bakemono wrote on 2025-10-29, 08:43:

maybe check the registry to see what it's trying to run at startup time. software/microsoft/windows/currentversion/run (or something like that)

These are what load on startup, according to regedit, and what I have disabled:

asdf53 wrote on 2025-10-29, 09:08:

Download FileMon 7.04, open the filter dialog. […]
Show full quote

Download FileMon 7.04, open the filter dialog.

You have two options: You can either enter the file name (xit) into the filter, FileMon will then tell you which program is trying to access that file at any moment. One problem is that if you don't know the file path, only the name, you have to work with wildcards (*xit*) and you'll probably get tons of unrelated results.

Or, enter a program name that you suspect, then see which files it's trying to access at launch. FileMon will then log the program activity and show you everything it's trying to access.

bakemono wrote on 2025-10-29, 08:43:

maybe check the registry to see what it's trying to run at startup time. software/microsoft/windows/currentversion/run (or something like that)

Yep, that's a great idea. If you're getting the error at boot, it's most likely a program that's being run from the Autorun key. For example, if "C:\creative\mixer.exe" (just an example) is in that list, you would add "c:\creative\mixer.exe" to the FileMon filter, then launch mixer.exe manually and see what happens.

And related to that, try disabling the HPT controller in the BIOS and hook up your drives to the first controller. There are so many reports online on that controller being buggy and corrupting other devices on the PCI bus. If you rule that out first, it might save you a lot of time troubleshooting.

Just tried FileMon and when selecting Find and searching for ‘xit’ just gives me no results found straight away. With Filter I just get a blank screen, so it can’t find anything with that word.

I’ll have to try enabling every startup item and see if it repeats the error and records anything.

I'd like an image of the 'Xit not found' error message, if possible.

wierd_w wrote on 2025-10-29, 17:37:

I'd like an image of the 'Xit not found' error message, if possible.

Sure thing. It’s just getting it to do it. 😅 When I don’t want it, it happens. And then when I do - nothing. As I said before, if I don’t get that error, I’ll get the SB audio cut the startup sound off and then I get no sound until I switch the between the cards/audio device.

I suspect there must be a bug with the drivers I managed to find/get working, but I’ve no idea if there’s a patch.

Also, I noticed in FileMon that it was unable to find/load Rundll32…? And then just now got this:

Rundll32 is a system process for executing procedure calls contained inside .dll files.

THIS is the kind of thing that dependency walker is for, if you can trigger the exception.

This is one of those 'basically useless and unhelpful' error messages windows loves to deliver.

All it says is

'hey, some executable dll procedure made rundll32 real mad. Which one? Who cares. Which procedure call? Why do you want to know!? I quit!'

Which is not very useful, but microsoft sure seems to think it is.

Dependency walker will tell you the things you really want to know.

I kind of became a bit distracted with another problem. An old favourite game of mine won't install for some weird reason, so I'm trying to figure out what's been installed or done that's preventing it from working. So I had to make an image/backup of the drive so I can remove stuff to find the cause. It wasn't the sound card's drivers anyway, which I uninstalled. I've re-installed them from scratch, so I'll see if that error pops up again.

Ha. Okay, I did a fresh install of Windows for the benefit of troubleshooting this game. All I've installed are the USB drivers, enabled the boot menu, and copied/pasted Ghost. I then created my first image, loaded back into Windows, aaaaaand... greeted with the same error message. 🤣

So it's clearly not related to my audio drivers. So possibly Ghost or the USB drivers...?

EDIT: Hmm. It's done something it hasn't done before anyway. It's automatically installed some Yamaha audio drivers for my ISA sound card. WDM ones, which I don't want. So maybe that's causing it...?

Not having any luck with this so far. I can’t seem to pinpoint where/what it’s related to and I’m not seeing any clues in FileMon. I expect Dependency Walker will only be of use if I knew exactly what file it was linked to…? 😕

DustyShinigami wrote on 2025-10-31, 19:34:

Not having any luck with this so far. I can’t seem to pinpoint where/what it’s related to and I’m not seeing any clues in FileMon. I expect Dependency Walker will only be of use if I knew exactly what file it was linked to…? 😕

Can you describe step by step what you're doing?

I just tested it, entered "xit" as the FileMon include filter and then ran "xit" - using Start Menu > Run, and programmatically using ShellExecuteEx, which is probably what the offending program is doing. I'm getting the same error popup "Cannot find the file 'xit' (or one of its components)..." and a list of entries appear in the FileMon window that show which program triggered the access.

You obviously have to run the actual program that will trigger the access - so go through the Start Menu's autorun entries and also the registry entries and run each of these programs/commands manually once FileMon is running.

asdf53 wrote on 2025-11-01, 09:44:

Can you describe step by step what you're doing? […]
Show full quote

DustyShinigami wrote on 2025-10-31, 19:34:

Not having any luck with this so far. I can’t seem to pinpoint where/what it’s related to and I’m not seeing any clues in FileMon. I expect Dependency Walker will only be of use if I knew exactly what file it was linked to…? 😕

Can you describe step by step what you're doing?

I just tested it, entered "xit" as the FileMon include filter and then ran "xit" - using Start Menu > Run, and programmatically using ShellExecuteEx, which is probably what the offending program is doing. I'm getting the same error popup "Cannot find the file 'xit' (or one of its components)..." and a list of entries appear in the FileMon window that show which program triggered the access.

