[computerwiz12890]

I used regsvr32 not too long ago to fix a computer that couldn't do a Windows update, but I didn't understand what regsvr32 really does. And then I've seen regsvr32 being used around here for various things too. So here's what I was wondering:

1. What exactly does regsvr32 do to a dll?

2. What kind of problems can it fix?

3. How do you determine what dll(s) to use it on?

[Advertisements]

I don't know much, but I know that it can register and unregister .dll's.

[retrac1324]

I don't know much, but I know that it can register and unregister .dll's.

[gerryf]

straight from the resource kit

http://www.microsoft...s/regsvr32.mspx

What DLLs (dynamic link libraries) you register or unregister depends on the issue..any DLL file can be registered or unregistered

[Metallica]

DLL's come in different varieties.

From webopedia:

Short for Dynamic Link Library, a library of executable functions or data that can be used by a Windows application. Typically, a DLL provides one or more particular functions and a program accesses the functions by creating either a static or dynamic link to the DLL. A static link remains constant during program execution while a dynamic link is created by the program as needed. DLLs can also contain just data. DLL files usually end with the extension .dll,.exe., drv, or .fon.

A DLL can be used by several applications at the same time. Some DLLs are provided with the Windows operating system and available for any Windows application. Other DLLs are written for a particular application and are loaded with the application.

Most can and will be "registerable" if they contain (a) function(s)
By "registerable" I mean that they can be handled by regsvr32:

From http://support.micro...com/kb/q249873/

You can use the Regsvr32 tool (Regsvr32.exe) to register and unregister object linking and embedding (OLE) controls such as dynamic-link library (DLL) or ActiveX Controls (OCX) files that are self-registerable. This may be necessary to troubleshoot some issues with Windows, Microsoft Internet Explorer, or other programs.

Another way to call functions in a dll is by using rundll(32)

From http://support.micro...com/kb/q164787/

Microsoft Windows 95, Windows 98, and Windows Millennium Edition (Me) contains two command-line utility programs named Rundll.exe and Rundll32.exe that allow you to invoke a function exported from a DLL, either 16-bit or 32-bit. However, Rundll and Rundll32 programs do not allow you to call any exported function from any DLL. For example, you can not use these utility programs to call the Win32 API (Application Programming Interface) calls exported from the system DLLs. The programs only allow you to call functions from a DLL that are explicitly written to be called by them.

For example:
rundll32.exe shell32.dll,Control_RunDLL
from start > run will open your Control Panel

So, in short, it depends on the kind of dll whether it can be registered (or run) and if it needs extra parameters in the command to find the correct entry-point.

What you may have noticed is that some malware removes all other BHO's from a victims machine.
So you may see a toolbar, that normally is accompanied by a BHO, all alone in a log.

For example:
this one is present
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
but this one is missing
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

In the above case I advise to either re-install Norton or, if the damage was limited, to register that dll

Click Start > Run > and copy this command:
regsvr32.exe "C:\Program Files\Norton AntiVirus\NavShExt.dll"
and > click OK

Other common ones:
RegSvr32.exe "C:\PROGRA~1\SPYBOT~1\SDHelper.dll"
RegSvr32.exe "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll"

[computerwiz12890]

Great info Metallica

Let me see if I understand this:

Since this one is missing
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

If you do regsvr32.exe "C:\Program Files\Norton AntiVirus\NavShExt.dll", that will cause that BHO entry to return?


And as for knowing that Norton has a Toolbar and a BHO that go together, is that something you just learn with experience?

Edited by computerwiz12890, 28 January 2006 - 06:40 PM.

[gerryf]

maybe...not absolutely since there may be more involved in the bho than just the one showing/registered. (and of course if the dll was deleted, it will not reappear)

[Metallica]

Quite correct. After reading a significant amount of logs you will learn to recognize the most common ones and know which other entries are related.

Registering NavShExt.dll installs the IE protection of NAV and restores both the BHO and the Toolbar if either one is missing.

If the dll has been deleted, then you will have to re-install NAV anyway.

Regards,

[computerwiz12890]

So, in general, registering a dll will activate it, and then unregistering a dll will deactivate it...right?

And when there's a problem, like in my example of not being able to update windows, how can you determine if a dll needs to be registered?

[Metallica]

Google.

OK, that is a daft answer I guess, but using Google on some errors and failures very often leads to Microsoft KB articles or threads where someone with the same problems was being helped.

I do know a few dll's that often cause problems with IE and it has become a habit to have them registered before looking deeper, since it very often helps.

Unregistering dll's is only a good idea if they are non-malicious or if you KNOW that they can be unregistered.
We have had some malware programmers that booby-trapped the unregistering of their dll's

Regards,

[computerwiz12890]

Great info

I do know a few dll's that often cause problems with IE and it has become a habit to have them registered before looking deeper, since it very often helps.

What dll's are those? I'll make a note of them.

[Metallica]

Pfew. This will be far from complete, I'm afraid.
I'm sure Tony Klein can come up with dozens of others.
These are the ones I had in my notes

Unable to access secure sites: schannel.dll rsabase.dll rsaenh.dll
http://support.micro...kb;en-us;261328
or
You cannot install some updates or programs: softpub.dll wintrust.dll initpki.dll dssenh.dll rsaenh.dll gpkcsp.dll sccbase.dll slbcsp.dll mssip32.dll cryptdlg.dll
http://support.microsoft.com/kb/822798

Error printing from IE: iepeers.dll
http://support.micro...kb;en-us;261328

Errors when trying Windows Update: wuapi.dll wuaueng1.dll wuaueng.dll wucltui.dll wups2.dll wups.dll wuweb.dll
http://support.micro...om/?kbid=910359

Problems defragmenting: dfrgsnap.dll dfrgui.dll

IE does not open in new window: oleaut32.dll shdocvw.dll actxproxy.dll mshtml.dll pdm32.dll
http://support.micro...com/kb/q180176/

IE produces ActiveX errors: Ole32.dll Comcat.dll
http://support.micro...b;EN-US;Q177943

Internet Explorer open with a blank page instead of web site: scrrun.dll‏ msxml.dll‏ mshtml.dll‏ shdocvw.dll‏ browseui.dll msjava.dll‏ urlmon.dll actxprxy.dll
http://support.micro...kb;en-us;555027

Some Network and Dial-Up Connections Icons May Be Missing: Netcfgx.dll Netman.dll Netshell.dll
http://support.micro...om/?kbid=254631

Windows XP Search not working: regsvr32 "c:\windows\srchasst\srchui.dll" urlmon.dll
wshom.ocx jscript.dll

For any other queries you may want to research I'm sure you will find this site very usefull:
http://www.colba.net...49/homhenri.htm

Regards,

[computerwiz12890]

Cool. Thank you Metallica.

[Metallica]

You're welcome.