Join 3,363 readers in helping fund MetaFilter (Hide)


Laptop Acting Up
January 26, 2014 11:12 AM   Subscribe

Entry Point Errors... ASN1BEREncBool... MSASN1.dll... Something has clearly gone wrong with my Windows laptop, but I'm not sure what. Can you help me out?

Lenovo T430 running Windows 7 Home Premium, SP1. I don't have a ton of stuff installed on it - it's mostly used for school work, in-classroom use, web browsing or writing in Word, etc., and I tend to keep most stuff in Dropbox or in the cloud.

Turned it on yesterday and got a slew of error messages right from the start:


Intel® USB 3.0 Monitor: iusb3mon.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

GoogleToolbarNotififier.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

AdobeARM.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

Ismagent.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

Dropbox.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

TpKnrres.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

Intel® USB 3.0 Monitor: iusb3mon.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

Dropbox.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll

[At this point a standard/generic “Dropbox Error: Couldn’t Start Dropbox” pops up, too)

TpKnrres.exe – Entry Point Not Found
The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll


Tried to open Dropbox, and it wouldn't open. IE works, but is giving me grief (ex: will open Google News, but not Google search). Haven't explored around much beyond that to see what else is acting up.

Tried using a System Restore, but it didn't help.

Any ideas how to resolve this problem? Second to that, any ideas what caused it?
posted by NotMyselfRightNow to Computers & Internet (12 answers total)
 
That is weird. What do you get when you look at %WINDIR%\system32\msasn1.dll in Properties > Details? I have:

File version: 6.1.7601.17514
Size: 45.5 KB
Date modified: 11/20/2010 8:27 AM
posted by grouse at 11:48 AM on January 26


File version: 8.0.50727.762
Size: 883 KB
Date modified: 12/2/2006 1:37 AM
posted by NotMyselfRightNow at 11:51 AM on January 26


That is very odd, I would have expected us to have the similar values (I am running Windows 7 Ultimate Service Pack 1, 64-bit). Try downloading Sigcheck, open a command prompt window and run sigcheck %WINDIR%\system32\msasn1.dll. I get:
C:\Program Files (x86)\Sysinternals>sigcheck %WINDIR%\system32\msasn1.dll

Sigcheck v2.01 - File version and signature viewer
Copyright (C) 2004-2013 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\system32\msasn1.dll:
        Verified:       Signed
        Signing date:   7:36 PM 11/20/2010
        Publisher:      Microsoft Windows
        Description:    ASN.1 Runtime APIs
        Product:        Microsoft« Windows« Operating System
        Prod version:   6.1.7601.17514
        File version:   6.1.7601.17514 (win7sp1_rtm.101119-1850)
        MachineType:    64-bit

posted by grouse at 11:54 AM on January 26


There are several possibilities:
* File corruption - where that DLL file is missing or corrupted. This is often indicative of a failing hard drive.
* Malware - something has hijacked or replaced that DLL file, which broke it for the other apps on that machine.

I'd guess the second one is more likely. Try Windows Defender offline:
http://windows.microsoft.com/en-us/windows/what-is-windows-defender-offline

On preview: My file properties for the file in question are the same as the poster above. I'm guessing malware replaced that DLL and it's not file corruption.
posted by cnc at 11:54 AM on January 26


To scan for malware, I would try the free version of MalWareBytes. It's not perfect, but it works better than any of the other free tools I've tried.

When you're installing it, if it asks you whether you want to install a trial copy of the paid version, say "no". After that, do a full scan of your laptop. It might take a while.

The other possibility is that the malware (if, in fact, your computer is infected with malware) will disable MalWareBytes and prevent it from running. If that happens, then the situation becomes a bit more complex.
posted by alex1965 at 12:04 PM on January 26


Quick (frustrating) update:

Ran Windows Defender Offline, and it didn't turn up anything.

Tried to install Sigcheck, but kept getting the same error as I was getting when I logged onto the laptop (The procedure entry point ASN1BEREncBool could not be located in the dynamic link library MSASN1.dll)

Tried to install MalWareBytes, but kept getting Run-time error '53'. Based on a quick Google, that seems to be a common issue...
posted by NotMyselfRightNow at 12:53 PM on January 26


Do you have access to another computer? Copy MSASN1.dll to a flash drive and run sigcheck on it there.
posted by grouse at 1:02 PM on January 26


OK, first off I'm a dumbass and ran the earlier Properties on the wrong DLL. Here it is for the right one:

File version: 6.1.7600.16385
Size: 33.5 KB
Date modified: 11/20/2010 10:23 PM

Going to install Sigcheck on my other machine now and run against the file...
posted by NotMyselfRightNow at 1:15 PM on January 26


Sigcheck v2.01 - File version and signature viewer
Copyright (C) 2004-2013 Mark Russinovich
Sysinternals - www.sysinternals.com

f:\msasn1.dll:
Verified: Unsigned
Link date: 8:11 PM 7/13/2009
Publisher: Microsoft Corporation
Description: Network Store Information RPC interface
Product: Microsoft« Windows« Operating System
Prod version: 6.1.7600.16385
File version: 6.1.7600.16385 (win7_rtm.090713-1255)
MachineType: 32-bit
posted by NotMyselfRightNow at 1:43 PM on January 26


It's bad that it is "Unsigned." It may have been replaced by malware.

You might be able to get a replacement SP1 version of this file by downloading "Windows 7 and Windows Server 2008 R2 Service Pack 1 (KB976932)" on a computer that is more reliable. You can then expand the files by running windows6.1-KB976932-X86.exe /x (assuming 32-bit Windows) and selecting a directory. You should be able to find a good copy of msasn1.dll in that directory.

You may want to follow Deezil's Malware Fighting Toolkit Redux instructions to look for malware problems on your computer and clean them up.
posted by grouse at 2:04 PM on January 26 [1 favorite]


You can check for corrupted system files by running "sfc /scannow" from a command prompt as Administrator -- here is a walkthrough of the process that I found with a quick DDG search. There is also a page there about doing a repair install of Windows that may also be worth looking into.
posted by Fuzzypumper at 5:59 PM on January 26 [1 favorite]


The other thing is that you often can't install something like Malwarebytes while the machine is infected. Try to boot into safe mode (press F8 just before Windows startup, install Malwarebytes in Safe Mode and scan from there.
posted by cnc at 6:21 PM on January 26


« Older I want a kitchen timer (for us...   |  I have been offered a dream ca... Newer »

You are not logged in, either login or create an account to post comments