You obviously have to run the actual program that will trigger the access - so go through the Start Menu's autorun entries and also the registry entries and run each of these programs/commands manually once FileMon is running.

I see. Usually when I load FileMon, it’s after the error comes up, but it doesn’t seem to register it and only adds entries from the moment it’s loaded, but never anything from before.

So I need to run ShellExecuteEx? Or type ShellExecuteEx xit?

I’ll also do a search in regedit for anything called xit. See what turns up there, if anything. Thanks.

DustyShinigami wrote on 2025-11-01, 11:47:

I see. Usually when I load FileMon, it’s after the error comes up, but it doesn’t seem to register it and only adds entries from […]
Show full quote

asdf53 wrote on 2025-11-01, 09:44:

Can you describe step by step what you're doing? […]
Show full quote

DustyShinigami wrote on 2025-10-31, 19:34:

Not having any luck with this so far. I can’t seem to pinpoint where/what it’s related to and I’m not seeing any clues in FileMon. I expect Dependency Walker will only be of use if I knew exactly what file it was linked to…? 😕

Can you describe step by step what you're doing?

I just tested it, entered "xit" as the FileMon include filter and then ran "xit" - using Start Menu > Run, and programmatically using ShellExecuteEx, which is probably what the offending program is doing. I'm getting the same error popup "Cannot find the file 'xit' (or one of its components)..." and a list of entries appear in the FileMon window that show which program triggered the access.

You obviously have to run the actual program that will trigger the access - so go through the Start Menu's autorun entries and also the registry entries and run each of these programs/commands manually once FileMon is running.

I see. Usually when I load FileMon, it’s after the error comes up, but it doesn’t seem to register it and only adds entries from the moment it’s loaded, but never anything from before.

So I need to run ShellExecuteEx? Or type ShellExecuteEx xit?

I’ll also do a search in regedit for anything called xit. See what turns up there, if anything. Thanks.

That's to be expected, this is why you have to manually trigger the error after loading FileMon. Since your error appears at boot, it's likely triggered by one of the autorun programs, either in the start menu or in the registry.

Example: You have "C:\creative\mixer.exe" under "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run". You would then copy the mixer.exe command from the registry and run it with Start menu>run while FileMon is running. Repeat for all remaining entries until the error appears.

ShellExecuteEx isn't a program, it's a Win32 API call that a program uses internally to run another program. This causes the actual "file not found" popup that you're getting.

asdf53 wrote on 2025-11-01, 12:10:

That's to be expected, this is why you have to manually trigger the error after loading FileMon. Since your error appears at boo […]
Show full quote

DustyShinigami wrote on 2025-11-01, 11:47:

I see. Usually when I load FileMon, it’s after the error comes up, but it doesn’t seem to register it and only adds entries from […]
Show full quote

asdf53 wrote on 2025-11-01, 09:44:

Can you describe step by step what you're doing?

I just tested it, entered "xit" as the FileMon include filter and then ran "xit" - using Start Menu > Run, and programmatically using ShellExecuteEx, which is probably what the offending program is doing. I'm getting the same error popup "Cannot find the file 'xit' (or one of its components)..." and a list of entries appear in the FileMon window that show which program triggered the access.

You obviously have to run the actual program that will trigger the access - so go through the Start Menu's autorun entries and also the registry entries and run each of these programs/commands manually once FileMon is running.

I see. Usually when I load FileMon, it’s after the error comes up, but it doesn’t seem to register it and only adds entries from the moment it’s loaded, but never anything from before.

So I need to run ShellExecuteEx? Or type ShellExecuteEx xit?

I’ll also do a search in regedit for anything called xit. See what turns up there, if anything. Thanks.

That's to be expected, this is why you have to manually trigger the error after loading FileMon. Since your error appears at boot, it's likely triggered by one of the autorun programs, either in the start menu or in the registry.

Example: You have "C:\creative\mixer.exe" under "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run". You would then copy the mixer.exe command from the registry and run it with Start menu>run while FileMon is running. Repeat for all remaining entries until the error appears.

ShellExecuteEx isn't a program, it's a Win32 API call that a program uses internally to run another program. This causes the actual "file not found" popup that you're getting.

Right. Gotcha. I’ll do some digging over the weekend if it pops up again. I’m sure it will. Thanks.

Here's another thing you can try:

Run FileMon, open the filter dialog, enter "xit", press OK, close FileMon. Open FileMon again to verify that it remembered the filter setting (it does by default). Then:

Run regedit, go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices, and add a new string value (name doesn't matter), then right click it and "change", enter "c:\filemon\filemon.exe -q" or whatever its located at. "-q" means no user prompt at launch. Reboot.

In theory, this should run FileMon as early as possible in the boot process, so if it loads fast enough, it'll already be listening when the program that causes the error starts.

asdf53 wrote on 2025-11-01, 15:14:

Here's another thing you can try: […]
Show full quote

Here's another thing you can try:

Run FileMon, open the filter dialog, enter "xit", press OK, close FileMon. Open FileMon again to verify that it remembered the filter setting (it does by default). Then:

Run regedit, go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices, and add a new string value (name doesn't matter), then right click it and "change", enter "c:\filemon\filemon.exe -q" or whatever its located at. "-q" means no user prompt at launch. Reboot.

In theory, this should run FileMon as early as possible in the boot process, so if it loads fast enough, it'll already be listening when the program that causes the error starts.

Awesome. Thanks for the tip. 😁 I'll give that a go now.

Yeah, when I want it to come up with the error, it suddenly becomes too shy. 🤣