Solved

Problems with RUNDLL32 and inetcpl.cpl causing IE and Outlook to disconnect from Internet

Posted on 2004-08-12
25
1,253 Views
Last Modified: 2008-01-09
Everytime I use IE or Outlook on Windows XP I eventually must end the process because it is not responding. The only way I can use the applications which run on Windows XP, is by opening Internet Options in the control panel and delete temporary internet files. When I attempt to delete the temporary internet files I get the following error:

An exception occurred while trying to run "shell32.dll, Control_RunDLL "C:\Windows\System32\inetcpl.cpl", Internet Options

After saying ok to this error I can use IE and Outlook again. I have tried re-installing Outlook and IE, but still no success. I scan my pc using Symantec Anti-Virus and my computer is clean.  
I uninstall my Yahoo! Messenger and that didn't remove the problem. I renamed inetcpl.cpl and re-installed the file and still the same problem. Any ideas?
0
Comment
Question by:utsolutions
  • 7
  • 7
  • 4
  • +2
25 Comments
 
LVL 4

Expert Comment

by:tmireles
ID: 11785895
You might want to try to run sfc /scannow from the run command.  This will repair any files that got corrupted.  You will need your XP disk for this though.  Here is a link to a website with some good instructions on how to use it.

http://www.updatexp.com/scannow-sfc.html

I hope it helps.

0
 
LVL 20

Expert Comment

by:DVation191
ID: 11786181
try using toolbarcop to remove any malware you might have attached to IE...
http://www.mvps.org/sramesh2k/toolbarcop.htm
0
 
LVL 3

Expert Comment

by:StGoY
ID: 11787171
0
 

Author Comment

by:utsolutions
ID: 11788481
I did the scf  /scannow and I used a Windows XP 1a CD and I still have the same problem. The toolbarcop will not resolve the problem either. Re-installing IE has not helped either. I appreciate the suggestions.
0
 
LVL 4

Expert Comment

by:tmireles
ID: 11788568
Have you tried checking for spyware with either spybot or adaware.  

http://www.safer-networking.org/en/mirrors/index.html

http://www.lavasoftusa.com/support/download/

Install these programs and then run the check for updates on each one.  Then run them and see if this removes some.  If there was a lot of stuff in there then post back with a hijack this log.

Hijack this:

http://www.spychecker.com/program/hijackthis.html



0
 
LVL 2

Expert Comment

by:ajschroh
ID: 11792836
Yeah that looks like browser hijack (malware) or redirection gone very wrong.  I highly recommend using Ad-Aware from Lavasoft (http://www.lavasoftusa.com/support/download) and also check your hosts file in c:\windows\system32\drivers\etc and make sure you don't have any entries redirecting sites to a third party (like Igetnet does).  Might also be worth your time to grab the LSP Explorer from Lavasoft as well.  Various Malware apps install LSP's into your network stack to act as a "man in the middle".
0
 
LVL 20

Expert Comment

by:DVation191
ID: 11793227
I agree with the browser hijack issue, which is why I suggested toolbarcop to delete anything that is attached to IE. I can't tell if the author tried it or just disregarded it.
0
 

Author Comment

by:utsolutions
ID: 11793553
I think I should also add that IE and Outlook hang and are not responding. I have to end task these applications, got to the control panel, attempt to delete the temporary internet files and restart both apps. The hosts file is empty, spybot did not fix the problem, and neither did toolbarcop.
0
 
LVL 4

Expert Comment

by:tmireles
ID: 11794368
I think you are going to have to post a hijackthis log file in order for us to help you.  Did spybot find a lot of stuff in there?  If so please post a hijackthis log file so that we can help you better.  Just save the log after you run it and then copy the entire contents and paste it in here.
0
 

Author Comment

by:utsolutions
ID: 11795044
I just ran Hijack this and this came up in the log file:

