20 replies to this topic

[wevsspot]

For any of you running Windows 7 (any flavor) AND Microsoft Security Essentials.............................
I've been getting Side by Side error 72 messages in the Event Log after installing the latest version of MSE. This was driving me nuts - even though it didn't appear to be causing any instability in the OS. After hours of messing around with the error I've finally been able to correct it by editing the .dll file.

The message in your event viewer may look something this;


Activation context generation failed for "c:\program files\microsoft security client\MSESysprep.dll"
Applies To: Microsoft Security Essentials | Getting Started and Upgrading

Log Name: Application
Source: SideBySide
Date: 01.08.2011 03:51:24
Event ID: 72
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Razorback
Description:
Activation context generation failed for "c:\program files\microsoft security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft security client\MSESysprep.dll" on line 10. The element imaging appears as a child of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by this version of Windows.

^

^

To fix the error;

^

^

Open up the MSESysprep.dll file located (Windows 7) at %\program files\microsoft security client\MSESysprep.dll using a third party editor such as Notepad++ or ResourceHacker. You can delete the contents and replace with the text below, otherwise manually edit it to read exactly like this;

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<!-- Copyright © Microsoft Corporation -->

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

<assemblyIdentity

version="5.1.0.0"

processorArchitecture="amd64"

name="Microsoft.MSE.MSESysprep"

type="win32"

/>

<description>Microsoft Security Client Sysprep module</description>

<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<application>

<!--Windows 7-->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

</application>

</compatibility>

<dependency>

</dependency>

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">

<security>

<requestedPrivileges>

<requestedExecutionLevel

level="asInvoker"

uiAccess="false"

/>

</requestedPrivileges>

</security>

</trustInfo>

</assembly>

Save changes to the file and reboot. Your errors will be gone

[SpeedCrazy]

Thanks that was bugging me to distraction.

[wevsspot]

You're welcome

I've run the EICAR test virus, as well as auto / manual updates, scheduled scan, manual scan etc. and MSE appears to work as it should with the modified .dll file. I've deployed the modified .dll in all of my personal Win7 machines and everything appears to be in order. If you have any problems just holler.

[Queens Kid]

Hi Bleeding Razorback Red
I joined this forum just to tell you that you cleared up the problem with EventID 72 in MSSE. This problem has been annoying me for months now, and you are the only one who came up with a solution.
Thanks so much, you deserve a medal.

[skay_baltimore]

Hi. I'm having the exact same problem, so I installed Notepad++ and opened up the .dll file in question. However, what I got when I opened up that file looked nothing at all like what you posted -- it looked like a bunch of coded symbols, not the easy to read words you show in your replacement file. The encode option in Notepad++ was set to ANSI. I tried setting it to UTF-8 but that didn't help. This is all new to me, and I didn't want to mess anything up, so I just closed it without saving. Could you please let me know what I did wrong, and/or what I need to do correctly to get the file changed and saved?

Also, do I have to do this in safe mode or turn off MSE before making the change to the .dll?

Thanks.

[wevsspot]

Hi skay.

If using notepad++ drives you to distraction, use ResourceHacker. It's a much friendlier GUI.

http://download.cnet...4-10178587.html

[wevsspot]

Hi Bleeding Razorback Red
I joined this forum just to tell you that you cleared up the problem with EventID 72 in MSSE. This problem has been annoying me for months now, and you are the only one who came up with a solution.
Thanks so much, you deserve a medal.

You're welcome. And thanks for bringing this thread back to life. I just did a fresh install of Win7 on a new build and this reminded me that I need to get this fix in place on that machine

And secondly, welcome to OCC. We hope that you decide to hang around. We love our new members!

[skay_baltimore]

Hi skay.

If using notepad++ drives you to distraction, use ResourceHacker. It's a much friendlier GUI.

http://download.cnet...4-10178587.html

Thanks. I'll give that a look, but I'm obviously a noob when it comes to this, so please bear with me. (I'm running Win 7 Pro 32-bit, btw). I re-opened the file using Notepad++, and set View to "wordwrap". Then I scrolled down and found the actual "English Language" section, vs the machine coded parts, and I think I found the part that needs to be replaced:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright © Microsoft Corporation -->
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="5.1.0.0"
processorArchitecture="x86"
name="Microsoft.MSE.MSESysprep"
type="win32"
/>
<imaging>
<sysprepInformation>
<sysprepModule moduleName="$(runtime.system32)\msesysprep.dll" methodName="DllSysprep_Cleanup" stage="cleanup"></sysprepModule>
</sysprepInformation>
</imaging>
<description>Microsoft Security Client Sysprep module</description>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--Windows 7-->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
</application>
</compatibility>
<dependency>
</dependency>

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>

First of all, is this the exact section that's supposed to be highlighted, and then replaced with what you provided?

Second, there are indentations in the section of the original .dll file, but not in yours; does that matter?

Third, when I go to save it, does it matter what the Encoding section is set to? (It's currently set to encode to ANSI.)

Fourth, do I have to turn off MSE, which is running all the time on my system, in order to be able to save it? Or do all of this in Safe Mode?

Thanks.

Edited by skay_baltimore, 09 March 2012 - 08:20 AM.

[wevsspot]

1. Yes, that is the part that needs to be replaced. Basically deleted every piece of code that is in the original (the text portion only) and replace it with the code I provided in my first post.
2. Indentations do not matter. I've tried it both ways and it works. For me it's easier to verify the correct code without the distraction of the indentations.
3. I don't remember the "save as" settings. Try it both ways - it will either work or it won't. Just back up your original .dll so you can grab it if you need. Please confirm once your done if it works with ANSI or UTF-8
4. MSE doesn't need to be turned off, nor do you need to complete the procedure in safe mode. Just reboot after you've made the changes.

[skay_baltimore]

1. Yes, that is the part that needs to be replaced. Basically deleted every piece of code that is in the original (the text portion only) and replace it with the code I provided in my first post.
2. Indentations do not matter. I've tried it both ways and it works. For me it's easier to verify the correct code without the distraction of the indentations.
3. I don't remember the "save as" settings. Try it both ways - it will either work or it won't. Just back up your original .dll so you can grab it if you need. Please confirm once your done if it works with ANSI or UTF-8
4. MSE doesn't need to be turned off, nor do you need to complete the procedure in safe mode. Just reboot after you've made the changes.

Fantastic. One last question: In your replacement code, it says processorArchitecture="amd64"; I'm using Intel i7, and in the code that I copied it says processorArchitecture="x86". Should I make that one change in your code, or leave it as it is? (And I'm glad you told me to make a backup copy of the .dll before I worked on it. I should have known that anyway.)

Edited by skay_baltimore, 09 March 2012 - 11:27 AM.

[wevsspot]

Leave all the code as it is

No guarantees otherwise.

[skay_baltimore]

Leave all the code as it is

No guarantees otherwise.

Will do.

(Is it a 50/50 shot whether to save it as ANSI or UTF-8? Or is one more likely to work than the other? I did back up the original. And if I happen to choose the one that doesn't work, will MSE give an immediate error message when I reboot or try to run a scan or update?)

Thanks again. I can see the light at the end of the tunnel!!