IE6 won't start. shell32.dll and MicroShaftKB stinks

[Zaxxon26]

First let me say that I have seen little peices of this problem in other treads but it was never completely awnserd. Also, this is NOT the Invalid pagefault in shell32.dll error that is addressed ad nausium on Microshaft KB.
Also....I had fixed this exact problem about a year ago and can't for the life of me remember how I did it.

Here is whats is wrong. When I start IE6 it gives me the old "IE has encountered an error and needs to close .... Send Report?" and the details of the error are:

AppName: iexplore.exe AppVer: 6.0.2800.1106 ModName:shell32.dll ModVer: 5.0.3900.6922 Offset: 0001e131

So I reinstalled IE6 SP1....no change
I reverted to and older ver of shell32.dll....no change so
went back to the origional shell32.
Then I re-applied SP4 in hopes of updating the shell32 file.
and again no joy.
Then I read some more vague threads and found nothing.

The only other history I have is a windows update 4 days ago, but it has been working since. And I deleted the temp internet files right before it broke. All scanning tools came back empty (NAV Adaware SpyBot).

Any Ideas??? Me either.

 

[bcastner]

Control Panel, Internet Options, Advanced, uncheck "Enable third party browser extensions."

Reboot and test again. If the error disappears, it is time to clean some malware from your system. See faq608-4650

 

[Zaxxon26]

That one didn't help.

However, I opened windows explorer and typed in a url and was able to open IE that way. Then after closing explorer.exe the direct open link to iexplore.exe started working again. Bizzaro.

I definately have a bug though. A program, %sys%\winnt\speech\task.exe keeps reapearing after deletion and it's call in HKLM\Soft\Mic\Win\Cur\run repopulates right after deletion. I have updated all my scan programs and nothing can isolate it. Anyone seen this one.

Thanks for the reply
Jeers

 

[bcastner]

Looks like a morph of BLUEWORM.C

To execute at every Windows startup, this worm creates the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup
Security = "%Windows%\ST5UNSTm.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
@ = "C:\WINNT\VOLUME\WINREP.EXE"

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
WINREP.EXE = "C:\WINNT\VOLUME\WINREP.EXE"

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
msnmsgr = ""C:\Program Files\MSN Messenger\msnmsgr.exe""

http://it.trendmicro-europe.com/ent...il.php?id=64922&VName=WORM_BLUEWORM.C&VSect=T

The dropped folder for Task.exe and Winrep.exe can change.