BJ's TechnoBlog

Explorer.EXE - Entry Point Not Found

This is the latest bestest fix for the Entry Point Not Found (incomplete SP2 install!)


You receive an "Explorer.EXE - Entry Point Not Found - The procedure entry point SHCreateThreadRef could not be located in the dynamic link library Shlwapi.dll" error message after you install the MS04-038 security update

This article discusses how to recover a computer that reports an error after you apply the security update MS04-038.

SYMPTOMS
When you install security update MS04-038 on Microsoft Windows XP, you receive the following error message after your computer starts:
Explorer.EXE - Entry Point Not Found - The procedure entry point SHCreateThreadRef could not be located in the dynamic link library SHLWAPI.dll

CAUSE
This error occurs when MS04-038 is installed on a computer with a failed Windows XP Service Pack 2 (SP2) installation. Typically, if Windows XP SP2 installation fails, an automatic rollback occurs that returns the computer to the pre-Windows XP SP2 installation state. If automatic rollback does not occur, the service pack recovery process will partially uninstall Windows XP SP2 after you restart your computer. (For example, automatic rollback may not occur if a power failure occurs during Windows XP SP2 installation.) After you restart the computer again, you receive a message that prompts you to use Add or Remove Programs in Control Panel to manually remove the remnants of the failed installation. If you do not follow this recommendation, and you do not use Add or Remove Programs to remove the remnants of the failed installation, your computer will have pre-Windows XP SP2 files, and your registry will contain Windows XP SP2 information. If your computer has pre-Windows XP SP2 files and your registry contains Windows XP SP2 information, Windows Update or Automatic Updates offers the Windows XP SP2 version of the MS04-038 security update.

RESOLUTION
To recover your computer, follow these steps:
1.
Start your computer and log on as you typically do. Note If your computer will not start correctly, start the computer in Safe mode. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
315222 A description of the Safe Mode Boot options in Windows XP
2.
When you receive the error message, press CTRL+SHIFT+ESC to open Task Manager. You can safely ignore any additional error messages that may appear.
3.
On the File menu, click New Task (Run...).
4.
In the Open box, type control appwiz.cpl, and then click OK. You can safely ignore any additional error messages that may appear.Note If the Add or Remove Programs tool (Appwiz.cpl) does not open, type the following line in the New Task (Run...) box to remove the Internet Explorer fix, and then go to step 5:
%windir%\$NtUninstallKB834707$\spuninst\spuninst.exe
5.
In the Add or Remove Programs window, click Windows XP Hotfix – KB834707, click Remove, and then follow the instructions.
6.
When the Finish button becomes available, click Finish, and then let your computer to restart, even if it seems that the removal process is not complete. You can safely ignore any messages about additional software or hotfixes that are installed during this process.Warning Although your computer may successfully start without error messages, your computer is still in an incomplete Windows XP SP2 state. You must complete the remaining steps and reinstall Windows XP SP2.
7.
After your computer restarts, click Start, and then click Control Panel.
8.
Click Add or Remove Programs, click Windows XP Service Pack 2, click Remove, and then follow the instructions. If you receive a message about software that you may have installed after you installed Windows XP SP2, make a note of the titles. You may have to reinstall these products after you reinstall Windows XP SP2.Note If you cannot access Add or Remove Programs, use Task Manager as described in steps 1, 2, and 3. Remove Windows XP Service Pack 2 by typing the following in the New Task (Run...) box:
%windir%\$NtServicePackUninstall$\spuninst\spuninst.exe
9.
After your computer restarts, visit the Windows Update Web site. Reinstall Windows XP SP2. For information about how to install Windows XP SP2, and for steps that you can take to help make sure that Windows XP installs successfully, visit the following Microsoft Web site:
http://www.microsoft.com/sp2install/
10.
After Windows XP SP2 has successfully installed, visit the Windows Update Web site and install any critical updates.If this procedure does not work, you can perform an in-place reinstallation. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
315341 How to perform an in-place upgrade (reinstallation) of Windows XP

