iexplore.exe - Application Error

[Guest]

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to initialize
properly (0xc0000005). Click on OK to terminate the application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get on the
internet, but it won't let me run windows updates. If I go directly to
microsoft.com, it crashes, and sends me back to my homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't really
find anything. I installed Netscape, and I'm able to get online with that
browser, but still not IE. I've attempted to uninstall IE and deleted
everything in the c:\program files\internet explorer folder. I reinstalled
IE, and still same result.

Event viewer doesn't give me any info other than the error. Any suggestions
would be greatly appreciated. I could take the easy way out and reinstall
Windows, but I'd really like to know what's causing this problem incase I run
into it again.

Thanks!

 

[Frank Saunders, MS-MVP OE]

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to initialize
properly (0xc0000005). Click on OK to terminate the application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get
on the internet, but it won't let me run windows updates. If I go
directly to microsoft.com, it crashes, and sends me back to my
homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't
really find anything. I installed Netscape, and I'm able to get
online with that browser, but still not IE. I've attempted to
uninstall IE and deleted everything in the c:\program files\internet
explorer folder. I reinstalled IE, and still same result.

Event viewer doesn't give me any info other than the error. Any
suggestions would be greatly appreciated. I could take the easy way
out and reinstall Windows, but I'd really like to know what's causing
this problem incase I run into it again.

Thanks!

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name you
can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Guest]

When I right click on RPCKDM, I don't get an export option, only "New, Find,
Delete, Rename and Copy Key Name". Should I just rename it?

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to initialize
properly (0xc0000005). Click on OK to terminate the application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get
on the internet, but it won't let me run windows updates. If I go
directly to microsoft.com, it crashes, and sends me back to my
homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't
really find anything. I installed Netscape, and I'm able to get
online with that browser, but still not IE. I've attempted to
uninstall IE and deleted everything in the c:\program files\internet
explorer folder. I reinstalled IE, and still same result.

Event viewer doesn't give me any info other than the error. Any
suggestions would be greatly appreciated. I could take the easy way
out and reinstall Windows, but I'd really like to know what's causing
this problem incase I run into it again.

Thanks!

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name you
can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Alan Edwards]

Use the Export option from the menu File-Export or Registry-Export
It does not appear in the right-click in all operating systems.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

When I right click on RPCKDM, I don't get an export option, only "New, Find,
Delete, Rename and Copy Key Name". Should I just rename it?

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to initialize
properly (0xc0000005). Click on OK to terminate the application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get
on the internet, but it won't let me run windows updates. If I go
directly to microsoft.com, it crashes, and sends me back to my
homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't
really find anything. I installed Netscape, and I'm able to get
online with that browser, but still not IE. I've attempted to
uninstall IE and deleted everything in the c:\program files\internet
explorer folder. I reinstalled IE, and still same result.

Event viewer doesn't give me any info other than the error. Any
suggestions would be greatly appreciated. I could take the easy way
out and reinstall Windows, but I'd really like to know what's causing
this problem incase I run into it again.

Thanks!

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name you
can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Frank Saunders, MS-MVP OE]

When I right click on RPCKDM, I don't get an export option, only
"New, Find, Delete, Rename and Copy Key Name". Should I just
rename it?

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to
initialize properly (0xc0000005). Click on OK to terminate the
application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get
on the internet, but it won't let me run windows updates. If I go
directly to microsoft.com, it crashes, and sends me back to my
homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't
really find anything. I installed Netscape, and I'm able to get
online with that browser, but still not IE. I've attempted to
uninstall IE and deleted everything in the c:\program files\internet
explorer folder. I reinstalled IE, and still same result.

Event viewer doesn't give me any info other than the error. Any
suggestions would be greatly appreciated. I could take the easy way
out and reinstall Windows, but I'd really like to know what's
causing this problem incase I run into it again.

Thanks!

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a
name you can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

As Alan said, highlight it and use File | Export.
Then please email a copy to me at
(e-mail address removed)

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Guest]

Thanks Frank, I emailed you the file.

