Member Avatar for LeonieJDB

C:\windows\system32\umxsbxexw.dll is either not designed to runon windows or it contains an error. try installing the original program again using the originalinstallation media or contact your system administrator or software vendor for support. How do i post a thread and where do i post it everytime i come into your site yolu change it and make it more difficult to get around i need to know how to gewt rid of this warning that keeps comeing up on my laptop what does it mean?

  • 3 Contributors
  • 10 Replies
  • 281 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Short summary and safe plan of action for the DLL warning: the message means Windows is trying to load a third‑party DLL at startup and the load is failing (corrupt, wrong version, or blocked). Follow the practical, low‑risk steps below — they expand on the uninstall/reinstall idea from and the removal caution from while adding safe diagnostics and recovery steps.

  1. Make a full backup or at least a System Restore point before changing system files.
  2. Find which product installed the DLL (check Programs and Features). If a security product is present, uninstall it cleanly, reboot, then reinstall the same (or a current) build. That often fixes broken helper DLLs.
  3. If the uninstaller fails, boot to Safe Mode and remove leftover startup hooks and services (use a startup/autorun viewer rather than deleting files blindly).
  4. If you must remove the single DLL, rename it first (add “.old”) while in Safe Mode, reboot and confirm no new errors — that preserves the file if you need to restore it.
  5. Run a current offline/rescue scan (or Microsoft Defender Offline) to rule out tampering before permanently deleting anything.
  6. After changes, reinstall the security product (if needed) and fully update it.

Helpful diagnostics (collect these before big changes so helpers can advise): copy the exact Event Viewer error text, save an autoruns/hijack log and the file’s Properties -> Digital Signatures page, and note whether the file is signed. Run a system file check:

sfc /scannow

Post the autoruns/hijack log and the Event Viewer entry if you want site members to review them; asked for that earlier and it will make targeted troubleshooting much faster. Final caution: do not permanently delete files from System32 without a backup or restore point — removing a legitimate security DLL can break the protection or the system.

Recommended Answers

All 10 Replies

Member Avatar for rch1231

Unless I am mistaken that is a virus dll that should be removed.

Member Avatar for gerbil

Naw. It's part of a Computer Associates firewall or AV service. Try uninstalling it, then reinstalling. Or just get a free AV/firewall package.

Member Avatar for gerbil

Perhaps not. But, UmxSbxExw.dll...
"User mode executive module helper DLL"
Publisher (Verified) CA
Entry path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
Entry name: UmxSbxExw.dll
Program path & name: "c:\windows\system32\umxsbxexw.dll"
Product Version info:- Host Intrusion Prevention System, File Version Copyright (c) 2006 CA
Perhaps the OP uses another, rebranded version - eTrust, Tiny Software, or a different CA component. The web is full of problems with it that arise after the installation of some other software. I think the practical solution is to totally remove and then reinstall the AV service.
I'm not even gunna ask what a secondary AV service is.

Edited by gerbil because: n/a
Member Avatar for rch1231

I do agree with Gerbil that removing and reinstalling should correct the issue however you need to make sure that it removes (or you remove if it doesn't during the uninstall) the UmxSbxExw.dll before you reinstall.

Gerbil is right and I was wrong about it being part of CA. It is in CA Security Suite and I am running an older version I received from my ISP a few years ago. It auto renews every day for another year but is old which is why it is my secondary anti-virus. By secondary I mean it is installed and updated but not resident. I use it to scan anything I am suspicious of and every now and then ( 1 in 150 +-) it will hit on something my Symantec misses. One is still one I don't need and it accessing files kicks the Symantec auto protect into play which catches the other 149. Just one Windows system left (everything else is Linux) and I do a lot of data conversions and data/file recovery. But this has nothing to do with the thread so I will stop now......

Member Avatar for gerbil

Gotcha, rch... you're using it as an on-demand scanner. I don't know the CA product now, so I don't know how that works... but as long as you don't have its services running, fine.
Interesting that installing new sware can damage that dll: there's a bug there somewhere.
That's another thing, ISPs and board manufs like to be a final solution for subscribers/buyers, and so a lot of them do offer a rebadged AV service from one of the majors. That is how I first came into contact with CA - a free offering with a mb.
Malware writers I think have to be very careful about not using a filename that is part of an AV service. One thing a good AV does is be very protective of itself; any unauthorized alteration and... WHINGE.

Edited by gerbil because: n/a
Member Avatar for LeonieJDB

the computer did not have AVG when the alarm first appeared?

Member Avatar for gerbil

Leonie, so that we may see what we are dealing with, could you do this, please?
Hijackthis - download the executable file from: http://www.bleepingcomputer.com/files/hijackthis.php
- unzip if necessary; copy hijackthis.exe to a new FOLDER placed either alongside your program files or on your desktop.
Start Hijackthis via the desktop icon or by dclicking hijackthis.exe.
- CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
- click the Scan and Save a Logfile button. Post the log here.

Member Avatar for LeonieJDB

ok that did not work it is still comming up on computer restart

Member Avatar for gerbil

I'm not surprised, Leonie. :) .... that scan only searches and lists vulnerable areas, by itself it makes no alterations. I need to see that logfile it produced - it likely will be in the folder in which you saved hijackthis.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.