Windows Legacy OS forum

General discussion

Rundll32 caused IPF in WMOCK32.CPY.DLL

by BrainDead / November 14, 2004 11:20 PM PST

First let me say, yes...this IS the correct file name and I am writing here because of another fellow (Jots) having a similar problem: the module being referenced is slitghly altered and the .CPY is added.

Here's the skinny:

Everytime I boot this puter I get that error message. I have to open and run Dr. Watson and it goes away. ONE time, and ONE time only, Watson reported the following....

WMOCK32.CPY.DLL attempted to read from memory that does not exist. It may be using an uninitialized variable or it may be attempting to access memory after having freed it. Module WMOCK32.CPY.DLL

Now, when I close DOWN the puter, I also get and Explorer caused IPF in WMOCK32.CPY.DLL as well as an Explorer caused IPF in Kernel32.dll. The "kernel" error I believe was caused by a corrupted password list file, I've deleted and recreated the pwl file according, and am waiting to see if I get that one again.

As for the Explorer IPF associated with this strange module, it continues to happen everytime on shut down.

Further, it seems some information out there is suggesting I have a corrupted WSOCK32.DLL file. I downloaded a new version, but can not shut down and restart in DOS in order to delete the old and reinstall the new.

Ah...hang on...this is why my sn is BrainDead!

In the Registry, there IS an entry under the CLSID's/InprocServer32 which reads "C:\WINDOWS\SYSTEM\WMOCK32.DLL".

Here's what I'm concluding: the WSOCK file was/is corrupted and the name has been changed to WMOCK. I want to modify this key and say WSOCK32.DLL. What I do NOT know, is what will happen if I'm wrong?

I've already exported the key to prepare to delete this entire CLSID if necessary.

Now, suggestions please before I proceed?? And THANK you and Jot I hope maybe part of the answer here will help you, as well.

Discussion is locked
You are posting a reply to: Rundll32 caused IPF in WMOCK32.CPY.DLL
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Rundll32 caused IPF in WMOCK32.CPY.DLL
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
It's either VX2 or LOOK2ME Spyware.
by R. Proffitt Forum moderator / November 14, 2004 11:25 PM PST

Are you???

1. Using the usual anti-parasite tools?
2. Using another browser other than IE when you can?

The Security Forum notes these tools and the possible hijacker that appears to be in this system almost daily.


Collapse -
Re: Rundll32 caused IPF in WMOCK32.CPY.DLL
by Cursorcowboy / November 15, 2004 12:27 AM PST

1. First off, there is no file issued by Microsoft named WMOCK32.CPY.DLL.

2. Second, you are going to have to ascertain "what" loads or initiates action on this file and circumvent it from occuring.

the Registry, there IS an entry under the CLSID's/InprocServer32 which reads "C:\WINDOWS\SYSTEM\WMOCK32.DLL"

3. If the registry address had been reported, that could have been checked by someone with the same operating system. It really doesn't matter however, since this file isn't critical for Windows operation. If you find the file in the System folder and check its Properties, useful information might be reflected. Regardless, rename the file or simply move it to a floppy and boot the system to see what the outcome is.

4. As far as changing that value in that system registry key, do it. Since you have a copy exported, it or the entire registry can be restored -- that is if it is active. Quick reading in this forum "link."

5. Something to consider is LSP-Fix, a utility for download that repairs a specific type of Winsock problem where the chain can get broken, rendering the user unable to access the Internet.


1. Understand fully the section titled "Using System File Checker" in the TechNet article "Chapter 27 - General Troubleshooting" concerning the use and troubleshooting strategy with this utility.

2. The article "SFC" at the TechAdvice site is recommended reading.

3. Please be advised that the article [Q186157] states that during the installation of a new program (including Win98), files on your hard disk may be detected and replaced with older versions, and describes the use of the Version Conflict Manager. If a newer version of a file is detected by Win98 Setup, a version conflict occurs. Prior to Win98, most installation programs (including Windows 95) prompt you to either keep the existing file or overwrite the file with the older file. When you install Win98, this prompt does not appear and newer files replaced by Win98 Setup are automatically backed up to your hard disk for compatibility purposes.

Note: When certain other tools in the Microsoft System Information utility have been used prior to running the SFC there are virtual device driver (.vxd) files normally updated after their use. SFC will always prompt when one of these files are found with a newer date: Drwatson.vxd, Hwinfod.vxd, and Msisys.vxd. Simple click the option to Update verification information.

4. The article [Q192832] warns that when using the System File Checker (Sfc.exe) tool to restore a file (for example, the User.exe, Gdi.exe, Setupx.dll or Krnl386.exe file) from a cabinet (.cab), the wrong version of the file may be extracted. This can result in the inability to start Windows (for example, the computer may stop responding/hang) or a Windows Protection Error messages may be rendered. This article explains that after starting the computer, a user should extract the correct file.

Hint: If you have the Windows media resident on your hard disk you may want to rename the in that folder to something else. At least take the b off the end of the extension so you'll not forget that an incorrect file could be extracted.

5. Supplemental reading:

a. "Prompted for CD-ROM When You Run System File Checker While Correct CD-ROM Is in Drive - Q263499."

b. "Error Message: The File Was Not Found. Verify That You Have Selected the Correct 'Restore from' Location and Try Again - Q180465."

c. "Unable to Extract the Desk.cpl File from the Windows 98 CD-ROM - Q193312."
Collapse -
Addressing both responses in this one
by BrainDead / November 15, 2004 3:51 AM PST

I'll first check and see if this is a result of one of those spyware. I do know about spyware, etc. But, if you search Google, you find NOTHING about this file, just like the other fellow here that was having same problem with a file extension .cpy added.

I know too that this isn't a reg system file, nor a reg system extension...been in puters since the days of DOS.

But, again, here's the main prob: I can't delete it or rename it under windows (says windows is using it)and I can't get to DOS because everytime I try to restart in DOS mode I get an Explorer caused IPF in Kernel32.dll, then the puter locks and I have no choice but to power off.

Now...I have another option here, but would need some more help. I have another hard drive with WinXP on it, but I can't remember what to do if I install that hard drive, to prevent a conflict between Win 98 on this hard drive and WinXP on that one. If I install the new hard drive successfully, I'll just be totally re-formatting this one. So, anyone able to give me the step-by-step on this? Should I ask this in another forum?

Thanks you two....

Collapse -
The step by step reformat and reload is...
by R. Proffitt Forum moderator / November 15, 2004 4:06 AM PST
Collapse -
It was LOOK2ME
by BrainDead / November 15, 2004 6:14 AM PST

Thank you, it was indeed the Look2me spyware, one I had absolutely no familiarity with. I'm new to actually using these types of forums to solve my probs...ty for your patient.

For the benefit of any one else with thie prob, I had to search out the Look2me Uninstaller and download it. It took two attempts to download, but once it ran the file was gone and the Rundll error ended. HOWEVER...I found the copy (hence, the .cpy extension) in Win\Sys...but this time, was able to delete the file.

And thank you for the thread to the step-by-step. As for me, this thread is now closed.

Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Turn up the volume with our Apple Byte sweeps!

Two lucky winners will take home the coveted smart speaker that lets Siri help you around your connected house. This sweepstake ends Feb. 25, 2018.