Dave-H

Thanks so much heinoganda! In fact I've now found that I can extract those files from the Easy Fix package using Universal Extractor. Still strange that the package won't work as it stands, but I guess it's only intended for EMET 5 and later. BTW, did you see that I resolved the Trust button crash problem?

I tried this "Easy Fix" before and I could not get it to work, even with EMET installed in its default location. I just get a message saying "The easy fix does not apply to your operating system or application version."

I'm pretty sure it won't install in Safe Mode anyway, as it uses the Windows Installer, which won't work in Safe Mode IIRC. Do you still have the installer for the last version that did work? If so you could try installing that again and then installing the new version over it. Have a look in your (hidden) Windows\Installer folder and see if there is a .msi file for Silverlight still there (a popup should tell you what program it's for if you hover the cursor on the files), if so try uninstalling from its right-click menu. If that doesn't work, try the file's repair option first. Also if you have the Microsoft Windows Installer Clean Up utility, see if Silverlight is still listed. If it is remove it using the Clean Up utility, which should remove any installer files and clean the registry entries. Then try the install again.

No, I've only used it in a web browser to play video on demand. I don't think I have any programs that use it normally. Strange, even once Silverlight stopped being offered through Microsoft Update on Windows XP machines, a manually downloaded and installed latest version has always worked for me. I don't usually bother uninstalling the previous version, but this last time I did. It still installed fine with no warning or error messages.

I suspect we'll have to put up with this at least until the "free update" window closes.

I've got the latest Silverlight (5.1.41212.0) installed here on XP and working fine. You can't use Silverlight on Chrome (or any other Chromium-based browser) now as it no longer supports it (or QuickTime and other Netscape plugins.) You have to use Firefox (32 bit only) or Internet Explorer. I suspect Silverlight's days are numbered......

Well the files I replaced were from 2008, so I guess those later versions have to be worth having! As long as you replace the versions in the DLLCache folder as well as those in the System32 folder, you shouldn't have any trouble with System File Protection.

Hi @SD73. Just download the update file from here. You will need to use Internet Explorer. Then run the downloaded file with the switches /q /x: "<outdir>" This should extract the files to a folder in the root of the drive and you will find the two files you need in there in the SP3QFE subfolder.

Well I've installed all the updates offered by Microsoft Update, and substituted the browseui.dll and shdocvw.dll files for the later versions (thanks @dencorso!), and no problems seen (touch wood!) This has fixed the blank dialogue box as mentioned by @Acheron above. Not something I'd ever noticed, but good that it's been fixed!

The Update Catalogue is here. The update will not install if you have IE8 installed. I extracted the files from it using Universal Extractor. I haven't tried it yet but I assume just replacing the browseui.dll and shdocvw.dll files in the system32 folder will do the trick. Easy for me as I have a multi-boot system, but it may have to be done in Safe Mode if you haven't. Don't forget to replace the files in the DLLCache folder too.

D'oh! Of course, silly me!

I've decided to completely roll back to 4.5.2015.10 until this is resolved. As a matter of interest, how are people managing to copy and paste the text from their error messages when you can't get fully to the desktop?

I'm not seeing the error message about RUNDLL32, but the first two appear to be the same errors I'm seeing. The system stops loading before any third one appears after I dismiss the first two.

I'm having a problem with the 4.5.2015.11 update, for the first time ever. After replacing the files in the KernelEx folder, Windows would not then load fully. It gets as far as the desktop, but then an error message saying that "Runonce" has performed an illegal operation pops up, closely followed by a message that "Explorer" has done the same. The load then stops. The culprit appears to be Kexbasen.dll. If I replace the new 4.5.2015.11 version with the previous 4.5.2015.10 version, leaving the other files as they are, it all comes good. The update batch file reports a syntax error, but I can't see what it is. It does seem to still execute as it should and put all the new files in the right place. Any suggestions as to what might be wrong?

