Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Iertutil.dll / Rundll Error / Loading Newdev.dll


  • Please log in to reply
9 replies to this topic

#1 FATROOFUS

FATROOFUS

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 10 April 2007 - 09:25 PM

windows xp pro SP2 is the OS.

What i was trying to do was download some poop off of bitlord, instead i got some kind of infection that brought up about 93 Internet Explorers. I couldnt stop them fast enough. So i just help down the alt F4 button and closed them all. I Dl'd and BOUGHT hxxp: //www.pesttrap.com and tried to hurry up and run it. It found many things, and i just quarantined them or deleted. Said to restart and do it again because it couldnt delete all of them on the first run for some reason. So i restarted and ran it again, while more popups are continuing on, the pest trap was finding even more. Finally, i dont remember what i did but i ended up getting frustrated and turned the computer off.

When i next booted i saw a new guest user. I went to control pannel and deleted it. Ended up shutting the pc down for some other reason again. Once i tried to start back up, nothing was there, no start menu, icons, task manager would say that it has been disabled by your administrator.
So i logged back off, and with F8 went into safe mode to turn it back on, low and behold. The administrators screens all jacked up, with some errors popping up saying.

Explorer.EXE -Unable To Locate Component

This application has failed to start because iertutil.dll was not found. Re-installing the application may fix this problem.

RUNDLL
Error loading newdev.dll
the specified modeule cold not be found.

But i could access msconfig, because i had it loaded on an xternal and and i used control alt delete to get to the hardrive. So i figured if i disabled everything in the start up maybe that would potentially fix the problem. It didnt!
So iam still stuck here, not able to access to many things (and only in safe mode, can i acccess anything) besides task manager

Iam on a different computer by the way Thanks

-Aaron

THIS APPLICATION HAS FAILED TO START BECAUSE IERTUTIL.DLL WAS NOT FOUND. RE-INSTALLING THE APPLICATION MAY FIX THIS PROBLEM.

Mod Edit: Disabled active link to malware site.

Edited by quietman7, 10 April 2007 - 09:42 PM.


BC AdBot (Login to Remove)

 


#2 FATROOFUS

FATROOFUS
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 10 April 2007 - 09:45 PM

Glad you edited that Quietman7, because i sure wouldnt want anyone else buying that either. =P Because it sure as hell didnt help me. =(

Edited by FATROOFUS, 10 April 2007 - 09:54 PM.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,139 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:16 PM

Posted 10 April 2007 - 09:55 PM

Have you tried "Last Known Good Configuration" or System Restore from a command prompt in "SAFE MODE" to return to a previous state before your problems began?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 FATROOFUS

FATROOFUS
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 10 April 2007 - 10:06 PM

No i had not. But i have now, and it did nothing. Any other things i should try?

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,139 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:16 PM

Posted 10 April 2007 - 10:09 PM

We have a self-help section for removing common malware. Please see the tutorial How to remove PestTrap.

When done run the the System File Checker (SFC) to scan all protected files to verify their versions. If SFC discovers that a critical system file has been damaged, altered or missing, it restores the correct version of the file from the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run sfc and it may ask you to insert your XP Installation CD so have it available.

To use System File Checker:
Go to Start > Run and type: sfc /scannow

Make sure that you include a space between the c and /. This command will initiate the Windows File Protection service to scan all protected files, verify their integrity, and replace any problem files.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 FATROOFUS

FATROOFUS
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 10 April 2007 - 10:48 PM

I did the first portion, for the pest removal and it gave me the log and everything after it was done on the note pad. Computer never restarted though. So i restarted, and tried the SFC and when i tried to run it, it stated and error of
" This application has failed to start because iertutil.dll was not found. Re-installing the application may fix this problem."

but here is the file from the note pad::



