Re: urlmon.dll error on IE6

J

Jim Byrd

Hi Anne and Chris - I assume that you both are running IE6SP1 (Open IE6,
then click on Help|About to see the version). If so, try downloading
and installing the Cummulative Update 818529, here:

http://download.microsoft.com/download/E/E/F/EEFAA3CD-7DE2-4DD0-8299-229527AB00D3/q818529.exe

See if that solves it for you. If you still have problems, please post
back in this same thread.


--
Regards, Jim Byrd, MS-MVP
Please respond in original thread in Newsgroup.




In [email protected], Anne typed:
 
A

Anne

Hi Jim,

I am not able to download anything as I keep getting the
same error that IE has encountered an error and needs to
close. My internet service is provided by Comcast through
a cable modem. I am not sure if that could have anything
to do with it. Thanks for your help.
 
A

Anne

Hi again,

version: 6.0.2800.1106IC
cipher strength: 128-bit
update versions: SP1
product ID: 55736-843-3980895-04816

The error I received while trying to open Hijack This.exe
was: "a required .DLL file, MSVBVM60.dll, was not found."

I have not had problems while starting or shutting down my
computer. The error I receive while on the internet seems
to be the problem, other than the error I received trying
to open the Hijack This file.

I did have this posting half written when a screen just
took over my computer. It did not have any way to close
it that I could see. It was some sort of internet search
that did not show the address. I tried a right mouse
click to see if I could close it but it wasn't an option.
I tried ctrl-alt-del and tried to end task but it shut
down my machine. Any ideas on that? Thanks, Anne
 
A

Anne

I tried to reinstall the Windows 5.6 Scripting Engine and
I got the same error I have been getting re: urlmon.dll

I will try to save it to disk or CD at work tomorrow and
see if I can load it that way. I don't think my IE will
let me download anything or save from a source on the
internet.

Thank you so much for all your help. I will post back
once I reinstall that file.

Take care,
Anne
 
R

Robert Aldwinckle

....
Agreed. IE6.00.2800.1188 is *not* a valid IE version.

PMFJI but why not assume that she already has 818529?
Then 6.0.2800.1188 makes sense as ModVer of urlmon.dll
(Subject: of this thread)

Then I would wonder if she has the right copy of that module?

So some potentially clarifying diagnostics would be:

javascript:navigator.appMinorVersion

(to see what exactly is supposedly applied)

and

cd \windows\system
dir urlmon.dll

(to see date and size of module.) Notice from manifests in 818529
that versions for other OS have different sizes and timestamps.


I think that some of the confusion may be due to the fact that the
Error Signature was probably transcribed manually rather than being
captured to the Clipboard. To capture the Error Signature drag the
mouse over the text and press Ctrl-c (unfortunately there is no right-click
menu there). Then paste that result instead of having to type it all.

In particular then we could see if she was really seeing this:

If so, urlmon.dll will be a victim not a culprit.


Robert Aldwinckle
---
 
A

Anne

Hi,

I verified the error signature and that is exactly how it
reads. I did perform all the critical updates which
include 818529 but I am still receiving the error.

When I get the error, it does give me the option to send a
report. I am not sure where the report is sent. Should I
try and capture that data. It looks like a lot of data.
Any ideas would be greatly appreciated. Thank you, Anne
 
P

PA Bear

Earlier on the 17th, OP corrects initial post and states IE Help>About
displays '6.0.2800.1106IC'.

AFAIK even with Q818529 installed, IE Help>About will still display
6.00.2800.1106, Robert. Have you seen otherwise?[/QUOTE]
 
P

PA Bear

If you find a Details button in the error (unlikely), press it, copy
whatever it says and post it in a reply.

You state that you've installed Q818529. Please confirm the following:

1. IE Help>About>Update Versions> Q818529 is found here;

2a. Mshtml.dll is version 6.0.2800.1170;

2b. Shdocvw.dll is version 6.0.2800.1203;

2c. Urlmon.dll is version 6.0.2800.1188.

