haven't yet been able to identify. There were several recent restore points, but none worked. That led to the SFC scan referred to in prior posts. There was only one file that couldn't be fixed; below are the relevant log entries:

 

2 [SR] Beginning Verify and Repair transaction
2018-01-01 19:58:39, Info                  CSI    00000324 [SR] Cannot repair member file [l:28{14}]"iassdo.dll.mui" of Microsoft-Windows-Networking-Internet_Authentication_Service_Iassdo.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2018-01-01 19:58:40, Info                  CSI    00000328 [SR] Cannot repair member file [l:28{14}]"iassdo.dll.mui" of Microsoft-Windows-Networking-Internet_Authentication_Service_Iassdo.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2018-01-01 19:58:40, Info                  CSI    00000329 [SR] This component was referenced by [l:266{133}]"Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.Windows Foundation Language Pack"
2018-01-01 19:58:40, Info                  CSI    0000032c [SR] Could not reproject corrupted file [ml:60{30},l:58{29}]"\??\C:\Windows\SysWOW64\en-US"\[l:28{14}]"iassdo.dll.mui"; source file in store is also corrupted
2018-01-01 19:58:43, Info                  CSI    0000033f [SR] Verify complete
 
2018-01-01 20:00:01, Info                  CSI    00000388 [SR] Repairing 1 components
2018-01-01 20:00:01, Info                  CSI    00000389 [SR] Beginning Verify and Repair transaction
2018-01-01 20:00:01, Info                  CSI    0000038b [SR] Cannot repair member file [l:28{14}]"iassdo.dll.mui" of Microsoft-Windows-Networking-Internet_Authentication_Service_Iassdo.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2018-01-01 20:00:01, Info                  CSI    0000038d [SR] Cannot repair member file [l:28{14}]"iassdo.dll.mui" of Microsoft-Windows-Networking-Internet_Authentication_Service_Iassdo.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2018-01-01 20:00:01, Info                  CSI    0000038e [SR] This component was referenced by [l:266{133}]"Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.Windows Foundation Language Pack"
2018-01-01 20:00:01, Info                  CSI    00000391 [SR] Could not reproject corrupted file [ml:60{30},l:58{29}]"\??\C:\Windows\SysWOW64\en-US"\[l:28{14}]"iassdo.dll.mui"; source file in store is also corrupted
2018-01-01 20:00:01, Info                  CSI    00000393 [SR] Repair complete
2018-01-01 20:00:01, Info                  CSI    00000394 [SR] Committing transaction
2018-01-01 20:00:01, Info                  CSI    00000398 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired


#6 joseibarra

joseibarra

  • Members
  • 1,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:04:58 AM

Posted 04 January 2018 - 01:10 AM

FWIW - Errors that end with 0005 are usually going to be permissions/rights/access denied kinds of things.

 

It might be your unspecified antivirus/antimalware application that is "protecting" your system from changes - you know...  the AV that allowed your system to get infected in the first place.

 

You could see if System Restore will work in Safe Mode, use the AV manufacturers uninstall software to temporarily uninstall the AV or see if System Restore will work from the Windows 7 System Recovery Options after booting on your genuine Windows 7 installation CD/DVD.


The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#7 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 04 January 2018 - 02:11 AM

Exactly. . . Something is preventing any applications from running, so it must be a system function. I don't suspect the AV or even DEP, since that hadn't been introduced in SP1, but something in the registry or system files. The AV that allowed the attack was replaced immediately, and the new one (Baidu) quickly detected and expunged the virus and doesn't interfere with running apps on 7 from the XP Mode subsystem. I'll see if Windows Restore will work in safe mode, and burn an install disc from the ISO image at Digital River to do a full repair if needed.



#8 Jaycan

Jaycan

  • Members
  • 454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:58 PM

Posted 05 January 2018 - 05:12 AM

Sorry to be missing for a while, but I have also asked another helper who would advise on Reinstall or other ideas.

As stated "Error code 0x80070005" is also known as "ACCESS DENIED." It usually occurs when you lack file or registry permissions that are required to install an update.

Because file or registry permissions may be changed by Malware, we recommend that you scan for malware after you repair the permissions (Rkill would have helped)..

I do not think that you will be able to run Rkill (unfortunately), as this would have reset some of the installed system. You can try, and keep us updated.


M/soft say to try this out and see your results. Again I do not think (in your state) that you will be able to install it. But it includes solutions for Win 7 / Win 8 / and Win 10..
http://www.microsoft.com/security/scanner/en-us/default.aspx

 

The infection still seems to be present, and I think it is present in your Win7.1 partition, preventing further downloads.