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION
Q1: I do not think my computer is in an "incomplete Windows XP SP2 state." How can I know for sure?A1:. After you successfully remove Windows XP Hotfix – KB834707, use one of the following methods to determine whether your computer is in an incomplete Windows XP SP2 state.
Method 1
1.
Check Add or Remove Programs for the presence of Windows XP SP2. If Windows XP SP2 is listed, go to step 2. If Windows XP Service Pack 2 is not listed, Windows XP Service Pack 2 is not installed.
2.
Determine the version of the Lsass.exe file that is in the %Windir%\System32 folder. To do this:
1.
Click Start, click Search, and then click All Files and Folders.
2.
In the All or part of the file name box, type %windir%\system32\lsass.exe, and then click Search.
3.
Right-click the Lsass.exe file, click Properties, and then click the Version tab. Note The Lsass.exe file may appear as "Lsass" without an extension.If the version number of the Lsass.exe file is earlier than 5.1.2600.2096, and Windows Service Pack 2 appears in the Add or Remove Programs tool, your computer is in an incomplete Windows XP SP2 state.

Method 2
Click Start, and then click Run, type winver, and then click OK.If the version is listed as "Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2" or a later version, you have the correct installation of Windows XP SP2. However, if the version has a number that begins with a 01, a 02, or a 03, your computer is in an incomplete Windows XP SP2 state. Additionally, if any number that is less than 040803 appears after "xpsp2", such as "Build 2600.xpsp2.030422-1633: Service Pack 2," your computer is in an incomplete Windows XP SP2 state.


REFERENCES
For additional information about Windows XP SP2, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to obtain the latest Windows XP service pack

posted by The LoneStranger rides again! @ 9:13 PM 1 comments

How to manually remove Xupiter

Found this at doxdesk.com, and wanted to store it for posterity...


Xupiter consists of an Internet Explorer toolbar containing link buttons to one of Xupiter's search engines and a task run at Windows startup which downloads updates to the software and may launch pop-ups. It also contains functionality to hijack your home page and address bar searches, and add Xupiter links to your bookmarks.

Variants
Xupiter/Xupiter uses the site xupiter.com for all functions; Xupiter/Xjupiter is the same but uses xjupiter.com instead. Xupiter/2003 is the same as the Xupiter variant, but puts its DLL directly in its Program Files folder instead of in an 'Updates' folder.

Xupiter/BrowserWise points to browserwise.com but is still otherwise identical to Xupiter. Xupiter/Browser is a newer variant which still points to browserwise.com, but stores its program files in a folder called 'Browser' instead of 'Xupiter'.

Xupiter/Sqwire is a newer variant pointing at sqwire.com. Its program files are stored in a 'Sqwire' folder, in a different layout to previous versions, and an installer DLL is left in Downloaded Program Files.

Xupiter/OrbitExplorer is the latest variant, pointing at orbitexplorer.com. Some of its program files are stored in an 'Orbit' folder in Program Files, the rest in an 'OE' folder in Common Files. It also has the installer DLL.

Also known as
XupiterToolbar (program name).

Distribution
Installed by ActiveX drive-by-download in affiliate pages. Known sources include the site www.freewebupgrades.com (which is advertised by junk e-mail) and pop-up adverts on sites such as FortuneCity and cjb.net subdomains.
More recently also bundled with Grokster.
One of Xupiter/Sqwire's ActiveX drive-by-download pages has been advertised by junk e-mail (spam) offering a 'Free Christian Toolbar'. Another pretends to be a program to disable Windows Messenger service pop-ups.

