70 replies to this topic

[eldo]

My system has been cleaned by advancedSetup. Just ran sfc /scannnow with no problem... however still could not start cryptographic services. RPC is running.

[exile360]

Greetings .

I viewed your thread in the HijackThis area briefly and I've got a few things for you to try.

• First, please copy/paste the following into notepad exactly as written:

  net start cryptsvc
  regsvr32 softpub.dll
  regsvr32 wintrust.dll
  regsvr32 initpki.dll
  regsvr32 dssenh.dll
  regsvr32 rsaenh.dll
  regsvr32 gpkcsp.dll
  regsvr32 sccbase.dll
  regsvr32 slbcsp.dll
  regsvr32 cryptdlg.dll
  pause

• Click on File and select Save as
  
• Click the drop down menu next to Save as type and select All Files
  
• Name the file fix.bat (the .bat extension is very important)
  
• Save the file to your desktop

Once you've done that, double click the file to run it. A series of message boxes will appear telling you if registering of a dll were successful or not, make a note of any that it says were not successful to post their names and the errors in your reply.

Once the commands complete the black Dos window will say "Press any key to continue", but don't press anything yet. Scroll to the start of the commands using the scrollbar on the right side and check to see if there was an error message immediately after the net start cryptsvc command. If there was, make a note of it and post it here in your reply.

[eldo]

I will try this as you prescribed...however I've already done this manually...first un-registered and then registered each dll. Each step was successful except net start cryptsvc.

[eldo]

C:\Documents and Settings\cerina heyward\Desktop>net start cryptsvc
System error 1290 has occurred.

The system cannot find message text for message number 0x50a in the message file
for BASE.


C:\Documents and Settings\cerina heyward\Desktop>regsvr32 softpub.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 wintrust.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 initpki.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 dssenh.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 rsaenh.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 gpkcsp.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 sccbase.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 slbcsp.dll

C:\Documents and Settings\cerina heyward\Desktop>regsvr32 cryptdlg.dll

C:\Documents and Settings\cerina heyward\Desktop>pause
Press any key to continue . . .

[exile360]

I suspect this may be a registry problem. To verify:

• Please copy/paste the following into notepad exactly as written:

  @echo off
  reg query "HKLM\SYSTEM\CurrentControlSet\Services\CryptSvc" /s>"%userprofile%\desktop\CryptoLog.txt"
  start /max notepad "%userprofile%\desktop\CryptoLog.txt"

• Click on File and select Save as
  
• Click the drop down menu next to Save as type and select All Files
  
• Name the file crypto.bat (the .bat extension is very important)
  
• Save the file to your desktop

Once you've done that, double click the file to run it. It will create a text file on your desktop called CryptoLog.txt. Once it finishes it will open the file in notepad. Copy and paste the text into your next reply.

Thanks .

[eldo]

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
DependOnService REG_MULTI_SZ RpcSs\0\0
Description REG_SZ @%SystemRoot%\system32\cryptsvc.dll,-1002
DisplayName REG_SZ CryptSvc
ErrorControl REG_DWORD 0x1
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs
ObjectName REG_SZ LocalSystem
Start REG_DWORD 0x2
Type REG_DWORD 0x20
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeChangeNotifyPrivilege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege\0\0
FailureActions REG_BINARY 80510100000000000000000003000000140000000100000060EA0000000000000000000000000000
00000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\cryptsvc.dll
ServiceMain REG_SZ CryptServiceMain
ServiceDllUnloadOnStop REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Security
Security REG_BINARY 00000E0001

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Enum
0 REG_SZ Root\LEGACY_CRYPTSVC\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

[exile360]

Ok, please reboot the PC and then see if the service is running.

If not, then please open Event Viewer:

• Click on Start and click Control Panel
  
• Click on Administrative Tools (if you don't see it then click on Classic View on the left side of Control Panel)
  
• Click on Event Viewer
  
• Expand the Windows Logs section and click the bar at the top that says Level to sort the events by the various types (be patient, this will most likely take a while and use a lot of CPU until it completes)
  
• Once it's done, look for the section of Errors and find the ones from the Source of Service Control Manager Event Log Provider
  
• Locate any related to the Cryptographic Service (clicking the first one once then using the Up and Down arrows on your keyboard will make going through them quicker)

Post back with any info from the General box below the list for these events that have occurred within the time frame of your problems with the Cryptographic service (if they're all the same error message you only need to post one, preferrably the most recent).

edit: Got some additional info from MysteryFCM who is one of our resident experts. He suggested that you should run this tool from Microsoft. It is made to correct issues with the Cryptographic service so please give it a shot and let me know if it fixes the problem.

[eldo]

The first posting is the crypto error(all the same) the others are window file protection info you might find interesting.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/29/2009
Time: 2:11:40 AM
User: N/A
Computer: D2SQB761
Description:
The CryptSvc service failed to start due to the following error:
%%1290

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 7/28/2009
Time: 6:17:24 PM
User: NT AUTHORITY\SYSTEM
Computer: D2SQB761
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 7/25/2009
Time: 3:05:16 PM
User: N/A
Computer: D2SQB761
Description:
Windows File Protection file scan completed successfully.

For more information, see Help and Support Center at http://go.microsoft....vents.asp.Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 7/25/2009
Time: 3:05:16 PM
User: N/A
Computer: D2SQB761
Description:
The protected system file c:\windows\system32\setup\zoneoc.dll could not be restored to its original, valid version. The file version of the bad file is 1.2.626.1 The specific error code is 0x00000426 [The service has not been started.
].

