Mystery popup

November 11, 2006 on 9:13 pm | In Malware analysis | No Comments

Originally posted Dec 18 2005, 02:46 PM

Maybe not spyware, but we can’t be sure at the moment.

Recently a lot of people started experiencing this error when they try to run IE:

The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.
I found a fix posted on several forums and groups.

Basically it comes down to:

Click Start > Run > and copy this command:
regedit.exe /e C:\RPCKDM.txt “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM”
> then click OK to execute.

This should create the file:
C:\RPCKDM.txt
Save that file as a backup for what we are about to remove.

Open notepad and and copy and paste next bold in it:
(don’t forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM]


Save this as fix.reg Choose to save as *all files and place it on your desktop.
This is how the regfix must look afterwards: regfile
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Reboot and open your Internet Explorer.
Let me know if that solved the problem.
What I have gathered sofar is that most (if not all) of the users were running Windows 2000 and IE 6 SP1
Some report receiving a popup that might have been the cause.
After they had closed that popup they were unable to get IE back up again.

If anyone reads this who knows where we can find this popup or what is causing this behavior, please let me know.

I’d like to find out if it does anything else and how we can stop it.

No Comments yet »

RSS feed for comments on this post. TrackBack URI

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds. Valid XHTML and CSS. ^Top^