We help IT Professionals succeed at work.

OL98: Nimda hit--Can't open messages-- Riched20.dll error

borleymsgs
borleymsgs asked
on
We got hit by Nimda.  I have basically recovered, but I cannot open my Outlook 98 messages.  I get the message "Unable to load riched20.dll.  You may be out of memory, out of system resources, or missing a .dll file"

I have have 128meg of RAM and system resources run about 80%.  Per Knowledge Base artcle Q198282, I have renamed riched20.dll and have extracted a new one using System File Checker to no avail.  And I have uninstalled Outlook 98, rebooted, and reinstalled it.  Still no luck.  I can open messages in Outlook Express with no problem and it seems to use the riched20.dll file.

I am running Win98 SE and recovered from Nimda by using a patch from Panda which examined the programs and files for infection and disinfected them.  Although I can't say that everything is 100% normal, the PC seems to work satisfactorially.

I am out of ideas.  I hope someone can help!!!
Comment
Watch Question

Commented:
you haven't completely fixed your system. You need to replace your riched20.dll with a fresh copy and then run an antivirus scan again.

riched20.dll was one of the virus files (tho windows does use the real one). You should also do a search for *eml and *nws files. If you find any, do NOT click on them, instead, use the Select All option and delete them.
BRONZE EXPERT

Commented:

Author

Commented:
Thanks for the responses.  I agree that I have not completely fixed my system--that is my problem.  

--I have run two different antivirus programs to fix the Nimda problem, Pandsoftware and Symantec.  
--I had previously  deleted all .eml and .nws files and have checked again for them.  
--I have deleted riched20.dll, uninstalled Outlook98 and Word97, rebooted, reinstalled Outlook98 and Word97, and extracted riched20.dll from my Window98 SE CD using System File Checker.  

And I still have the same message!

Any further suggestions????
BRONZE EXPERT

Commented:
Hmmm did you extract riched20.dll the 'oldfashioned way'?
Do not use SFC but do a file  |  find and look for all versions of the riched20.dll file and rename to old.  Then reboot with a w98 boot disk (with cd-rom support) have your w98 cd handy and extract from command prompt?
extract /a d:\win98\win98_40.cab riched20.dll /L c:\windows\system

Author

Commented:
Well, I've tried that, too, with no success.  

To be safe, after renaming riched20.dll, I did another File|Find to make sure I got them all.  Then did the extract per the old fashioned way, then did another File|Find to make sure it ended up in the right place, but again no luck and again the same message.  I did another virus check just to verify that nothing is resident.

This is really perplexing me.  The PC seems pretty normal otherwise.

Any other ideas???
BRONZE EXPERT

Commented:
Per chance do you use 'user profiles?'

Author

Commented:
No, I do not use "user profiles".
BRONZE EXPERT

Commented:
Perhaps your pst file is corrupt?  Run Scanpst.exe.

Author

Commented:
I thought you were onto something.  I did a Find|File for all of the .pst files and scanned each one using scanpst.exe.  And, I found several files that needed repair.  However, they were older ones on the root of c:.  Naturally, I did repair them.  And to be safe, in case they somehow affected riched20.dll, I again renamed it and extracted it again using the "old fashioned" method.

And, you guessed it, unfortunately, the error message is still there, preventing me from opening the Outlook messages.  Good idea, though!
BRONZE EXPERT

Commented:
Still thinking - this is a witch of a question . . .
BRONZE EXPERT

Commented:
Try renaming all the *.psts including current in use.  Then move the psts to a backup folder and let Outlook create a new pst.  Now to test - send yourself a test message and open to see if you get the error?  Import PST file back - error?

http://support.microsoft.com/support/kb/articles/q181/0/14.asp

http://support.microsoft.com/support/kb/articles/q184/8/17.asp
BRONZE EXPERT

Commented:
What version of Internet Explorer and Outlook Express do you have?

Author

Commented:
Thanks for the suggestion about renaming my .pst files, and for the KB links.  I will try them ASAP.  In the meantime, my versions of IE and OL are:

Internet Explorer 5.5 SP2 Ver 5.50.4807.2300

Outlook98  Ver 8.5.5104.6

Author

Commented:
I renamed every .pst file, but them into a backup folder, started Outlook 98 and it created a new folder.  But I couldn't create a new message, as the same error message appeared.
BRONZE EXPERT
Commented:
Close out of Outlook 98 (check ctrl-alt-del) to make sure that outlook is not running.  Go to file |  find   and look for    extend.dat
delete it.

If this does nothing - create a new outlook profile?