SmitFraudFix v2.166

Scan done at 20:19:55.57, Tue 04/10/2007
Run from E:\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 lavasoft.de
127.0.0.1 www.lavasoft.de
127.0.0.1 dnl-us3.kaspersky-labs.com
127.0.0.1 dnl-us4.kaspersky-labs.com
127.0.0.1 ftp.kaspersky.com
127.0.0.1 dnl-eu1.kaspersky-labs.com
127.0.0.1 dnl-eu2.kaspersky-labs.com
127.0.0.1 dnl-eu3.kaspersky-labs.com
127.0.0.1 dnl-eu4.kaspersky-labs.com
127.0.0.1 dnl-eu5.kaspersky-labs.com
127.0.0.1 eset.com
127.0.0.1 www.eset.com
127.0.0.1 u3.eset.com
127.0.0.1 u4.eset.com
127.0.0.1 symantec.com
127.0.0.1 www.symantec.com
127.0.0.1 avast.com
127.0.0.1 www.avast.com
127.0.0.1 dnl-ru1.kaspersky-labs.com
127.0.0.1 dnl-ru2.kaspersky-labs.com
127.0.0.1 dnl-ru3.kaspersky-labs.com
127.0.0.1 dnl-ru4.kaspersky-labs.com
127.0.0.1 dnl-ru5.kaspersky-labs.com
127.0.0.1 dnl-jp1.kaspersky-labs.com
127.0.0.1 dnl-jp2.kaspersky-labs.com
127.0.0.1 dnl-jp3.kaspersky-labs.com
127.0.0.1 dnl-jp4.kaspersky-labs.com
127.0.0.1 dnl-kr1.kaspersky-labs.com

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{085E9665-FC4C-4051-B01B-32FC81EEF69B}: DhcpNameServer=68.190.192.35 66.214.48.27
HKLM\SYSTEM\CS1\Services\Tcpip\..\{085E9665-FC4C-4051-B01B-32FC81EEF69B}: DhcpNameServer=68.190.192.35 66.214.48.27
HKLM\SYSTEM\CS2\Services\Tcpip\..\{085E9665-FC4C-4051-B01B-32FC81EEF69B}: DhcpNameServer=68.190.192.35 66.214.48.27


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Edited by FATROOFUS, 10 April 2007 - 10:58 PM.


#7 FATROOFUS

FATROOFUS
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 10 April 2007 - 11:13 PM

I have noticed though, that if i start in safe mode command... and i type in sfc (after c:\documents and settings\administrator.fatroofus>)

looks liek this... example

c:\documents and settings\administrator.fatroofus>sfc

that it says...
scans all protected system files and replaces incorrect versions with correct microsoft version.
SFC

/SCANNOW scan all protected system files immediately.

so i tried it, "c:\documents and settings\administrator.fatroofus>/scannow" and it then said...

the specific error code is 0x000006ba [the RPC server is unavailable.]

Any way that i could make it available, or am i stupid?

Edited by FATROOFUS, 10 April 2007 - 11:19 PM.


#8 FATROOFUS

FATROOFUS
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:16 PM

Posted 12 April 2007 - 10:39 PM

Okay, so as of now. I FINALLY got my desktop back.

But now i am getting an error of ORDINAL 56, when i try to do anything. With acception of exe (i think) programs

Any one still following this forum?

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,139 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:16 PM

Posted 13 April 2007 - 12:32 PM

That error message is usually associated with a .dll file like "The ordinal 56 could not be located in the dynamic link library iertutil.dll". Most of your errors seem to be associated with IE7. Have you tried to reinstall IE7 or maybe considered reverting back to IE6?

Since you have several issues going on it may be advisable to have a deeper look at your system by creating a hijackthis log.

Please read and follow all instructions in the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". You may have performed some of these steps already. If you can't perform a step, then skip and continue with the next. In step #9 there are instructions for downloading HijackThis and creating a log. (This is a self-extracting version which will automatically install HJT in the proper location.)

When you have done that, post your log in the HijackThis Logs and Analysis Forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. Please include the top portion of the HijackThis log that lists version information. An expert will analyze your log and reply with instructions advising you what to fix.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

If after 5 days you still have received no response, then post a link to your HJT log in the thread titled "Haven't Had A Reply In Five Days?".

After posting a log you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc.) unless advised by a HJT Team member. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make may cause confusion for the member assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 vicking68

vicking68

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:16 AM

Posted 24 September 2008 - 12:43 PM

HHello, I read with a lot of attention your message, for my part it réinstallanat the SP2 of Windows XP it to correct the problem. There are 2 options, that is to extract to do(throw) him(it) in command modus(Run, cmd, explane) or the reinstalment of the SP. For my part it to work very well and I have patcher the system with SP3. Good luck!
:thumbsup:: cool:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users