Solved

get "Error loading winupd.dll" pop window after removing various adware/spyware

Posted on 2004-10-31
480 Views
Last Modified: 2013-11-13
Hi all.  Have a xp home sp1 on a machine that was loaded down with adware/spyware.  After attempts to clean the junk off of the machine using various programs, spybot s&d, adaware6, Norton, machine is cleaned up and all systems appear to be a go.  Only problem found is that every so often a error window pops up which says "Error loading winupd.dll" "The specific module could not be found".  I have tried to find this dll but it is no longer anywhere in the machine, at least not that I can find with the windows search.  I expect that there is still some piece of a an adware spyware program still existing in the machine that is still trying to run, but can't because of the missing dll.  How do I find this culprit and/or how do I stop this annoying pop up.  I can live with the program still being in there trying to run, it is not apparently affecting the speed or operation of the equipment.  Just don't want to have to keep closing this window all the time. Any help will be appreciated.  Thanks
0
Question by:bubblehead580
    19 Comments
     
    LVL 49

    Expert Comment

    by:sunray_2003
    Try this
    boot to normal mode
    go to start --> run--> msconfig

    go to startup tab and disable all applications except anti-virus and firewall
    go to services tab and check "hide microsoft services" and then uncheck all services there

    restart and check how it goes in normal mode

    http://windowsxp.mvps.org/Startup.htm
    0
     
    LVL 12

    Assisted Solution

    by:zvitam
    run

    http://www.cexx.org/LSPFix.exe

    ....Check 'I know what I'm doing'.
    Select ' inetadpt.dll '
    Click the right-pointing arrow.
    Click 'Finished'.
    Restart your computer.
    Delete the following file: %SystemDir%\inetadpt.dll


    Hope that helps,
    Zvitam.
    0
     
    LVL 13

    Expert Comment

    by:gonzal13
    Most likely the command is located in the registry and should be removed.
    Here are some help sites to avoid errors when modifying the registry:

    How To Use the Windows XP  Registry Editor Features


    http://www.majorgeeks.com/download460.html


    How To Add, Modify, or Delete Registry Subkeys and Values by Using a Registration Entries (.reg) File

    http://support.microsoft.com/default.aspx?scid=kb;en-us;310516


    gonzal13(joe)
    0
     

    Author Comment

    by:bubblehead580
    I kinda figured that there is something in the registry trying to run.  Problem is, how do I find where and what the entry is? I have disable all of the start up and service items.  Everything seems to work ok until I  open IE.  It appears that this is when I  start receiving the pop up error messages again. This may just be a coincencedence, I am not really sure.  I would like to be sure that I am taking out the right things before I start screwing with the registry. Zvitam, what is that "inetadpt.dll and %Systemdir%\inetadpt.dll" ?  is that some entry from some adware or spyware that you know of?
    0
     
    LVL 49

    Expert Comment

    by:sunray_2003
    Have you checked the startup entries in the link i had given in  my first comment..

    0
     
    LVL 49

    Expert Comment

    by:sunray_2003
    bubblehead580,

    Also do this
    open control panel
    go to internet options > advanced and uncheck " enable third party browser extensions"
    now restart

    check now what happens if you open IE

    Also use this http://windowsxp.mvps.org/toolbarcop.htm
    and remove any unwanted toolbars that might be causing this

    0
     

    Author Comment

    by:bubblehead580
    yes, didn't help me much...didn't see anything that appeared to be out of place....could be that I really don't know what I am looking for.  Don't you just hate stupid people?  
    0
     
    LVL 13

    Expert Comment

    by:gonzal13
    Sunray may walk you through the Regedit program and how to use the find command.

    I am not infront of the XP machine, but it should be simmilar to:

    Run
    type regedit
    click on edit
    click on find
    enter the item
    hit enter
    After it finds the first line of information you can just post it to this site

    Next go to edit, find, find next
    Post info on this site.

    This way if you are not familure how to  modify the line, someone can help you


    gonzal13(joe)
    0
     

    Author Comment

    by:bubblehead580
    ok, I will get the toolbarcop and use it.  There was a toolbar on this thing...just don't remember what it was...I have found that the winupd.dll  is associated with something from "Targetsoft", Adware log list it as a virtumundo object.  Don't know if that helps any, just thought that I would throw that in.  Thanks
    0
     
    LVL 49

    Accepted Solution

    by:
    bubblehead580,

    Did you run Hijackthis yet

    download and run Hijackthis.
    Download Hijacthis from here http://www.softpedia.com/public/cat/10/17/10-17-69.shtml.
    Get the log from Hijackthis and save the log and paste it here http://hijackthis.de/index.php?langselect=english to analyze it. The analyser site is used so that you donot gum up the thread with the entire log.

