comctl32.dll missing

Topic

New Reply

All

This morning I turned on my computer to find a repeated number of errors, stating many of my startup and antivirus programs couldn’t run because comctl32.dll is missing.

As far as I can see, it’s not missing, it’s in the windows system folder. The only new program I’ve installed recently is Filezilla, from Sourceforge, so I don’t think that can be the problem.

I’ve followed the various troubleshooting suggestions given by a google search, done SFC /Scannow. Got the message found corrupt files, unable to fix some of them.

I did a clean boot but found the error was still there.

Did Chkdsk from Safe mode.

All to no avail.

I have a rather old mirror image and could use that to restore the computer, but that means hours of work restoring programs and updates, so I’d like to avoid this if I could!

Any suggestions?

Joe

Reply | Quote

Replies

Run SFC /scannow again after a reboot – then reboot and run it once more, that will give Windows the best chance of repairing itself.

Reply | Quote

If you didn’t decline the “extras” when you installed Filezilla using the SourceForge installer you will have a bunch of malware: http://sourceforge.net/projects/filezilla/reviews/?offset=25

This is how it happens:
http://blog.tedd.no/2014/11/25/sourceforge-malware/
http://blog.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/

So run Malwarebytes, which certainly picks up some of the PUPs (Potentially Unwanted Programs) as well as the SFC/scannow recommendation: https://www.malwarebytes.org/lp/lp4/02_r/?gclid=COjTsfHMoMQCFYcSwwodZ6wAuA

I don’t know if uninstalling Filezilla also uninstalls the extras, but I would try that as well as uninstalling any of the software you can find which the first link above refers to.

Another time, get Filezilla from here: https://filezilla-project.org/

Reply | Quote

I tried running Malwarebytes but got an error about a memory problem at 00.000000.

I also tried ESET scanner but it won’t run with the comctd32 error.

I’m pretty sure I didn’t get any other programs when I installed Filezilla. I’m usually pretty careful about this. And I’ve just looked at the uninstall bit of control panel and it doesn’t list any other programs installed yesterday. I can’t uninstall Filezilla because of the comctd32 error!

Very frustrating!

Joe

Reply | Quote

Thanks for getting back to me. I’ve tried rebooting, run scannow, then rebooting again. The problem persists.

Any other suggestions?

Joe

Reply | Quote

I just checked the version that starts with Malwarebytes (as that would be one of the next steps and I suspect the ‘missing’ file would cause it to fail as well) and it loads 2x versions of comctl32.dll here – both from subfolders of C:Windowswinsxs. It looks to me like all software (from Explorer on) uses this .dll to display the UI.

See if you can use Last Known Good – but start it at least 5 times that way before giving up on it (Windows might store, so I’ve read, up to 9 old startup configurations).

Do you have System Restore disabled? If not, that might be an easier way to work back in time.

Reply | Quote

I tried System Restore earlier, and found to my dismay that it had been turned off, so that option isn’t available. Of course I’ve turned it on now, but it’s a bit late!

Reply | Quote

I tried System Restore earlier, and found to my dismay that it had been turned off, so that option isn’t available. Of course I’ve turned it on now, but it’s a bit late!

I don’t suppose I can copy the file from one computer with Windows 7 to another… I’m using the forum on my laptop.

Reply | Quote

Doing more searching online, I found a Microsoft article suggesting that I use the Windows 7 installation disk to repair the installation http://support.microsoft.com/kb/2255099. Is there any significant downside to this apart from the time spent?

Reply | Quote

If you have a Windows 7 disk, the best way of recovering this dll is to do Repair / Install.

However, given the pervasiveness of the malware you probably have, restoring to your earlier image and going through the tedious updating process you refer to may well be both quicker and better in the long run as it is likely there is much more to fix than just the dll.

Reply | Quote

I checked a few programs running here earlier and few use the .dll from system32 … so there may be at least 3x versions that are (should be) in use/installed on your system.

Can you run ListDLLs? https://technet.microsoft.com/en-us/sysinternals/bb896656 Try using Explorer as the target so we have a baseline, use the -r and -v switches. Copy/paste the output into Notepad and paste it into a reply.

If you can run ListDLLs, try running Autoruns https://technet.microsoft.com/en-us/sysinternals/bb963902 wait for it to finish and then save it as the default .arn file type, zip and attach the file to a reply.

You can try a Repair, sure – but I’m not really confident about it being successful at this point. Depending on the root cause, it might make things worse – it’ll certainly need full patching (SP1 again? plus all security and necessary updates to date) even if it works.

@Martin, you suspect malware with no other possibilities?

Reply | Quote

Thanks for persisting with this.

I tried listing the dlls, via the link but got the 404 file directory error (I had to copy it by hand to my other computer as I’m concerned that it is infected with malware and don’t want to login to my email or Lastpass accounts…)

I’m beginning to think Using Macrium Reflect to restore the system and C drives to an earlier state might not be such a bad option, particularly if Repair won’t work…

Reply | Quote

You can get to both those programs via sysinternals.com, down the left side > Utilities > Process Utilities.