OK, I've managed to fix most of my problems with EMET 4.1! Someone here had helpfully posted an export of their EMET 5.2 configuration, which seems to include up to date PinRules. I modified the file to remove all the applications that I don't have installed, and after importing it, I now have presumably 5.2's PinRules, which are still up to date, and no more errors in the Event Log! The only outstanding problem now is that I can't use the "Trust" button function because of the .NET exception error, which I will have to do more research on. EDIT: I've now fixed the crash when using the EMET Trust button! Turns out it was due to a Nokia application that I have installed to backup my phone adding some custom cultures to the system, which EMET doesn't like for some reason. I disabled them by renaming the files in the windows\globalization folder, and EMET now works fully. This does not seem to have affected the Nokia application either.

The second key does not exist on my system. The first one does and points to the "Dr. Watson" debugger. I tried deleting it, but it made no difference to the error in EMET. Incidentally I had to disable the "EAF" option for iexplore.exe in EMET, or Internet Explorer 8 would not load. That's a known issue IIRC, but most of the references I found were for fixing IE 11 on later systems with EMET. I seemed to need the fix on mine too!

Thanks again @heinoganda! I checked out that link, and looked at the registry entries referenced, and they seem to be correct as they should be on my system. I've now tried more versions of EMET, the only one I cannot find anywhere is version 3.0. I even found a copy of version 2.0, but that looked very crude and basic, so I don't really want to use that although it did seem to work correctly. Version 4.0 and 4.1 Update 1 are very similar. The only difference is that the tray icon works properly on 4.0. whereas on version 4.1 it just throws up a message saying that "admin privileges are required" when it's double clicked, for some completely unknown reason! I am an admin of course. Both 4.0 and 4.1 put errors in the Event Log on every boot saying that five "PinRules" have expired and need to be deleted or updated. Try as I might I cannot find how to actually update them, and I can't even delete them because apparently you need to go into the "Trust" button dialogue, and that's what is crashing on every version when I try to use it (except 2.0 which doesn't have it!) Version 5.1 (and presumably 5.2 would be the same) cause the error popup every time I try to use Acrobat Reader. Version 5.0 seems to be the best, although the "Trust" button crash is still there, and I'd rather not use it as it isn't designed for the OS. I would probably ideally like to use 4.0, but I don't want it filling my Event Log up with warnings all the time, so I need to get into that "Trust" dialogue, or (even better) find some way of updating these "PinRules". As I said earlier my research seems to indicate that "culture" errors in .NET applications are related to language configuration errors. I did try putting my machine into US English, but it made no difference. EDIT: Fixed the icon problem! Apparently it's a known problem with EMET 4.1. See here. All you have to do is add a "--NoRestart" switch to the registry entry to run EMET_Agent.exe at startup. So that's one thing fixed, and I'm happy with EMET 4.1 now apart form the Event Log entries and the crashes!

Wow, thanks @heinoganda! It never occurred to me that it would be something so simple! Your script wouldn't have worked for me as it was as I don't have EMET installed in its default location, but I just added the entry in the registry manually, and the system tray icon now works. The option to turn it on and off in the GUI doesn't work, but that's not an issue of course. I guess the installer missed adding the registry entry or something. Does the tray icon do anything else other than give another means to launch the GUI, such as balloon notifications of events? If it's only the former, I will probably disable it again anyway. The crash seems to be something to do with language settings as far as I can see, but all the references I've found to it are for programmers who are creating .NET applications. My Windows is set to UK English. Maybe I will try setting it temporarily to US English and see if the error goes away. I don't have Visual Studio installed. I will check out your links and report back. Cheers, Dave.

