Missing DWMAPI.DLL and EFSADU.DLL

[Jackianni]

For the past week I have been having untold problems with Windows XP and IE7. I ran Dependency Walker and it shows that both of the above files are missing from IE7. After hours of trying to find these files on the net and coming up with a hundred programs that promise to fix every problem known to Windows XP I still don't know how to get these files.

Can anyone tell me if it is possible to download these two files from the net and, if so, how can I get them?

[cluberti]

I think you're barking up the wrong tree. I say this, because dwmapi.dll is a Vista-only dll, and efsadu.dll is only installed if you've enabled the Encrypting File System on one of your drives. Therefore, I expect that on XP, if you don't have EFS enabled on a volume, you would indeed find neither of these on your system. Also, don't trust depends entirely. Depends will find that you may be missing .dlls, but it can't determine if you need those on your system or not - in this case, you should not need either on XP for IE7 to function properly. I'd say your problems with XP and IE7 have nothing to do with missing those .dlls, so you may want to refocus your troubleshooting efforts. What you are seeing in depends is pretty much expected behavior on an XP install without an EFS volume.

[Jackianni]

Thank you Cluberti - I will now leave that tree alone! Being a bit of a numbskull when it comes to the inner workings of Windows, I don't know what EFS is but I guess I don't really need to know.

My major problems with IE7 is that, on some pages I get the little "Error on page" message in the bottom left hand corner of the page on many websites and on some, mainly secure sites I've noticed, some links will not work - in particular links to make payments with PayPal or the link to my account on my bank website. Sometimes I also get the Script error box come up but with no details and the only way I can get rid of it is to close the webpage with Task Manager. I have disabled script debugging and notification of script errors but it doesn't make any difference.

I think I may have a serious problem with Windows XP because when I try to validate my version of windows, the validation program cannot supply me with a code. I have validated numerous times in the past without a problem. I have also lost System Restore and the Search function.

Anyway, thank you for your reply it is very much appreciated.

[cluberti]

I would agree with you then that your problems seem to go much deeper than Internet Explorer. Perhaps backing up your data and starting fresh with a new install of XP may be good medicine for your machine .

[Jackianni]

Thanks for taking the time to reply Cluberti - I am about to dig out my rescue disk!

Cheers

Jackie

[wants.to.know]

I was guided to this page after using dependency walker with the Sysinternal Process Explorer. I would like to know if the information here is still applicable. It identified the two dlls listed here and additionally, one for the GoogleDesktopCommon.dll. All of the references to these dlls indicate the "system cannot find the specified file"

and states this:"

Warning: At least one delay-load dependency module was not found.

Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

I, too have IE7 and I am unclear whether the version I have (which does seem to have a reference to Vista in it) is causing some of my issues. I know Windows uses explorer.exe to open IE and I use it extensively on my laptop (as I guess most of us do). I have a student's version of an app on my desktop (since relocated after having lots of problems) and it opens from my documents path, with, of course, explorer.exe. It also had some missing dlls according to dependency walker.

At one point, I was asked by SIFVERIF to insert a Windows XP Professional CD to replace some system files (after downloading a new driver for my mouse and printer) and did so,(this was my daughter's laptop which she used from time to time at home and passed on to me and the disc was from work), and then was unable to back out of the process without accepting the change(s) made to my files. After much research, I discovered that in an OEM install (Toshiba laptop purchased with o/s already installed), this was a problem before SP2. Being the researcher that I am, I started doing a lot of investigation, downloaded countless fixes from Windows, and still cannot resolve all of these issues. I suspect that the incorrect system files are causing at least some of my problems.

Sysinternals process, as well as many others, records excessive page faults and refers to so many USER32 errors, that I contacted Microsoft in the hope of fixing this. I had found reference to a problem with SHELL opening files and although the fix was included in SP2 (which presumably IS loaded on my laptop and Windows Defender identifies explorer.exe as a digitally signed file from them) I am still having these issues.

Also, hope you can answer this question which perhaps is not totally related. Why do some system files show with ".exe" and others with ".EXE"? I have a number of references to system files with these differences and Windows Defender still identifies them as digitally signed by them (although SIGVERIF may not).

By the way, this all started as a result of a trojan (dialer) that was on the laptop and has mushroomed out of control since then. Being a student, and needing to use this laptop to access some online courses, I cannot get into the mode of learning a new o/s (Vista) at this time. As it is, my learning curve (almost typed in curse here), includes the new Office 2007 (which I do like but need to have more time to explore) and three online courses, one of which I am almost two weeks behind in completing, as a result of all these problems.