Acer Computer with LG Monitor and Toshiba Laptop with Windows 7.1

Windows 64bit  8.1 - Always fully updated

Firefox / Google Chrome / Internet Explorer Browsers

Usually a home helper here or with friends and nimble fingered ladies who would rather sew or dust, but not clean the bugs out of a computer ...


#9 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 05 January 2018 - 05:01 PM

Many thanks for your diligent efforts on my behalf!

 

I just finished running another scan with my Baidu AV app (which still runs, probably by design). This time it found only adware (last time it found and eliminated the virus) - so if permissions were changed, they may have to be corrected manually. The SFC scan found only the mysterious iassdo.dll.mui situation, which I'm still not convinced is relevant to this problem.

 

The one positive factor here is that I can download and install apps using the XP Mode subsystem. If the app can be directed to install in another location (e.g., a network drive), I can install it in the main Win7 system and run it from XP Mode. In order to try that with the MS security scanner you suggested, should I download the 32-bit version (to run from XP) or the 64-bit version, since it will be scanning my 64-bit WIn7 system?

 

Thanks!



#10 Jaycan

Jaycan

  • Members
  • 454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:58 PM

Posted 05 January 2018 - 06:12 PM

Full credit for this script is with thanks to dc3

You will need the installation media to run this. If you do not have the disc you can download a ISO file which they can use to create the installation media.

http://www.majorgeeks.com/files/details/microsoft_windows_iso_download_tool.html

If you have a retail version of Windows 7 and the product code which came with it you can use the link below to download a ISO image which you can use to create a installation disc.

http://www.microsoft.com/en-us/software-recovery


Repair Installation Instructions

Attention: In order to boot from the installation disc you may need to change the boot order in the BIOS so that the optical driver is the first device in the boot order, and the HDD/SSD is the second devcice.

1. Place the installation disc in the tray of the CD/DVD drive, close the tray and restart the computer.

2. You will be prompted to press any key to continue the installation, do so.

At this point the setup process will load files, this will take several minutes.

3. You will now need to choose the Language, Time and currency format, and Keyboard or input method that you'd like to use.

jIHG1Q6.png
After this is done click on Next.

4. Click on the Repair your computer link at the bottom-left of the Install Windows window.

93LGcoc.png

5. System Recovery Options will now search your hard drive(s) for any Windows 7 installations. This will take several minutes.

No participation is required on your part at this time, wait till it has finished and the next window opens.

6. Choose the Windows 7 installation that you'd like to perform the Startup Repair on, then click on Next

7. Click on the Startup Repair link from list of recovery tools in System Recovery Options.

8. The Startup Repair tool will now search for problems in the system files.

If Startup Repair finds a problem with any system files the tool may suggest a solution which you will need to confirm, or may solve the problem automatically.


9. Startup Repair will now attempt to repair whatever problems it found with system files.

Note: If Startup Repair did not find any problems with system files you won't see this step.

Important: Your computer may or may not restart several times during this repair process. This is normal, you should allow it to continue until you see the Restart your computer to complete the repairs window.

10. Click on Finish, this will restart your computer.

It is possible that the Startup Repair will not be able to fix the problem. If the Startup Repair tool determines this, it may automatically run the the repair after your computer restarts. If it does not automatically run the repair but you are still having problems with Windows 7 repeat these steps to run Startup Repair again manually.

Edited by Jaycan, 05 January 2018 - 06:17 PM.


Acer Computer with LG Monitor and Toshiba Laptop with Windows 7.1

Windows 64bit  8.1 - Always fully updated

Firefox / Google Chrome / Internet Explorer Browsers

Usually a home helper here or with friends and nimble fingered ladies who would rather sew or dust, but not clean the bugs out of a computer ...


#11 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 05 January 2018 - 09:39 PM

Inching along slowly here, but still running into obstacles. The ISO download at majorgeeks.com seems only to include the 64-bit version of the system - or in any case, the EXE file doesn't open in my XP Mode system ("not a valid WIN32 file" runs the complaint). So I tried the MS site, but it was unable to verify my product key (the one on the label on the side of the case). I'll try to get through to Microsoft support, but if anyone has any suggestions, please send them along. Once I get the ISO file installed, I should be able to run it.



#12 joseibarra

joseibarra

  • Members
  • 1,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:04:58 AM

Posted 06 January 2018 - 03:31 AM

The Microsoft site for downloading Windows 7 ISOs will only accept 25 character Product Keys for Retail and System Builder products.

 

If the Windows installation came preinstalled from the store/factory/other source that usually makes it an OEM (Original Equipment Manufacturer) system and you will not be downloading ISOs from the Microsoft site.

 

The majority of systems in online help communities seem to be OEM factory installed so that means that suggesting the MS site is not going to work for the majority of systems with problems.  Instead of suggesting something that will only work for some systems some of the time it makes more sense to me to suggest things that will work for all systems all of the time (but that could just be me).

