something humbling so here I am cap in hand

[chainwash]

A winxp sp2 and otherwise patched system.

mshtml.dll disappears everytime I reboot.

The result is that the "User Accounts" in the control panel does nothing when I try to open it. AND the "general" tab in the Internet Options is simply not there.

Strange that Internet Explorer seems to work since most of the references found so far relate to mshtml.dll and impaired or non functioning Internet Explorer

I use regsrv to reregister the dll after makeing yet another copy and dropping it into the system32 folder and everything works until I reboot

weirdest thing I have seen this week, HELP !

Thanks in advance for any all replies/suggestions.

CW

[NooNoo]

Make a new user profile and login to it, does it still disappear?
Have you checked for spyware/viruses?

tried this?

[rgharper]

If this is a standard version of MSHTML.DLL have you tried using System File Checker (SFC.EXE) to restore it? If it's a non-standard version (something you're trying to change or update on the PC) how are you doing it? If you're just copying and registering it, you are probably being messed up by SFC.

[chainwash]

Good suggestions from both NooNoo and rgharper thank you.

Tried the new user account and behavior remains the same. Tried the suggestions from the link = no change.

I really thought I had goofed by not using sfc.exe before and was very surprised that it failed to resolve this.

This system is a recovery from trojan.downloader.zlob.anj(bit-defender def)
comprimise.

Once sfc.exe failed I went back to "hi-jack this" ran another log file and found more spyware/malware entries.

I could not find a manual removal procedure for this trojan to confirm bit defenders success... the behavior is so consistent I bet it will be a very simple fix once found... Of course after this much time it borders on volunteerism, lol.

so...

Once resolved I will post back to claim my success and explain or ask more questions once I have properly covered the basics yet again.

CW

[rgharper]

If the copy on the computer is "Dirty" - you think it came from the trojan or some other dirty source - getting rid of it is going to be a bit tricky. You will probably need to run in Safe Mode to start with.

Then find and eliminate ANY other copies of the file. A likely place for another bad copy to be hiding would be in the DLLCache folder and you'd need to get rid of it before even being able to try the replacement.

Once there is only one copy in SYSTEM32 (or SYSTEM? Not sure, I'm on Vista right now and can't check) you MAY be able to replace it without SFC stomping on your toes. But if there's still an active process spawning and replacing it ... well, sounds like time for an intervention.

[chainwash]

A new day a fresh look...

Sysenfor~1.exe appears to have been the culprit preventing permanent changes to the registry. It may be a component*of Sisoftware Sandra Pro 2005 or a bug*in the program now into 2007 version,the specific Sandra .exe is/was sysenforce.exe
**that is NOT conclusive as I did read some threads that attribute the Sysenfor~1.exe to malware/spyware programs**

I did use the Sisoftware Sandra at one point but the version I used at least 2 years ago was a buggy resource hog that duplicated or simply called the existing built in utilities of the OS. why bother...

Once the sysenfor~1.exe was deleted by HiJack This then all the .dll files replaced and registered remained intact and functioning on reboot. yay !

Again my thanks NooNoo & rgharper.
CW

[chainwash]

Sysenforce has NOTHING to do with Sisoftware Sandra Pro 2005.

Sysenforce is from Trispan Technologies and their software Spyware Interrogator (SSI).

CW

[NooNoo]

A quick check of spywarewarrior.com shows it's not a rogue or suspect antispyware package... it is listed there as a diagnostic tool (freeware). If you did use this program and it had that effect, it would be a good idea to drop the makers an email explaining the problem.

Genuine software companies like to know when their product breaks something.