[Search for (WinKey+F) each of the above
files>right-click>Properties>Version]

3. If you have Yahoo Companion (Toolbar) or Google Toolbar installed,
uninstall it via Add/Remove Programs.
--
HTH...Please post back to this thread

~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE)
http://mvp.support.microsoft.com
 
A

Anne

IE information: version: 6.0.2800.1106IC
Update versions: SP1; Q818529; Q330994; q313829

I verified each file and they all had the version that you
listed. I don't have Yahoo companion or Google toolbar
installed. thanks again. Anne

-----Original Message-----
If you find a Details button in the error (unlikely), press it, copy
whatever it says and post it in a reply.

You state that you've installed Q818529. Please confirm the following:

1. IE Help>About>Update Versions> Q818529 is found here;

2a. Mshtml.dll is version 6.0.2800.1170;

2b. Shdocvw.dll is version 6.0.2800.1203;

2c. Urlmon.dll is version 6.0.2800.1188.

[Search for (WinKey+F) each of the above
files>right-click>Properties>Version]

3. If you have Yahoo Companion (Toolbar) or Google Toolbar installed,
uninstall it via Add/Remove Programs.
--
HTH...Please post back to this thread

~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE)
http://mvp.support.microsoft.com
there is no
right-click
.
 
R

Robert Aldwinckle

I verified the error signature and that is exactly how it

In that case you had better use an anti-virus application
because iexplorer.exe is a known trojan.
(The real Internet Explorer main application module
is iexplore.exe (no trailing r).)

When I get the error, it does give me the option to send a
report. I am not sure where the report is sent. Should I
try and capture that data.

No just capture the text in the Error Signature using the technique
I mentioned. Unfortunately there is no easy way to capture the extended
diagnostics apart from PrintScrn which is ridiculous.

Any ideas would be greatly appreciated. Thank you, Anne

Did you understand my point about capturing the size and date
of your urlmon.dll using a dir command in a command window?

I guess you should also do the same thing with that

iexplorer.exe

you appear to have.


Good luck

Robert
 
R

Robert Aldwinckle

PA Bear said:
Earlier on the 17th, OP corrects initial post and states IE Help>About
displays '6.0.2800.1106IC'.

AFAIK even with Q818529 installed, IE Help>About will still display
6.00.2800.1106, Robert. Have you seen otherwise?

PA Bear,

That is the application version. I'm saying that the numbers in question
are from the *Module* version. The module is urlmon.dll, the Subject
of this thread. I'm sure if Anne captures the Error Signature instead
of trying to transcribe it that things will be clearer. (I'm still hopeful that
rather than there being a real Trojan we're just getting led astray by some
typos.)


Robert
---
 
P

PA Bear

I see your point. I had assumed that in...

<paste>
AppName: iexplorer
ModVer: 6.0.2800.1188
AppVer: 6.0.2800.1106
[the 2 versions above may have been inadvertently switched as a typo]
Offset: 000082a2
Modname: urlmon.dll
</paste>

....6.0.2800.1188 was pointing to 'iexplore(r)' and 6.0.2800.1106 was
pointing to 'urlmon.dll'.

I certainly *hope* all the above were typos.[/QUOTE]
 
A

Anne

Hi Robert,

AppName: iexplore.exe AppVer: 6.0.2800.1106 ModName:
urlmon.dll
ModVer: 6.0.2800.1188 Offset: 000082a2

The above is the copy/paste of an error I just got. It
says iexplore.exe I may have tranposed the original
error but I have received it many times and each time
wrote it on a piece of paper and those say iexplorer.exe

I did a file search for iexplorer.exe and didn't find
anything. I work at Western WA University and downloaded
McAfee Virus Scan from our computer website on CD so I
could reinstall it this evening. It is 4.5.1 SP1. I
uninstalled my old version and reinstalled the new one. I
did a full system scan and found nothing.

I did not understand how to capture the size and date of
the urlmon.dll using a dir command in a command window. I
am definitely learning more about computers but consider
myself a novice.

I appreciate your help. Thanks, Anne

-----Original Message-----

In that case you had better use an anti-virus application
because iexplorer.exe is a known trojan.
(The real Internet Explorer main application module
is iexplore.exe (no trailing r).)

