Jump to content


Photo

Shell.dll missing


  • Please log in to reply
10 replies to this topic

#1 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 19 July 2004 - 03:54 PM

I finally got rid of Home Search, using a combination of CWShreader, Spybot, Ad-aware, TrojanHunter, Registry mechanic, and PCBug Doctor.

I have one remaining problem after all the 'fixing.'

I use a rolodex program called Sharkware. When I start it I get an error message which says: Cannot find SHELL.DLL

Following is an excerpt from CEShredder scan only report:
Hosts file not present
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe

I've reinstalled Sharkware, but to no avail. same error message.

I've downloaded a new shell.dll, and replaced the old one. still same message.

so, How can I put that registry value back?
Thanks in advance. Jashac

#2 racooper

racooper

    Master of my own Domain

  • Emeritus
  • PipPipPipPipPip
  • 1,420 posts

Posted 20 July 2004 - 11:44 PM

I'm sorry, but we need some additional information beore we can help. For example, which version of Windows are you running? version of Internet Explorer? Patch level?

I realize that you have already cleaned up your system, and I congratulate you. However, I would still recommend posting a HijackThis log, as it will contain information (such as I mentioned above) that will help resolve your issue.

Download 'Hijack This!'. http://www.spywarein.../HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents here. I don't believe that there will be anything to fix, so just post the log and we'll try and help!

#3 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 22 July 2004 - 09:59 AM

HospitalPCTech Thanks for looking,
Following is my hijackThis log:

Logfile of HijackThis v1.98.0
Scan saved at 9:55:14 AM, on 7/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Wintab32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\GeoGraphix\Tools\GGXNASrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\Program Files\GeoGraphix\AdaptiveServer80\win32\dbsrv8.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\GeoGraphix\Tools\GeoSync.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\PROGRA~1\Dantz\RETROS~1\ComboButton.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [MaxtorCombo] "C:\PROGRA~1\Dantz\RETROS~1\ComboButton.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.9\THGuard.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office Fast Start.lnk = C:\MSOffice\Office\FASTBOOT.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\MSOffice\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.skibanff....sCamControl.ocx
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corporate.vecta-exp.com
O17 - HKLM\Software\..\Telephony: DomainName = corporate.vecta-exp.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corporate.vecta-exp.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = corporate.vecta-exp.com


As I mentioned it's the Shell.dll missing entry (I think) which seems to be causing the problem.
Also missing mhgcal.vbx.

Any ideas as to how to restore what is needed?
Thanks,
JashaC

#4 racooper

racooper

    Master of my own Domain

  • Emeritus
  • PipPipPipPipPip
  • 1,420 posts

Posted 22 July 2004 - 11:32 AM

I'm looking over your log and doing some research on the vbx file. I'll be back with you on this shortly!

#5 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 22 July 2004 - 11:55 AM

Mhgcal.vbx
Used to display and select dates from a monthly calendar.
You can display and select multiple dates, display a 3-D
appearance around the edge of the control as well as the current
selected date, control colors, display an image in the background
or at the top of the control, and support multiple languages.

Download here:
http://www.rdg.mirro...BX?extract=true

(*48.7K 04-Jun-1996 )
That's an App specific file. Not Windows file.
I'm Not sure about the version or location.

As for shell.dll, it's known and caused by one cws trojan.
Search for it in:
-System32 folder
-System folder
-System32\dllcache folder.

If it's reported missing it's probably missing from System32.
Replace it by copying it from one of the other locations (it should exist in all 3)

Good luck :D
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#6 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 22 July 2004 - 05:35 PM

Wonderful,
The shell.dll was missing from system32. When I replaced it that error dissappeared.
:D

I've messed with the MGHCAL.VBX. It exists in Windows/system and Windows/system32. I downloaded another version and tried it.

I reinstalled Sharkware (the application I'm having trouble with)

I still get the error message:
Can't load Custom Control DLL: C:\windows\system\MHGCAL.VBX

It's there, and I've substituted an older version, and replaced it then with the newer version. No luck

Thanks a bunch for helping with the Shell.dll.
Any ideas about the MHGCAL
Thanks again, jashac

#7 racooper

racooper

    Master of my own Domain

  • Emeritus
  • PipPipPipPipPip
  • 1,420 posts

Posted 22 July 2004 - 06:05 PM

did you delete (or rename) the existing mhgcal.vbx before reinstalling Sharkware? The installer may have not overwritten the file if it was present on the system.

#8 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 23 July 2004 - 10:02 AM

I renamed the file before copying the downloaded version into the folder.
Restarted
and then tried it

I've tried with both the old and new.

The thing that's bugging me is that it was working before the Hijack. So if the .vbx file is there, why won't it load? An older version (the one I downloaded) ought to be even better, given that the application (Sharkware) is a Windows 98 version program.

I'm really at a loss.

Ideas?

#9 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 26 July 2004 - 05:45 PM

Even more wierd...

I loaded the problem program (Sharkware) on my home computer which runs Windows XP (not pro).
It runs fine.
I copied all the VBX files and transplanted them to my work system. I still get the same error message.

#10 racooper

racooper

    Master of my own Domain

  • Emeritus
  • PipPipPipPipPip
  • 1,420 posts

Posted 26 July 2004 - 10:44 PM

One more thought, brought up by one of the Moderators: have you completely removed Sharkware from your system (down to backing up the data files and uninstalling/deleting all files and folders, including the VBX files) and then reinstalling? That's about the last thing I can come up with. Please let me know if you have tried that, and if not, can you try it and let me know if it made a difference?

#11 jashac

jashac

    Member

  • Full Member
  • Pip
  • 17 posts

Posted 28 July 2004 - 09:38 AM

Racooper,
Thanks for the thought.

Sharkware does not show up on the Add or Remove Programs list. And it does not have it's own uninistall.

I have deleted all the files I can find, but the install program still thinks Sharkware is still installed, and provides the option to update, or reinstall. I chose reinstall.

I think if I could really do a fresh install that would solve the problem, but I haven't figured out how to totally rid the system of all remnants.

This is really a hassel, but I have all my contacts, and history, an notes in this data base.

thanks again for your help and suggestions.
Jashac :cool:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button