 

Don't waste time waiting to hear from Microsoft because their alleged "experts" in their community don't seem to know what they are doing where their troubleshooting methods consist of trying things:  try chkdsk, try clean boot, try safe mode, try sfc /scannow...  You don't need to try things, you need to do things.

 

The MajorGeeks download is not their stuff but from HeiDoc.net and it used to be quite reliable, then it got unreliable, then it changed so that when you launch it you will see:

 

You can donate some of your computer's idle resources to ensure future

development of this tool and other services on HeiDoc.net.  This is entirely 

voluntary, and has no impact on functionality.  Learn more?    Yes  No

 

What does that mean and what happens if you Click Yes or No?

 

Today if you click No you will find the Windows 7 option is unclickable and I'm not clicking Yes to see what happens unless I have a way to undo whatever it does to my system after that.


Edited by joseibarra, 06 January 2018 - 03:47 AM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#13 Jaycan

Jaycan

  • Members
  • 454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:58 PM

Posted 06 January 2018 - 06:35 PM

Going over a few items, plus a few ideas from Windows Forums (that never solved all problem).
Baidu Antivirus is a security software by Beijing’s top major web company. Can you only install this Chinese program, or are others available ? Do you have ant other Chinese security programs installed.

Can you see any Program Files when you hit "Start" button or not ? Can you go to Documents or My Documents to find other downloads ?
Is there any other Antivirus installed or listed there ?

Are you able to find Defrag, and run that 'installed' program or follow below (it is included) ?

Try to hit Start > Across to Computer > Properties Then it should bring up your drives, C: is usually your nominated HDD or SDD > Right click on this and you should be offered options that include First,  Disk Cleanup > Left Click on the box and allow it to run. It can take quite some time and may seem to jam at scanning System Error Dump files, but make a coffee if you wish, so just allow it to scan. I tick all boxes and it runs 'like' CCleaner > Do not use the "More Options" area above this section > Click Tools and go directly to Defragmention (should be middle option) and hit Defrag Now, Mine is set to Auto Run weekly as the Win 7.1 gets very little use > Finally at the top, Error Checking is Disc Check. Click the Check Now box > Tick both boxes and click Start > Now Reboot your computer and it will automatically begin a 5 stage check. This will not start unless you Reboot.

(From Microsoft Foruns).. Check to see if either of these updates are installed. They cause false SFC results.
Neither is an update you want unless your heart is set on Win10. They were among the early "fake security" updates
KB3022345
KB3068708

If you did not see earlier, please use the previously installed version (32bit or 64bit) only.



Acer Computer with LG Monitor and Toshiba Laptop with Windows 7.1

Windows 64bit  8.1 - Always fully updated

Firefox / Google Chrome / Internet Explorer Browsers

Usually a home helper here or with friends and nimble fingered ladies who would rather sew or dust, but not clean the bugs out of a computer ...


#14 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 08 January 2018 - 07:27 PM

Catching up after a busy weekend here. . . I've done all the "housekeeping" routines suggested on the Windows forums. Disk Cleanup didn't find any problems, de-frag didn't even run because the disk was "100% fragmentation free" and Disk Check went through its paces without having to correct anything. And I removed the two "fake security" updates. My operating system works fine, it just won't run any applications (shows that 0xc0000005 error whenever I try to open anything).

 

Regarding the AV, I was running Avira when the virus got in, so I switched to Baidu, which immediately found and eliminated it. The usual advice is against running more than one AV program, so I've uninstalled all the others. Baidu was just installed, so it's up to date and likely working properly, but any recommendations will be gratefully accepted.

 

Since none of the file checking routines found any problems, whatever damage that virus did was probably to the registry. Does anyone know whether that suggested LoadAppInit_DLLs edit might work, or is safe to try?



#15 fgranlund

fgranlund
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:12:58 AM

Posted 16 January 2018 - 04:30 PM

Update - still fighting with that 0xc0000005 application error, but I've uncovered a cog in the troubleshooting wheel. Since no one else has mentioned it, I'll pass it along as useful information (or perhaps a reminder).

 

Since my system can't run applications (like Rufus or ImgBurn) my plan to run a repair/install was frustrated by a lack of a bootable DVD or USB drive. However, some determined online scrounging found a pre-Rufus set of instructions for creating a bootable USB drive. Turns out that in addition to copying the ISO image you have to run a file called bootsect.exe (found in the boot folder in the ISO) to prep the USB drive. Per the instructions, I was able to do that in DOS.

 

Then, at last, I ran the repair/install routine and. . . it found nothing wrong.

 

So that points to the registry as the last place to look for the source of the problem. Anyone care to tackle that registry edit question in my previous post? I've not seen that suggestion anywhere else, but I'm willing to try it if it's safe.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users