<
http://www.symantec.com/avcenter/venc/data/backdoor.tourniq
..html >
 
R

Robert Aldwinckle

Anne said:
Hi Robert,

AppName: iexplore.exe AppVer: 6.0.2800.1106 ModName:
urlmon.dll
ModVer: 6.0.2800.1188 Offset: 000082a2

The above is the copy/paste of an error I just got. It
says iexplore.exe I may have tranposed the original
error but I have received it many times and each time
wrote it on a piece of paper and those say iexplorer.exe

Great. That's what I was hoping you would find.

I did a file search for iexplorer.exe and didn't find
anything. I work at Western WA University and downloaded
McAfee Virus Scan from our computer website on CD so I
could reinstall it this evening. It is 4.5.1 SP1. I
uninstalled my old version and reinstalled the new one. I
did a full system scan and found nothing.
Whew!



I did not understand how to capture the size and date of
the urlmon.dll using a dir command in a command window. I
am definitely learning more about computers but consider
myself a novice.

The Command window has its own Edit menu.
You can select a block of text using your keyboard's cursor keys,
then press Enter to copy the selection into the Clipboard.
I recently discovered that at least on XP there is also a right-click
mouse menu which may be easier but in either case the Mark command
always starts at the top of the window. Press Shift when you want to
change the Mark into a selection.

I don't have your OS but I suspect you could find a Help panel which
may give you a different description of this if you need it. For example,
I just pressed Win-F1 and entered command, edit, mark, select, shift
and found that that selected the help item:
"Copy text from a command prompt window"

Serendipity: in the Related Topics there is a link to
"Copy and Paste MS-DOS text using the mouse"
Thank you for making me find that!

I appreciate your help. Thanks, Anne


Happy to help

Robert
---
 
A

Anne

Hi Robert,

I am hoping the text below is what you were asking for.

Microsoft(R) Windows 98
(C)Copyright Microsoft Corp 1981-1999.

C:\WINDOWS>cd \windows\system

C:\WINDOWS\SYSTEM>dir urlmon.dll

Volume in drive C has no label
Volume Serial Number is 3749-15FF
Directory of C:\WINDOWS\SYSTEM

URLMON DLL 483,840 04-14-03 9:25a URLMON.DLL
1 file(s) 483,840 bytes
0 dir(s) 350,945,280 bytes free

C:\WINDOWS\SYSTEM>

I will also post back to PA Bear with answers to his
questions. Thanks again. Anne
 
A

Anne

Hi PA Bear,

I will try and answer your questions below.
I also responded to Robert's question in another posting.
I must have transposed the iexplorer in the AppName which
should be iexplore. I am sorry. This is all new to me
but I do believe I am actually learning something. Thanks
for your patience.
-----Original Message-----
*RECAP*: Anne's running Win98 with a fully updated IE version 6.2800.1106IC.
She connects via Comcast cable. She is running, apparently, McAfee
VirusScan (which may be part of a McAfee "system" tool?). Neither Yahoo
Companion nor Google Toolbar are installed.

Anne first posted (14 July) with this error...

<paste>
Microsoft Internet Explorer has encountered a problem and needs to close. We
are sorry for the inconvenience.

AppName: iexplorer
ModVer: 6.0.2800.1188
AppVer: 6.0.2800.1106
[the 2 versions above may have been inadvertently switched as a typo]
Offset: 000082a2
Modname: urlmon.dll
</paste>

....and still is, apparently, after assuring us she's now running Urlmon.dll
version 6.0.2800.1188.

Before installing Q818529, she could not reinstall Windows 5.6 Scripting
Engine due to the same error in Urlmon.dll.

Up to this point, Anne couldn't "download anything" [due to this error?]
though somehow she got a zipped file of "hijackthis" [not mentioned in this
thread; siljaline or Jim Byrd?] but could not open it due to an error
message involving a missing MSVBVM60.DLL.
<end of recap>

1. If you can recall, Anne, what were you doing on or before Monday 14
June-03 when you first got the error? What did you (or anyone else) do with
the computer in the few days prior to the first time you got the error
(e.g., installs/uninstalls, updates/upgrades, new ISP or method of
connecting)? Was anyone else using the machine?