Sorry for being so long winded and hope this message is in the correct place and that you can verify that these 'missing' dlls are not "really missing" and I can go on with researching other reasons I am experiencing so many page fault errors. By the way, my explorer.exe version is listed as 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) and the IE version is 7.00.6000.16608 (vista_gdr.071204-1500).

Since this is my first post, I hope it is alright to ask all these questions in this forum. If not, please redirect me to the correct forum.

Thanks

[cluberti]

I was guided to this page after using dependency walker with the Sysinternal Process Explorer. I would like to know if the information here is still applicable. It identified the two dlls listed here and additionally, one for the GoogleDesktopCommon.dll. All of the references to these dlls indicate the "system cannot find the specified file"

and states this:"

Warning: At least one delay-load dependency module was not found.

Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

Again, the first two .dll files I've explained. The last would indicate that you either had the google toolbar on this machine and removed it, or if it is currently installed, it's broken and should be removed/reinstalled.

I, too have IE7 and I am unclear whether the version I have (which does seem to have a reference to Vista in it) is causing some of my issues. I know Windows uses explorer.exe to open IE and I use it extensively on my laptop (as I guess most of us do).

Explorer.exe isn't IE, it's the shell (desktop, taskbar, etc). Iexplore.exe is the Internet Explorer file, and explorer.exe would only be involved if you double-click an IE icon to open the browser. As to the version, IE7 is built from the Vista tree, and as such (even on XP and 2003) it will display as a Vista version. This is normal.

At one point, I was asked by SIFVERIF to insert a Windows XP Professional CD to replace some system files (after downloading a new driver for my mouse and printer) and did so,(this was my daughter's laptop which she used from time to time at home and passed on to me and the disc was from work), and then was unable to back out of the process without accepting the change(s) made to my files. After much research, I discovered that in an OEM install (Toshiba laptop purchased with o/s already installed), this was a problem before SP2. Being the researcher that I am, I started doing a lot of investigation, downloaded countless fixes from Windows, and still cannot resolve all of these issues. I suspect that the incorrect system files are causing at least some of my problems.

Quite true, but once a machine is infected, you can never be truly sure what it has done. Unless this is a learning exercise for you (i.e. you don't mind the downtime trying to fix this the hard way), I strongly suggest the VERY next thing you do is back up your data to another location and wipe that machine, starting over. Once a machine is infected, unless you wipe it clean and restart, you can never be 100% certain it's clean.

Sysinternals process, as well as many others, records excessive page faults and refers to so many USER32 errors, that I contacted Microsoft in the hope of fixing this. I had found reference to a problem with SHELL opening files and although the fix was included in SP2 (which presumably IS loaded on my laptop and Windows Defender identifies explorer.exe as a digitally signed file from them) I am still having these issues.

Don't assume what you see is a problem - page faults come in two forms, hard faults and soft faults. A hard fault is when something is attempting to access a page in memory, and it is no longer in RAM nor is it's page file page intact, causing a complete reload of the data in the page, thus a hard fault. A soft fault is when something is attempting to access a page in memory, it is no longer in RAM, but it's data is in a page in the paging file, and it is "faulted" back into RAM. Unless you know which is happening (hard or soft), I wouldn't put an overabundance of emphasis on this. It's not entirely normal (and again, this machine is suspect), but I wouldn't necessarily worry about this quite yet.

Also, hope you can answer this question which perhaps is not totally related. Why do some system files show with ".exe" and others with ".EXE"? I have a number of references to system files with these differences and Windows Defender still identifies them as digitally signed by them (although SIGVERIF may not).

Hard to say, but Windows filesystems (and the binaries that read from them) are not case-sensitive, so if the signature is OK and the checksums match, it doesn't matter.

By the way, this all started as a result of a trojan (dialer) that was on the laptop and has mushroomed out of control since then. Being a student, and needing to use this laptop to access some online courses, I cannot get into the mode of learning a new o/s (Vista) at this time. As it is, my learning curve (almost typed in curse here), includes the new Office 2007 (which I do like but need to have more time to explore) and three online courses, one of which I am almost two weeks behind in completing, as a result of all these problems.

Again, you've said a magic word - "trojan". I reiterate my statement, that unless this is a learning exercise in how to clean an infected system, you would be supremely wise to back up any important data on that machine to a separate location and rebuild from scratch.