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 7/25/2009
Time: 3:05:16 PM
User: N/A
Computer: D2SQB761
Description:
Windows File Protection scan found that the system file c:\windows\system32\setup\zoneoc.dll has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 1.2.626.1.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 7/25/2009
Time: 3:05:14 PM
User: N/A
Computer: D2SQB761
Description:
The system file c:\windows\system32\xrxwiadr.dll could not be copied into the DLL cache. The specific error code is 0x00000426 [The service has not been started.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

[eldo]

Ran fixcomplteinst...had to install .net framework v2.0 first...rebooted...could not start cryptosvc...???

[Tarun]

Few things I'd try out:

• Dial-a-fix - In Tools do sfc /purge then sfc /scannow. After that close tools, click the green checkmark and click Go.
  
• Should that not resolve it, try this; it resets all perms and settings to OOBE defaults:
  

  secedit /configure /cfg "%windir%\security\templates\setup security.inf" /db ss.sdb /overwrite

[eldo]

Windows cannot find secedit

[Tarun]

Copy it from the Dial-a-fix directory into your System32 folder.

[eldo]

Still didn't start.(What a chess game!)

[exile360]

Step 1

• Click on Start and click Control Panel
  
• Click on Administrative Tools (if you don't see it then click on Classic View on the left side of Control Panel)
  
• Click on Services
  
• Scroll down the list of services until you come to Cryptographic Services and double click on it
  
• Click on the Log On tab and make sure that the circle is filled in next to Local System account (if it isn't, then click on it so that it is and click Apply then click OK
  
• Then scroll down the list until you come to the Remote Procedure Call (RPC) service and double click on it
  
• Click on the Log On tab and make sure that the circle is filled in next to This account and that the box to the right of that says NT Authority\NetworkService and that there are several black circles in the Password and Confirm Password boxes (if not, then let me know in your next reply)

If you had to change anything such as the Log On information for the Cryptographic Services to match what I just told you then reboot now and see if the service is now running as it should be.

Step 2
If that didn't work then please do the following:

• Please copy/paste the following into notepad exactly as written:

  @echo off
  reg query "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC" /s>"%userprofile%\desktop\cryptolog2.txt"
  start /max notepad "%userprofile%\desktop\cryptolog2.txt"

• Click on File and select Save as
  
• Click the drop down menu next to Save as type and select All Files
  
• Name the file crypto2.bat (the .bat extension is very important)
  
• Save the file to your desktop

Once you've done that, double click the file to run it. It will create a text file on your desktop called CryptoLog2.txt. Once it finishes it will open the file in notepad. Copy and paste the text into your next reply.

[eldo]

Some where along the line I lost the ability to right click with the mouse.?


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC\0000
Service REG_SZ CryptSvc
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x20
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Cryptographic Services

[exile360]

Before I start having you actually alter anything in the registry I just wanted to post this as it's possible that one of the other guys might have some insight. I ran the exact same batch file on my system here at work which is also running XP Home SP3. The Cryptographic Service is functioning normally here. Here's the output:

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC
	NextInstance	REG_DWORD	0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC\0000
	Service	REG_SZ	CryptSvc
	Legacy	REG_DWORD	0x1
	ConfigFlags	REG_DWORD	0x20
	Class	REG_SZ	LegacyDriver
	ClassGUID	REG_SZ	{8ECC055D-047F-11D1-A537-0000F8753ED1}
	DeviceDesc	REG_SZ	Cryptographic Services

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC\0000\Control
	ActiveService	REG_SZ	CryptSvc

I notice it's a little bit different from yours. It seems one of the keys that I have here is not present on your machine.

As for your mouse, try unplugging it then plugging it in again and if that doesn't work, try a different mouse if you have one.

[eldo]

Found this on the internet...and another bingo!...mouse problem solved.

You are right. I used the Clean Disk feature in Accessories, System Tools. It gave me the option of deleting my Temp files along with the Internet Temp Files. I did that and, bingo, the mouse copy and paste is working fine. Why is that, may I ask?

Thanks so much.

Benjamin
You only have so much space for temporary files. You were at the limit so there was no place to copy the files to.

[exile360]

Good, glad you got that solved. You just taught me something .

Now, back to the Cryptographic Service. Since no one chimed in, lets go ahead and give this a shot to see if it fixes the problem:

• Copy and paste the following text into notepad exactly as written:

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC\0000\Control]
  "ActiveService"="CryptSvc"

• Click on File and select Save as
  
• Click the drop down menu next to Save as type and select All Files
  
• Name the file fix.reg and save the file to your desktop
  
• Double click the file to run it
  
• Reboot your PC and check to see if the service is now running

[eldo]

Cannot import fix.reg error accessing the registry.

[exile360]

Ok, that must be because that part of the registry has higher permissions set (which is how it should be).

For now, we'll need to change permissions on that key so you can access it, then we'll revert it back.

• Click Start then click on Run
  
• In the Run box type regedit and press Enter or click on OK
  
• Navigate to

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CRYPTSVC\0000

• On the left side of the window right-click on the 0000 folder and select Permissions
  
• When the window pops up click on Add
  
• In the box under Enter the object names to select (examples): type your login name and click on the Check Names button and click on OK
  
• Now, with your username highlighted check the box next to Full Control and click Apply then OK
  
• Double click fix.reg again and let me know if it gave you errors
  
• If it didn't, then follow the instructions to access that key again and get to the Permissions screen once more
  
• Highlight your username and click Remove then click Apply and OK
  
• Reboot to see if the [b]Cryptographic Service is working now

Please let me know how it went or if you have any questions.