Thanks hmuellers! I now have a copy of EMET 5.0 installed, and the error popups on running PDF shortcuts have gone away. I saved the contents of 5.1's "Deployment" folder, as the files in there seem to unsurprisingly be newer than those in 5.0, so I substituted them, assuming the XML files are later certificate lists. That's certainly what they look like. 5.0 seems to work fine with them anyway. I might even try to use the ones from 5.2 as they will be even newer! My Event Log seems to be completely clean now, with no entries from EMET at all unless I change a setting. Internet Explorer 8 would not run at all with the default settings on EMET. I had to disable the "EAF" and "StackPivot" options on iexplore.exe to restore it to working. Don't know why that would be. The EMET icon still isn't working, but you say that is a known problem and isn't an issue for me. I'm still getting the crashes when I use the "Trust" button though, which I guess must be a .NET problem, as all versions of EMET fail there the same way. I've attached the full error log, which is meaningless to me I'm afraid. Can any .NET experts see what's happening there? Cheers, Dave. Error.txt

Thanks @hmuellers. That's very interesting about the error message you're seeing, because I'm now seeing that exact same message whenever I run a shortcut to a PDF file! If I dismiss it, Adobe Reader then opens and displays the file fine. As the error message box is apparently from AcroRd32.exe, I was assuming it was a problem with Adobe Reader, as the version I'm using (11.0.13) no longer officially supports XP, although it does install fine. I'm wondering if the message appeared after I installed EMET, I will have to uninstall it again to confirm that. I've not seen it in any other context but the running of PDF shortcuts. I will have to search for EMET 5.0 and try it if I can find a copy anywhere. I suspect that if 4.1 and 5.1 are both throwing the error on pressing the "Trust" button that 5.0 will be the same, but you never know! EDIT: Apparently the msvcrt error with EMET 5.1 on XP is known. See here and here. I'll see if I can find 5.0!

Just thought I'd report my experience today with EMET, something I wasn't at all familiar with before today. I downloaded and installed version 4.1 (Update 1) as recommended, and it seemed to work fine although it was throwing five warnings into my event log that five "PinRules" were out of date, having expired on 01/08/15. As I didn't want to just delete them, for obvious reasons, I looked into how to update them. I found what I thought was an answer here. I downloaded the "easy fix", which failed because I hadn't installed EMET in the default folder. To be fair, the page does warn you of that, but it's still stupid when the EMET installer allows you to choose a different installation destination! Anyway, I uninstalled EMET and reinstalled it in its default location, and the "easy fix" then completed successfully, but didn't fix the event log errors! There were a couple of other issues as well, the system tray icon didn't work as it should, it popped up a message saying "administrator rights needed" if you tried to use it, which is nonsense as I am an administrator of course! More seriously, pressing the "Trust" button at the top of the interface resulted in an exception error message coming up. I therefore decided to try a later version, although this isn't recommended. I installed version 5.1, which is not stated to be compatible with XP (although it is with Server 2003). That installed fine, and the error messages about expired certificates in the Event Log went away, so good result there! The only issues outstanding are that despite the fact that it appeared after the first install, the system tray icon now does not seem to appear at all, even when it's enabled, and the crash on using the Trust button still happens. I'm not worried about the icon obviously, but the crash is a strange one. As I said, it was doing the same with version 4.1, which is supposed to be compatible with XP, so it's a bit of a mystery why it's happening. Does this tie up with other people's experience with this? I appreciate this is a bit off-topic, but it is relevant to the thread as EMET is one of the recommendations to use for maximum security.

Thanks, that does sound like a good rule of thumb for how often it should be run, although obviously running it once a month say would do no harm.

I wouldn't have thought it was necessary to run the certificates updater program on every single boot, but you could set up a scheduled task to run it automatically every week say.

So if I have the installers for all six of these archived, I can safely delete and forget about the three that are listed as having been replaced?

I can't remember which one it was, but the discussion about it is in here somewhere! IIRC someone patched it, but that eventually turned out to be un-necessary as MS released a fixed version themselves. If you've installed all but the last few months worth I'm pretty sure that one would have been in there as it was quite some time ago now. If your fonts are OK, i wouldn't worry!