When I right click on RPCKDM, I don't get an export option, only
"New, Find, Delete, Rename and Copy Key Name". Should I just
rename it?

When starting Internet Explorer I get the following error:

iexplore.exe - Application Error The application failed to
initialize properly (0xc0000005). Click on OK to terminate the
application.

I'm running Windows 2000, when I boot in safe mode, I'm able to get
on the internet, but it won't let me run windows updates. If I go
directly to microsoft.com, it crashes, and sends me back to my
homepage.

I've ran spybot / adaware and housecall.trendmicro.com, and didn't
really find anything. I installed Netscape, and I'm able to get
online with that browser, but still not IE. I've attempted to
uninstall IE and deleted everything in the c:\program files\internet
explorer folder. I reinstalled IE, and still same result.

Event viewer doesn't give me any info other than the error. Any
suggestions would be greatly appreciated. I could take the easy way
out and reinstall Windows, but I'd really like to know what's
causing this problem incase I run into it again.

Thanks!

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a
name you can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

As Alan said, highlight it and use File | Export.
Then please email a copy to me at
(e-mail address removed)

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Frank Saunders, MS-MVP OE]

Thanks Frank, I emailed you the file.

Thanks. Got one from someone, don't know whether or not it was you.
Haven't found where I put my ASCII conversion chart yet. Haven't used it in
years.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Robert Aldwinckle]

Thanks. Got one from someone, don't know whether or not it was you.
Haven't found where I put my ASCII conversion chart yet. Haven't used it in
years.

Frank,


Try using debug's E command instead? <eg>

Another tool I have used for the same effect is list.exe
(from the Support Tools.) But everybody has debug.exe

If it's just a few characters to decode use charmap.


Robert
---

 

[Frank Saunders, MS-MVP OE]

Frank,


Try using debug's E command instead? <eg>

Another tool I have used for the same effect is list.exe
(from the Support Tools.) But everybody has debug.exe

If it's just a few characters to decode use charmap.


Robert
---

I found my chart and it looks like machine code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
"data2"=hex:58,eb,ec,bd,44,7a,06,08,0a,0f,7e,0e,7c,12,09,08,7c,0b,12,0b,08,7b,\
0b,12,7e,0c,7e,09,12,07,0c,09,7b,06,0e,7a,7b,7b,0b,79,09,42
"data1"=hex:22,f8,9c,8b,71,7a,6c,69,7b,79,7b,7d

It's been way to long since I've used Debug and I can't get anything out of
it.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Guest]

Frank,

Deleting that file from the registry worked. Thanks!!

Frank,


Try using debug's E command instead? <eg>

Another tool I have used for the same effect is list.exe
(from the Support Tools.) But everybody has debug.exe

If it's just a few characters to decode use charmap.


Robert
---

I found my chart and it looks like machine code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
"data2"=hex:58,eb,ec,bd,44,7a,06,08,0a,0f,7e,0e,7c,12,09,08,7c,0b,12,0b,08,7b,\
0b,12,7e,0c,7e,09,12,07,0c,09,7b,06,0e,7a,7b,7b,0b,79,09,42
"data1"=hex:22,f8,9c,8b,71,7a,6c,69,7b,79,7b,7d

It's been way to long since I've used Debug and I can't get anything out of
it.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Robert Aldwinckle]

I found my chart and it looks like machine code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
"data2"=hex:58,eb,ec,bd,44,7a,06,08,0a,0f,7e,0e,7c,12,09,08,7c,0b,12,0b,08,7b,\
0b,12,7e,0c,7e,09,12,07,0c,09,7b,06,0e,7a,7b,7b,0b,79,09,42
"data1"=hex:22,f8,9c,8b,71,7a,6c,69,7b,79,7b,7d

It's been way to long since I've used Debug and I can't get anything out of it.

Agreed. That isn't ASCII characters (too much stuff under 20).
In fact, if it might be machine code using debug would make
just as much sense and be just as easy. (E.g. use the U command
instead of the D command to show an interpretation of the bytes.)