What it does
Advertising
Yes. Apart from the hijacking and added links, the software periodically opens pop-under advertisements as directed by its controlling servers. (These may appear in windows with only an 'exit' menu.)
Privacy violation
The privacy policy states that the software may track all web usage. However this behaviour has not been observed.
Security issues
Yes. The software contacts its servers to ask for update code, which is executed without checks. It has also been known to download third-party software (for instance a casino loader app).
Stability problems
In the initial variants, the update-checking task tries to connect to xupiter.com to download updates whether or not you are connected. If it fails it may cause a crash in 'RunDownload.exe'. Some versions of Xupiter can cause the Windows Explorer to crash when opened under Windows XP.

Removal
The OrbitExplorer variant may have an uninstall available. Go to Add/Remove Programs in the Control Panel, choose 'Orbit' and click 'Remove'.
Other variants have no built-in uninstall. An uninstaller is available through ActiveX drive-by-download from Xupiter sites; reports suggest this works for some but not all variants, and may leave a message on bootup that Xupiter must be reinstalled.

The latest updates of Spybot S&D and Ad-Aware can remove all Xupiter variants.

Manual removal
Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Delete the entries 'XupiterStartup' and 'XupiterCfgLoader' (earlier variants), 'SQUpdatesChecker' and 'SQConfigChecker' (Sqwire variant) or 'OrbitUpdate' and 'OrbitView' (OrbitExplorer variant).

Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands to deregister the toolbar (Xupiter and BrowserWise variants):
cd "%WinDir%\System" regsvr32 /u "\Program Files\Xupiter\Updates\XupiterToolbar.dll" regsvr32 /u "\Program Files\Xupiter\Updates\XTUpdate.dll" regsvr32 /u "\Program Files\Xupiter\Updates\XTSearch.dll"
(The earliest variants of Xupiter didn't have the XTSearch.dll file, so don't worry if this last command gives an error.)

For the 2003 variant, use:
cd "%WinDir%\System" regsvr32 /u "\Program Files\Xupiter\XupiterToolbar.dll" regsvr32 /u "\Program Files\Xupiter\XTUpdate.dll" regsvr32 /u "\Program Files\Xupiter\XTSearch.dll"

For the Browser variant, use:
cd "%WinDir%\System" regsvr32 /u "\Program Files\Browser\Updates\BrowserToolbar.dll" regsvr32 /u "\Program Files\Browser\Updates\BWUpdate.dll" regsvr32 /u "\Program Files\Browser\Updates\BWSearch.dll"

For the Sqwire variant, use:
cd "%WinDir%\System" regsvr32 /u "\Program Files\Sqwire\t.dll" regsvr32 /u "\Program Files\Sqwire\u.dll" regsvr32 /u "\Program Files\Sqwire\s.dll"
For the OrbitExplorer variant, use:
cd "%WinDir%\System" regsvr32 /u "\Program Files\Common Files\OE\toolbar.dll" regsvr32 /u "\Program Files\Common Files\OE\redirector.dll" regsvr32 /u "\Program Files\Common Files\OE\search.dll"
(On non-English versions of Windows, 'Program Files' and 'Common Files' may be called something different. In that case you will have to change these commands to match the name of these folders.)

Restart the computer and open the Program Files folder. Delete the 'Xupiter', 'Browser', 'Sqwire' or 'Orbit' folders, and in the OrbitExplorer variant also the 'OE' folder inside Common Files. For the Sqwire and OrbitExplorer variants, you should also open 'Downloaded Program Files' in the Windows folder and remove the 'Loader class' entry if it is there.

You can now restore your home page (Internet Options->General->Home page) and your search settings (Internet Options->Programs->Reset web settings). You can also delete the settings to clean up if you like: open the registry and delete the key HKEY_CURRENT_USER\Software\Xupiter, HKEY_CURRENT_USER\Software\SQ (Sqwire variant) or HKEY_CURRENT_USER\CLSID\{0FDA4D2B-7975-405d-8D7C-F5E2247EAE80} (OrbitExplorer variant).

posted by The LoneStranger rides again! @ 9:03 PM 0 comments