Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

get "Error loading winupd.dll" pop window after removing various adware/spyware

Posted on 2004-10-31
19
Medium Priority
?
507 Views
Last Modified: 2013-11-13
Hi all.  Have a xp home sp1 on a machine that was loaded down with adware/spyware.  After attempts to clean the junk off of the machine using various programs, spybot s&d, adaware6, Norton, machine is cleaned up and all systems appear to be a go.  Only problem found is that every so often a error window pops up which says "Error loading winupd.dll" "The specific module could not be found".  I have tried to find this dll but it is no longer anywhere in the machine, at least not that I can find with the windows search.  I expect that there is still some piece of a an adware spyware program still existing in the machine that is still trying to run, but can't because of the missing dll.  How do I find this culprit and/or how do I stop this annoying pop up.  I can live with the program still being in there trying to run, it is not apparently affecting the speed or operation of the equipment.  Just don't want to have to keep closing this window all the time. Any help will be appreciated.  Thanks
0
Comment
Question by:bubblehead580
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 7
  • 2
  • +1
19 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12457160
Try this
boot to normal mode
go to start --> run--> msconfig

go to startup tab and disable all applications except anti-virus and firewall
go to services tab and check "hide microsoft services" and then uncheck all services there

restart and check how it goes in normal mode

http://windowsxp.mvps.org/Startup.htm
0
 
LVL 12

Assisted Solution

by:zvitam
zvitam earned 600 total points
ID: 12457203
run

http://www.cexx.org/LSPFix.exe

....Check 'I know what I'm doing'.
Select ' inetadpt.dll '
Click the right-pointing arrow.
Click 'Finished'.
Restart your computer.
Delete the following file: %SystemDir%\inetadpt.dll


Hope that helps,
Zvitam.
0
 
LVL 13

Expert Comment

by:gonzal13
ID: 12457552
Most likely the command is located in the registry and should be removed.
Here are some help sites to avoid errors when modifying the registry:

How To Use the Windows XP  Registry Editor Features


http://www.majorgeeks.com/download460.html


How To Add, Modify, or Delete Registry Subkeys and Values by Using a Registration Entries (.reg) File

http://support.microsoft.com/default.aspx?scid=kb;en-us;310516


gonzal13(joe)
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:bubblehead580
ID: 12457688
I kinda figured that there is something in the registry trying to run.  Problem is, how do I find where and what the entry is? I have disable all of the start up and service items.  Everything seems to work ok until I  open IE.  It appears that this is when I  start receiving the pop up error messages again. This may just be a coincencedence, I am not really sure.  I would like to be sure that I am taking out the right things before I start screwing with the registry. Zvitam, what is that "inetadpt.dll and %Systemdir%\inetadpt.dll" ?  is that some entry from some adware or spyware that you know of?
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12457720
Have you checked the startup entries in the link i had given in  my first comment..

0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12457776
bubblehead580,

Also do this
open control panel
go to internet options > advanced and uncheck " enable third party browser extensions"
now restart

check now what happens if you open IE

Also use this http://windowsxp.mvps.org/toolbarcop.htm
and remove any unwanted toolbars that might be causing this

0
 

Author Comment

by:bubblehead580
ID: 12457787
yes, didn't help me much...didn't see anything that appeared to be out of place....could be that I really don't know what I am looking for.  Don't you just hate stupid people?  
0
 
LVL 13

Expert Comment

by:gonzal13
ID: 12457802
Sunray may walk you through the Regedit program and how to use the find command.

I am not infront of the XP machine, but it should be simmilar to:

Run
type regedit
click on edit
click on find
enter the item
hit enter
After it finds the first line of information you can just post it to this site

Next go to edit, find, find next
Post info on this site.