Here's how. Switch to a cmd window and enter debug.
If you enter a ? you can get a command summary.
Do an r and you'll see that the IP is always at 100.
So that's where I start.

Enter e 100 plus a space and then paste after it those pairs of hex characters
that represent the exported data bytes. You can even leave the commas
in the string you paste!

<example valuename="data2">
-e 100 58,eb,ec,bd,44,7a,06,08,0a,0f,7e,0e,7c,12,09,08,7c,0b,12,0b,08,7b,0b,12,7

-d 100
0B02:0100 58 EB EC BD 44 7A 06 08-0A 0F 7E 0E 7C 12 09 08 X...Dz....~.|...
0B02:0110 7C 0B 12 0B 08 7B 0B 12-07 96 F2 AE 34 00 F1 0A |....{......4...
0B02:0120 89 3E 21 96 BB 06 97 80-3E 13 96 00 74 03 BB 4C .>!.....>...t..L
0B02:0130 97 BE C3 96 8B 3E 05 98-B9 08 00 AC 3C 3F 75 02 .....>......<?u.
0B02:0140 8A 07 3C 20 74 01 AA 43-E2 F1 B1 03 B0 20 38 04 ..< t..C..... 8.
0B02:0150 74 12 B0 2E AA AC 3C 3F-75 02 8A 07 3C 20 74 01 t.....<?u...< t.
0B02:0160 AA 43 E2 F1 32 C0 AA C3-F6 46 04 02 75 43 8B D5 .C..2....F..uC..
0B02:0170 83 C2 05 57 B8 00 6C BB-40 00 33 C9 8B F2 BA 01 [email protected].....
-u 100
0B02:0100 58 POP AX
0B02:0101 EBEC JMP 00EF
0B02:0103 BD447A MOV BP,7A44
0B02:0106 06 PUSH ES
0B02:0107 080A OR [BP+SI],CL
0B02:0109 0F DB 0F
0B02:010A 7E0E JLE 011A
0B02:010C 7C12 JL 0120
0B02:010E 0908 OR [BX+SI],CX
0B02:0110 7C0B JL 011D
0B02:0112 120B ADC CL,[BP+DI]
0B02:0114 087B0B OR [BP+DI+0B],BH
0B02:0117 1207 ADC AL,[BX]
0B02:0119 96 XCHG SI,AX
0B02:011A F2 REPNZ
0B02:011B AE SCASB
0B02:011C 3400 XOR AL,00
0B02:011E F1 DB F1
0B02:011F 0A893E21 OR CL,[BX+DI+213E]
-
</example>

Hmm... evidently I can't concatenate the entire data2 string
and try to enter it as one piece. The command line length
or something restricts that. In particular notice that the interpreted
bytes at

0B02:0117 1207

would really be 127E because the truncation occurred in the middle
of a byte!

If I was going to redo it I would just do 16 bytes at a time.
However, this is enough to show that whatever it is isn't
meant to be executed either.


Robert
---

 

[Frank Saunders, MS-MVP OE]

I found my chart and it looks like machine code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
"data2"=hex:58,eb,ec,bd,44,7a,06,08,0a,0f,7e,0e,7c,12,09,08,7c,0b,12,0b,08,7b,\
0b,12,7e,0c,7e,09,12,07,0c,09,7b,06,0e,7a,7b,7b,0b,79,09,42
"data1"=hex:22,f8,9c,8b,71,7a,6c,69,7b,79,7b,7d

It's been way to long since I've used Debug and I can't get anything
out of it.

Agreed. That isn't ASCII characters (too much stuff under 20).
In fact, if it might be machine code using debug would make
just as much sense and be just as easy. (E.g. use the U command
instead of the D command to show an interpretation of the bytes.)

Here's how. SNIP

If I was going to redo it I would just do 16 bytes at a time.
However, this is enough to show that whatever it is isn't
meant to be executed either.


Robert
---

Anyhow, it doesn't help me figure out what installed the key.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/