IEXPLORE.EXE - Application Error (IE6)

[Jeff Gibson]

Looks like I have been hit by what a few other individuals have reported
here.

Somehow got redirected to another website. Can't remember the combination.

Got a Java Script popup window that requested my name.

I immediately hit cancel, but IE6 locked up. When I tried to launch IE6
again I got the following...

IEXPLORE.EXE - Application Error

The application failed to initialize properly (0xc0000005). Click on OK to
terminate the application.

I have ran Adaware, SbyBot, HijackThis, CWShredder and CCleaner. I have
updated the definitions on everything that required. Per these programs in
their current state, I am clean.

I downgraded to IE5. I was able to get into that. Upgraded again to IE6.
Same error again. So I am back down to IE5.

FWIW, I am running Windows 2000 SP4 with every update applied. Including
the updates to IE6.

Any info anybody hears about would be greatly appreciated.

Jeff Gibson

 

[Guest]

Backup and delete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]

Cheers,

Bruce

 

[Jeff Gibson]

Got to hand it to you Bruce.

What a FIND!!

Great job tracking this issue down. The only problem I was having right
now, is that my system keeps telling me it wants to install the KB823353 fix
for Outlook Express 6. Problem is it's already installed. I told it to
ignore that issue for now to see if that helps out.

What did you use to track that issue down? I tried dependency walker to see
what files were being interacted with, but it didn't get very far.

Anyway, thanks again for the info. Back up and running here now.

Jeff Gibson

Backup and delete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]

Cheers,

Bruce

Looks like I have been hit by what a few other individuals have reported
here.

Somehow got redirected to another website. Can't remember the combination.

Got a Java Script popup window that requested my name.

I immediately hit cancel, but IE6 locked up. When I tried to launch IE6
again I got the following...

IEXPLORE.EXE - Application Error

The application failed to initialize properly (0xc0000005). Click on OK to
terminate the application.

I have ran Adaware, SbyBot, HijackThis, CWShredder and CCleaner. I have
updated the definitions on everything that required. Per these programs in
their current state, I am clean.

I downgraded to IE5. I was able to get into that. Upgraded again to IE6.
Same error again. So I am back down to IE5.

FWIW, I am running Windows 2000 SP4 with every update applied. Including
the updates to IE6.

Any info anybody hears about would be greatly appreciated.

Jeff Gibson

 

[mccartjt]

Backup and delete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]

Cheers,

Bruce

Looks like I have been hit by what a few other individuals have reported
here.

Somehow got redirected to another website. Can't remember the combination.

Got a Java Script popup window that requested my name.

I immediately hit cancel, but IE6 locked up. When I tried to launch IE6
again I got the following...

IEXPLORE.EXE - Application Error

The application failed to initialize properly (0xc0000005). Click on OK to
terminate the application.

I have ran Adaware, SbyBot, HijackThis, CWShredder and CCleaner. I have
updated the definitions on everything that required. Per these programs in
their current state, I am clean.

I downgraded to IE5. I was able to get into that. Upgraded again to IE6.
Same error again. So I am back down to IE5.

FWIW, I am running Windows 2000 SP4 with every update applied. Including
the updates to IE6.

Any info anybody hears about would be greatly appreciated.

Jeff Gibson

Bruce

Regarding

"iexplore.exe the application failed to initialize properly
(0xc0000005) "

Thanks for the leg work here. I saved myself a bunch of time on backing
up and deleting that key in the registry.



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]


.. I am back up and running now . Not a problem.. VERY GRATEFUL. I
didn't want a days work formatting/ re-installing all the same software
again!!. Thanks again

John McCarthy

 

[tomlegg]

I benefited from your advice as well Bruce. Much appreciated.
Tom

 

[krs]

Hi Bruce--

I have the EXACT same issue as the one Jeff had. What exactly do i
need to do?
How do I "Backup and Delete" the [HKEY...] string?

I'm a little bit of a newbie here...

Thanks!
KRS

 

[Frank Saunders, MS-MVP OE]

Hi Bruce--

I have the EXACT same issue as the one Jeff had. What exactly do i
need to do?
How do I "Backup and Delete" the [HKEY...] string?

I'm a little bit of a newbie here...

Thanks!
KRS

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name you
can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[RWS]

Hi Bruce--

I have the EXACT same issue as the one Jeff had. What exactly do i
need to do?
How do I "Backup and Delete" the [HKEY...] string?

I'm a little bit of a newbie here...