I am not the only user of the computer. My husband, Vern,
also uses the computer. He uses Hotmail email and views
the internet. The only thing that I have done to the
computer was to run a thorough SCANDISK, defrag and try to
update the McAfee which failed as I was not able to
download. I was able to load the from a CD that I burned
at work the McAfee version 4.5.1 SP1 which is on our
website for Western WA University. I did run that and all
looked OK. I ran the Ad-aware that I had already
installed which was an older version. I tried to download
it today and received my usual error. I was able to go
back and save it to my computer and then run the newest
version Ad-aware 6.0. There were 11 new objects including
on called CoolWebSearch listed as Malware. The rest were
categorized as DataMiner. I did delete them all.
2. What McAfee product <shudder> are you using and what happens if you
disabled it/turn it off? How long have you had it? When was the last time
you sought (or were able to seek) virus definitions? Have you run a full
system scan since doing so? You can get free online scans at
http://snurl.com/g14 and http://housecall.trendmicro.com/.
I did go to the website above and tried downloading and
got the error. I am thinking maybe I should go into work
and download a good version of a virus scan product on CD
and then bring it back and load it. Do you think I should
do this and maybe download something different than McAfee?
3. Have you tried reinstalling 5.6 Scripting Engine since installing
Q818529? Yes. I was able to do that via my work, saving
it to CD and then loading it here.


C:\WINDOWS\SYSTEM> dir MSVBVM60.dll

Volume in drive C has no label
Volume Serial Number is 3749-15FF
Directory of C:\WINDOWS\SYSTEM

File not found
350,912,512 bytes free
I copied the above just in case that would help. ?
http://msdn.microsoft.com/library/default.asp? url=/downloads/list/webdev.asp

4. Search for (WinKey+F) MSVBVM60.DLL. What version is it? (On my Win98SE
machine, it's version 6.00.8964 and dates to the Dec. '02 Cumulative Patch
for IE.)

5. I would certainly want to run a fully up-to-date AdAware, Spybot, *and*
BHO Cop on the machine to rule out malware or hijacking but apparently you
still cannot download such applications, let alone update them. Have you
ever been to this page (can you?) and allowed it to load?...
http://www.doxdesk.com/parasite/ (It certainly won't do what any of the
foregoing apps will do but it's a start.)

Hang in there, Anne!

Thank you for helping me. I really appreciate it. Anne
--
HTH...Please post back to this thread

~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE)
http://mvp.support.microsoft.com
IE information: version: 6.0.2800.1106IC
Update versions: SP1; Q818529; Q330994; q313829

I verified each file and they all had the version that you
listed. I don't have Yahoo companion or Google toolbar
installed. thanks again. Anne


-----Original Message-----
If you find a Details button in the error (unlikely), press it, copy
whatever it says and post it in a reply.

You state that you've installed Q818529. Please confirm the following:

1. IE Help>About>Update Versions> Q818529 is found here;

2a. Mshtml.dll is version 6.0.2800.1170;

2b. Shdocvw.dll is version 6.0.2800.1203;

2c. Urlmon.dll is version 6.0.2800.1188.

[Search for (WinKey+F) each of the above
files>right-click>Properties>Version]

3. If you have Yahoo Companion (Toolbar) or Google Toolbar installed,
uninstall it via Add/Remove Programs.

Anne wrote:
I verified the error signature and that is exactly how it
reads. I did perform all the critical updates which
include 818529 but I am still receiving the error.

When I get the error, it does give me the option to send a
report. I am not sure where the report is sent. Should I
try and capture that data. It looks like a lot of data.
Any ideas would be greatly appreciated. Thank you, Anne


-----Original Message-----
....
Agreed. IE6.00.2800.1188 is *not* a valid IE version.

PMFJI but why not assume that she already has 818529?
Then 6.0.2800.1188 makes sense as ModVer of urlmon.dll
(Subject: of this thread)

Then I would wonder if she has the right copy of that module?

So some potentially clarifying diagnostics would be:

javascript:navigator.appMinorVersion

(to see what exactly is supposedly applied)

and

cd \windows\system
dir urlmon.dll

(to see date and size of module.) Notice from manifests in 818529
that versions for other OS have different sizes and timestamps.


I think that some of the confusion may be due to the fact that the
Error Signature was probably transcribed manually rather than being
captured to the Clipboard. To capture the Error Signature drag the
mouse over the text and press Ctrl-c (unfortunately there is no
right-click menu there). Then paste that result
instead of having
to
.
 
Top