Logfile of HijackThis v1.97.7
Scan saved at 1:21:36 PM, on 8/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Crystal Decisions\2.0\bin\querysrv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\WINDOWS\SYSTEM32\MMC.EXE
C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Epic\EPIC.exe
C:\Documents and Settings\administrator.NYBFUDOMAIN\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr6/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr6/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://dell.mmguide.musicmatch.com/aod/aodPromo.cgi?reference=1&name=MC%20Hammer%20-%20Artist%20MATCH&params=stationid%3Dartist%26artistid%3D344236%26aod%3DAM%26xml%3Dstrict&sname=MC%20Hammer%20-%20Artist%20MATCH
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec AntiVirus\vptray.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/183436063a9284cccd22/netzip/RdxIE601.cab
O16 - DPF: {5A66E13A-311D-488B-828D-DDDF52EFB636} (strprint.trprints) - https://partnering.one.microsoft.com/mcp/tools/MCPTranscriptPrint.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = NYBFUDOMAIN.ORG
O17 - HKLM\Software\..\Telephony: DomainName = NYBFUDOMAIN.ORG
O17 - HKLM\System\CCS\Services\Tcpip\..\{96E4ABE9-D8CA-455C-AFC5-4EED801D1C0E}: NameServer = 192.168.32.2,199.45.45.14
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = NYBFUDOMAIN.ORG
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = NYBFUDOMAIN.ORG
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = NYBFUDOMAIN.ORG

I hope that someone can take a look and see what might fix my problem. Thanks for everyone's help to this point.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 4

Expert Comment

by:tmireles
ID: 11795348
It looks like you might have a virus.  I would recommend that you do an update on your AV program and then reboot in safe mode and run a scan.  Make sure that your virus definitions are up to date.

You also want to fix the following:

O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL

O4 - HKLM\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe

O4 - HKCU\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe


This last one appears to be a virus :  WINdirect.exe

It appears to be the w32.beagle or bagle depending on what AV company you look at.  Since it appears that you are running Norton I will refer you to them:

http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.ao@mm.html


I would follow the instructions that they recommend for removal.  

Here is the link for the removal tool also:

http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle@mm.removal.tool.html

Run this and see if this solves some of your problems.


0
 
LVL 20

Expert Comment

by:DVation191
ID: 11795372
Yea you definitely didnt use toolbarcop right, the mysearch bar is still there and you still have a BHO called mybar.dll ... both of which toolbarcop can easily remove
0
 
LVL 4

Expert Comment

by:tmireles
ID: 11795433
I agree with you DV.
0
 

Author Comment

by:utsolutions
ID: 11796228
I just updated the virus definition files on my pc and Symantec is finding hundreds of instances of the w32.beagle.AO@mm. It is all over my pc. I hope this fixes the problem.
0
 
LVL 20

Expert Comment

by:DVation191
ID: 11796267
maybe you should turn liveupdate on automatic? just a thought :)
0
 
LVL 4

Expert Comment

by:tmireles
ID: 11796299
Probably will not solve all the problems but at least it is a starting point.

After it gets done I would still download the removal utility and run that as well.  Better safe than sorry on stuff like this.  

Also be sure that you are booted into safe mode when you run both of these.
0
 

Author Comment

by:utsolutions
ID: 11797105
I ran the removal utility and I got rid of the mysearch bar in safe mode. UNfortunately the problems still exists. I still get an exception error when I attempt to delete temporary internet files in the INternet options in the control panel.
0
 
LVL 4

Expert Comment

by:tmireles
ID: 11797812
If you are clean of viruses and spyware try and either run a repair on internet explorer.

http://support.microsoft.com/default.aspx?kbid=318378

If this doesn't work then try the first method that I told you about which is the sfc /scannow.

If the first doesn't fix the problem and you try the sfc/scannow then make sure you restart the computer after this is done.

Let us know.
0
 

Author Comment

by:utsolutions
ID: 11815915
I ran sfc /scannow and I still have the same problem. Is there anyway to replace rundll32? I also notice that my yahoo! messenger is also hanging as well.
0
 
LVL 3

Accepted Solution

by:
StGoY earned 250 total points
ID: 11976773
Well you could always try a repair installation

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP:
http://support.microsoft.com/?kbid=315341

Or this site explains a Repair with pics: (Click on How To Run a Repair Install)
http://www.webtree.ca/windowsxp/repair_xp.htm

Steph
0
 

Author Comment

by:utsolutions
ID: 13592977
I have tried all the recommended fixes and my computer still has trhe same problem. I just gave up on finding a resolution.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Introduction How to create multiboot configuration with XP\Vista and Windows 7 on it? And most important question - how to do this correctly so not to have any kind of nightmares we get when system gets screwed? First of all one should realize t…
Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now