Thanks!
KRS

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name you
can remember. Then right click it again and select Delete.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

------------------------------------------------------------------------------------
Is there any information as to what entity is responsible for:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
??????
Just curious
Thank you
------------------------------------------------------------------------------------

 

[jocoo]

This information is very helpful, I'm having exactly the same problem. Forgive me if this is just too obvious, but I've followed the instructions till I located the registry file, but when I right click, there is no option to export. Is it necessary to export or can I just delete? Win 2000 Pro SP4.

Hope someone can put me right,

Thanks,

John.

 

[Frank Saunders, MS-MVP OE]

"krs" <[email protected]>
wrote in message

Hi Bruce--

I have the EXACT same issue as the one Jeff had. What exactly do i
need to do?
How do I "Backup and Delete" the [HKEY...] string?

I'm a little bit of a newbie here...

Thanks!
KRS

Go to Start | Run and type
regedit
and press <Enter>.
In the left column navigate to
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
and highlight it. Right click it and select Export, giving it a name
you
can remember. Then right click it again and select Delete.

Is there any information as to what entity is responsible for:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
??????
Just curious
Thank you

Not that I know of yet. I'd sure like to know.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[EQStoli]

Thank you soooo much for this fixed. Deleting that reg key worked
perfectly. Any idea how this happened in the first place?

 

[Frank Saunders, MS-MVP OE]

Thank you soooo much for this fixed. Deleting that reg key worked
perfectly. Any idea how this happened in the first place?

No, I don't know what is causing it. I haven't actually seen a machine with
the problem.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Raffi]

Same problem on 10th December...
GREAT solution... Many thanks
I'm VERY curious to find out where on earth you found this RPCKDM solution
Bruce ...???
Cheers
Raffi

 

[Frank Saunders, MS-MVP OE]

Same problem on 10th December...
GREAT solution... Many thanks
I'm VERY curious to find out where on earth you found this RPCKDM
solution Bruce ...???
Cheers
Raffi

Actually, I found it reading this newsgroup. That's where I find a lot of
what I know. I do wish I knew what puts that key into the Registry.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Robert Aldwinckle]

Is there any information as to what entity is responsible for:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
??????

Not that I know of yet. I'd sure like to know.

What is KDM? Looks like a third-party thing?

An Export may give you some clues from any additional subkeys,
value names and values but I suspect the real common factor
would show up in people's HJT logs.

Also, if it comes back running RegMon could perhaps track down
the module which creates it. Etc.


Hmm... KDM == "Key Distribution Manager"?

http://www.iana.org/assignments/port-numbers

(MSN search for
RPC KDM
)

<quote>
kdm 2115/tcp Key Distribution Manager
kdm 2115/udp Key Distribution Manager
</quote>


In that case they could use netstat to see if any program
was using that port. And in XP you could use the new
options for discovering the modules in the stack.
Capture the output so you can do a find for that port.
E.g. enter in a cmd window:

netstat -abov >netstat.txt
and
notepad netstat.txt

Then press F3 and do finds for 2115. Etc.


Robert Aldwinckle
---

 

[Dave]

Bruce, I sure hope your using this gift to make money. Your "fix" to
this problem was right on. Thank you. You no doubt saved me from a
format. U R the man!!!!! Dave

 

[smbiondi]

Thank you so much! I also had the exact same situation and it worked
like a charm. How did you find that???

Sandie Biondi

Backup and delete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]

Cheers,

Bruce

Looks like I have been hit by what a few other individuals have reported
here.

Somehow got redirected to another website. Can't remember the combination.

Got a Java Script popup window that requested my name.

I immediately hit cancel, but IE6 locked up. When I tried to launch IE6
again I got the following...

IEXPLORE.EXE - Application Error

The application failed to initialize properly (0xc0000005). Click on OK to
terminate the application.

I have ran Adaware, SbyBot, HijackThis, CWShredder and CCleaner. I have
updated the definitions on everything that required. Per these programs in
their current state, I am clean.

I downgraded to IE5. I was able to get into that. Upgraded again to IE6.
Same error again. So I am back down to IE5.

FWIW, I am running Windows 2000 SP4 with every update applied. Including
the updates to IE6.

Any info anybody hears about would be greatly appreciated.

Jeff Gibson

 

[pieter.metallica]

This seems to be the general consensus:

http://www.geekstogo.com/forum/index.php?showtopic=84382

Most (if not all) of the victims have Win2K boxes and received an
advertisement popup. Afterwards IE no longer wants to start.
Maybe it corrupts something that was fixed in IE SP2

Regards,

Pieter Arntz, MS-MVP Security



Frank Saunders, MS-MVP OE wrote:

Is there any information as to what entity is responsible for:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]
??????
Just curious
Thank you

Not that I know of yet. I'd sure like to know.

--