This way if you are not familure how to  modify the line, someone can help you


gonzal13(joe)
0
 

Author Comment

by:bubblehead580
ID: 12457838
ok, I will get the toolbarcop and use it.  There was a toolbar on this thing...just don't remember what it was...I have found that the winupd.dll  is associated with something from "Targetsoft", Adware log list it as a virtumundo object.  Don't know if that helps any, just thought that I would throw that in.  Thanks
0
 
LVL 49

Accepted Solution

by:
sunray_2003 earned 1400 total points
ID: 12457871
bubblehead580,

Did you run Hijackthis yet

download and run Hijackthis.
Download Hijacthis from here http://www.softpedia.com/public/cat/10/17/10-17-69.shtml.
Get the log from Hijackthis and save the log and paste it here http://hijackthis.de/index.php?langselect=english to analyze it. The analyser site is used so that you donot gum up the thread with the entire log.

Remove the bad ones that the site reports. If it says unknown process, then use a search engine to check if those are bad ones. If bad remove them , if you still cannot find then post those files alone here.
0
 

Author Comment

by:bubblehead580
ID: 12458524
Here is what HIJACK this came up with:

O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.



 NOTE: I do not recognize any of the 4 entrys listed above.  They all look the same to me. I have tried running the spybot S&D... it is apparently not finding these entrys. I also do not recognize the following entrys.  These are all of the entrys that hijack this came up with.  What do you think?  

 
 
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/2984cdabb5815e571614/netzip/RdxIE2.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


  O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://www.wildtangent.com/multiplayer/cannonsmmp/wtinst.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (CSonyPicturesGameDownloaderCtl Object) - http://www.shockwave.com/content/angelx/SonyPicturesGameDownloader.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


  O16 - DPF: {C7932801-AF0C-11D6-8137-0050DA5F0293} (RdxIE Class) - http://www.grokster.com/rdx/RdxIE.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.sunterra.com/downloads/svh/svideo3.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.
0
 

Author Comment

by:bubblehead580
ID: 12458775
Ok, think that I have just about got this one whipped.  I went to the CEXX site that Zvitam suggested.... didn't orginally understand enough about what was going on to understand what Zvitam was trying to get me to do.  His suggestion along with all of Sunrays help have almost got me there......one last thing to do....delete that file "%SystemDir%\inetadpt.dll".  I am not sure that I have found the right file to delete.  I only found one by doing a search and it is located at c:\windows\system32.  Is this file that I am supposed to delete and what do the percentage marks "%" mean when you see them used with a file like Zvitam did?  Thanks for all the help and hopefully this will finish this up.

0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12458782
have you removed all these

*************O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

  O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.


********************

and also remove the other ones also in your previous hijackthis log..
0
 

Author Comment

by:bubblehead580
ID: 12458837
Yes, all of the identified entrys from Hijack this have been removed.  
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12458878
even after removing all of them ,do you still have issues ?
0
 

Author Comment

by:bubblehead580
ID: 12458916
no, everything appears ok.....only question I got is do I still need to delete this file "%SystemDir%\inetadpt.dll".  as directed earlier by Zvitam?  I have only found one file named inetadpt.dll which is located at c:\windows\system32, do I need to delete it? And I am wondering what the "%" indicates in the file name that Zvitam sent.  
0
 

Author Comment

by:bubblehead580
ID: 12458929
we are in the middle of a lightning storm....will check back after it is gone.  Thanks for all of your help.
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12458932
if you are asking % in %systemroot% , it just means that if you put %systemroot% going to any location in your windows , your OS will know which place to go or in other words it will go to the location where your windows is installed , example if you had installed your OS in c:\windows and didnot know that , just go to start > run and give %systemroot% and the windows will display C:\windows

Looks to me inetadpt.dll is not a needed file as it is concerned with targetsoft adware . Yes , you should remove it
0
 

Author Comment

by:bubblehead580
ID: 12459335
I split the points on this because Zvitam nailed it right off, but Sunray 2003 spent a lot of time and effort leading me through the correcting of this problem.   A very big thank you to all involved.  
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show, step by step, how to integrate R code into a R Sweave document
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This tutorial explains how to use the VisualVM tool for the Java platform application. This video goes into detail on the Threads, Sampler, and Profiler tabs.
The viewer will learn additional member functions of the vector class. Specifically, the capacity and swap member functions will be introduced.
Suggested Courses

597 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question