Author

Commented:
Before I do that (which I do not mind doing) I just noticed that I get a very similar error message when trying to save selected text to WordPad--the message refers to riched20.dll file not being available.  Could we be mistakenly blaming Outlook?  Could it be a Windows problem?  But, if so, what would it be???

Commented:
I talked to our IT guy who cleaned our network - he suggested a new profile. I also found out that the norton clean up tool is 100% - over the weekend, he found new corruptions - user profiles were corrupted and had to be recreated (scenario: he was reconfiguring some pcs and was logged in as himself - no problems. this morning the users log in as themselves and WHAMMO! nothing wanted to work. So, he recreated the profiles from scratch and all was well). so far...

Author

Commented:
starl - when you refer to profile, are you talking about an Outlook profile or user profile for Windows?

Author

Commented:
The problem has finally gone away!  And I am not sure why I had such a hard time getting it to go away--I am perplexed and perhaps you can shed some light on the situation.

A little bit ago I tried deleting extend.dat and rebooted.  It did not seem to help, so I shut down for the day.  In the process of shutting down another PC, I happened to look at an earlier virus deletion report and noticed that numerous riched20.dll files were affected.  Out of curiosity, I did a file find for riched20.dll and found that it existed in several directories.  Believing that this was not the case on mine, I went back to my PC, booted it up, and did a file find.  To my consternation I found over 40 riched20.dll's, all with a date of  4/23/99 9:22 PM and size 49,152 bytes.  When checking the properties, the description was Outlook Express and Internal Name of MSIMN and Product Name of MS Windows 2000 Operating System!!  Plus there was one file in Windows\Systems that seemed good.  All of the files except the file in the System folder and one erroneous one were shaded out.

I am absolutely positive that I did all of my previous searches from the root of C: and had the subfolder checkbox checked.  But, these files never showed up before.  Why would they now, and why would they be grayed out?  I deleted all of the grayed out files, but the one erroneous one that was not grayed out would not permit renaming or deleting, even though I had no Office applications open.  I renamed the one in the Systems folder and rebooted and then successfully renamed the erroneous file.  I then reinstalled Outlook and saw that another riched20.dll file had been installed.  So, I tried Outlook and it worked!!  

Previously this afternoon, I ran another anti-virus program (McAfee's nimdascn.exe), but it did not report finding anthing.

Do you have any ideas why these files never showed up before?  And why were they grayed (shaded) out?

Incidentally, I am finding the identical files on the second PC that I referred to.  So I suspect that this was a by-product of Nimda that still needs to be dealt with.

I sincerely appreciate all of the help you have given me.  Your responses kept me going with this problem without giving up.  Thank you very much.
BRONZE EXPERT

Commented:
Sheesh - I gave you the extend.dat answer here - and I just responded to another question that you had awarded me points in for almost the same type problem (now I am really confused!)
As I responded in the other post - I was going to look for the extend.dat post - well here it is pal!

Commented:
why the files weren't there - b/c you were still infected - right clicking on an infected *dll will reinfect you all over again - we had that happening here. The way to delete the infected files safely is to do a search for them, choose select all and use the delete button - DO NOT right-click on them - that's as good as opening them up!

Author

Commented:
shekerra - sorry I confused you.  See my Word post for an explanation.

starl - obviously you are correct.  But how do you know you have infected files if the anitvirus software gives you an all clear?  And I agree that the safe way to get rid of infected files is to delete them, but I was told to rename riched20.dll which I did by right-clicking on it.

To all:
I still have these questions:
1)  What does the extend.dat file do?
2)  How do you delete files that do not show up in Find|File?  Is there a setting I should have changed?
3)  Can a person rename a file with the F2 key without opening it up?

I hope someone will answer out of the kindness of their heart, even though there are not points involved.

Thanks
BRONZE EXPERT

Commented:
1. Extend.dat contains reference to what addins you have installed in outlook.
Check here is registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Extensions
The add-ins are listed in the left pane under the Data key.
It could be that the virus also might have something to do with an addin that possibly went 'undetected' - I really do not know.
2. Find/files will not show 'hidden files' if under 'do not show hidden files' is checked under view | folder options settings.
3. Rename a file:  Yes just open up a command prompt and cd to directory where file is located that you wish to rename.  
type:
ren rename.txt rename.old
If file is hidden or system you would attrib it first:
attrib -s -h -r rename.txt rename.old

Author

Commented:
Thanks for the information.  

I did not know that right clicking a file was essentially the same as opening it.

There is no problem in using DOS--I just didn't know that it had its advantages in situations like this.  What will we do with Windows XP?  As I understand, it does not allow any usage of DOS.

As I've said before, I'm always learning and always will be learning.  That is the fun of PC's!