I’m working elsewhere with someone with an awfully similar issue to this, he suspects malware, which Martin I also believe to be high on the suspect list here. Without being able to collect any evidence, I’d say reimaging with Macrium Reflect is probably your best bet.

Reply | Quote

I’ll try Macrium Reflect and will report back.

I’m going to put reminders in my calendar to backup more regularly!

Many many thanks,

Joe

Reply | Quote

No worries, Joe. Good Luck 🙂

Reply | Quote

No worries, Joe. Good Luck 🙂

Macrium Reflect (and a couple of hours of updates) restored things back to normal. I wish I knew how I got infected. I’m pretty asiduous about not opening emails from people I don’t know, and have several antivirus utilities….

Thanks again for your help Martin and Satnow.

Joe

Reply | Quote

I wish I knew how I got infected.

Do you use Panda as your security/antivirus, Joe?

Reply | Quote

Do you use Panda as your security/antivirus, Joe?

I do! Do you mean it might have quaranteed the file? If so, why didn’t it happen when I installed it several weeks ago?

Joe

Reply | Quote

I do! Do you mean it might have quaranteed the file? If so, why didn’t it happen when I installed it several weeks ago?

It was a one-off bad update patch by Panda, pulled within hours, the fix(es) are up now:
http://support.pandasecurity.com/forum/viewtopic.php?f=83&t=3708&sid=c82b5179850baba43d2db1cf273617d8
http://www.pandasecurity.com/usa/enterprise/support/card?id=100045
http://www.pandasecurity.com/usa/enterprise/support/card?id=100046

Reply | Quote

It was a one-off bad update patch by Panda, pulled within hours, the fix(es) are up now:
http://support.pandasecurity.com/forum/viewtopic.php?f=83&t=3708&sid=c82b5179850baba43d2db1cf273617d8
http://www.pandasecurity.com/usa/enterprise/support/card?id=100045
http://www.pandasecurity.com/usa/enterprise/support/card?id=100046

How frustrating! That means if I’d just been working elsewhere the whole thing would have passed me by and I wouldn’t have spent the whole day trying to fix it, and bothering you!

Reply | Quote

I am just working on the fact that that FileZilla download is packed with malware.

But I can’t see any reason not to do a Malwarebytes run before the Macrium restore – it might just suffice and it won’t take long.

Reply | Quote

I am just working on the fact that that FileZilla download is packed with malware.

Assuming that the OP used the Installer Enabled download link (rather than the Direct Download link), I downloaded and ran the FileZilla stub-installer from sourceforge.net in a new VM running IE 11 and latest versions of Chrome and Firefox.

I declined the optional installations of Stormfall Age of War (a game) and myPCBackup (a cloud-based backup utility). At the end of the install of FileZilla I couldn’t find any signs of malware that had been added alongside FileZilla. No new files/folders other than FileZilla (and an empty Stormfall folder in the AppData folder), no browser re-directs or changes to start/home pages, no popups, no new browser extensions, no strange processes, no new services, no added scheduled tasks, etc…. nada.

Sorry but, despite articles like Tedds Blog (25-11-2014), blog.gluster.org (22-8-2013) and reddit (a year ago) warning of bundled malware from sourceforge.net, my experience was very different.

It could very well be that sourceforge.net has cleaned up its act since publication of the Tedds Blog article – and I’m more than happy to agree that the sourceforge.net download wrapper does offer PUPs – but I can’t agree with your generalization about malware. In my opinion it’s not a fact… far from it.

Reply | Quote

Malwarebytes wouldn’t run, looks like it needs the ‘missing’ dll 🙁

Joe, do you have Panda installed? If so, that might be the reason behind this: http://support.pandasecurity.com/forum/viewtopic.php?f=83&t=3708 it puts certain dlls into quarantine.

Reply | Quote

Did you try copying comctd32 from the directory you saw it in over into the directory of the program complaining?
Also, I guess you already reRegistered that file, correct?

"Take care of thy backups and thy restores shall take care of thee." Ben Franklin, revisted

Reply | Quote

I was just working on the fact that that FileZilla download is packed with malware.

But I can’t see any harm in trying a Malwarebytes scan – it won’t take long and might just suffice.

What I am pretty certain about is that simply replacing one known corrupt dll may treat the immediate symptoms but is likely to leave issues unfixed – and the user may not know that other things are wrong.

Reply | Quote

Fair comment. I was running on my experience of December 2014 when I acquired a browser hi-jack through that download despite unchecking all the optional installs.

I know that it was the source – I re-imaged the PC (XP at that time) and reinstalled only to find the hi-jack back again.

Maybe things have changed – possible.

Reply | Quote

That’s interesting Martin. I’m not downloading it again. I did it to upload my daughters website…

Reply | Quote

Yup, had your PC been switched off during the short time the bad update was ‘live’, or if you had just left it on and connected for ~8 or so hours after the patch hit, you’d probably never have noticed.

I think just about all the AV makers out there have caused similar problems in the past, it’s mostly luck of the draw if, or how frequently, you get hit by one of them.

Reply | Quote

My apologies to SourceForge then.

Reply | Quote