    Remove the bad ones that the site reports. If it says unknown process, then use a search engine to check if those are bad ones. If bad remove them , if you still cannot find then post those files alone here.
    0
     

    Author Comment

    by:bubblehead580
    Here is what HIJACK this came up with:

    O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.



     NOTE: I do not recognize any of the 4 entrys listed above.  They all look the same to me. I have tried running the spybot S&D... it is apparently not finding these entrys. I also do not recognize the following entrys.  These are all of the entrys that hijack this came up with.  What do you think?  

     
     
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/2984cdabb5815e571614/netzip/RdxIE2.cab    
    Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


      O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://www.wildtangent.com/multiplayer/cannonsmmp/wtinst.cab    
    Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


    O16 - DPF: {9FC87BC7-7963-4B70-8485-B1A41034C9A1} (CSonyPicturesGameDownloaderCtl Object) - http://www.shockwave.com/content/angelx/SonyPicturesGameDownloader.cab    
    Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


      O16 - DPF: {C7932801-AF0C-11D6-8137-0050DA5F0293} (RdxIE Class) - http://www.grokster.com/rdx/RdxIE.cab    
    Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.


    O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.sunterra.com/downloads/svh/svideo3.cab    
    Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!   Check if you know this site and fix it if you do not.
    0
     

    Author Comment

    by:bubblehead580
    Ok, think that I have just about got this one whipped.  I went to the CEXX site that Zvitam suggested.... didn't orginally understand enough about what was going on to understand what Zvitam was trying to get me to do.  His suggestion along with all of Sunrays help have almost got me there......one last thing to do....delete that file "%SystemDir%\inetadpt.dll".  I am not sure that I have found the right file to delete.  I only found one by doing a search and it is located at c:\windows\system32.  Is this file that I am supposed to delete and what do the percentage marks "%" mean when you see them used with a file like Zvitam did?  Thanks for all the help and hopefully this will finish this up.

    0
     
    LVL 49

    Expert Comment

    by:sunray_2003
    have you removed all these

    *************O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.

      O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll    
    Nasty   This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org or Spybot S&D from Kolla.de.   Check your hard disc drive with Spybot S&D from Kolla.de or LSPFix from Cexx.org.


    ********************

    and also remove the other ones also in your previous hijackthis log..
    0
     

    Author Comment

    by:bubblehead580
    Yes, all of the identified entrys from Hijack this have been removed.  
    0
     
    LVL 49

    Expert Comment

    by:sunray_2003
    even after removing all of them ,do you still have issues ?
    0
     

    Author Comment

    by:bubblehead580
    no, everything appears ok.....only question I got is do I still need to delete this file "%SystemDir%\inetadpt.dll".  as directed earlier by Zvitam?  I have only found one file named inetadpt.dll which is located at c:\windows\system32, do I need to delete it? And I am wondering what the "%" indicates in the file name that Zvitam sent.  
    0
     

    Author Comment

    by:bubblehead580
    we are in the middle of a lightning storm....will check back after it is gone.  Thanks for all of your help.
    0
     
    LVL 49

    Expert Comment

    by:sunray_2003
    if you are asking % in %systemroot% , it just means that if you put %systemroot% going to any location in your windows , your OS will know which place to go or in other words it will go to the location where your windows is installed , example if you had installed your OS in c:\windows and didnot know that , just go to start > run and give %systemroot% and the windows will display C:\windows

    Looks to me inetadpt.dll is not a needed file as it is concerned with targetsoft adware . Yes , you should remove it
    0
     

    Author Comment

    by:bubblehead580
    I split the points on this because Zvitam nailed it right off, but Sunray 2003 spent a lot of time and effort leading me through the correcting of this problem.   A very big thank you to all involved.  
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Suggested Solutions

    Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
    There is an easy way, in .NET, to centralize the treatment of all unexpected errors. First of all, instead of launching the application directly in a Form, you need first to write a Sub called Main, in a module. Then, set the Startup Object to th…
    The viewer will learn how to pass data into a function in C++. This is one step further in using functions. Instead of only printing text onto the console, the function will be able to perform calculations with argumentents given by the user.
    This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.

    913 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now