STMP Virtual Server won't stay running, inetinfo.exe errors

I have been am having problems on our SBS 2003 server since 12:58 PM CST on
11/1. They appear to revolve around the dll file SHLWAPI.dll. Events listed
below.

Error Events listed below

The first symptom was the Sharepoint intranet page wouldn't load. Trying to
load I would either get the typical page not found or a message "The remote
procedure call failed". I checked the error log and I was getting errors #1
and #2 below. Auto Updates was waiting to restart so I thought I would start
with that to see if it was a temporary memory error or something. After the
restart then email stopped routing. I cannot view the queues getting and
error that "Exchange System Manager failed to retrieve the queues from the
SMTP virtual server" and I was only getting error #2

After a short time the SMTP service, Exchange Routing Engine, FTP Publishing
service shut down. And the IIS Admin Service will restart. I don't care
about the FTP service since I don't host and FTP server so I will probably
leave that disabled

Since it all appears to revolve around this SHLWAPI.DLL I ran sfc /scannow
hoping it would replace it if it was bad. I also tried replacing it manually
with a copy that was stored in C:\WINDOWS\$NtServicePackUninstall$ but that
didn't seem to help.

Then I ran the Baseline Security Analyzer and found a couple Exchange
Patches that I had missed. I installed those and restarted the server.
Immediately after the restart everything appeared to be working fine, no
error in the error log. Unfortunately sometime after that they started up
again. This morning

I do have Trend Micro OfficeScan antivirus on the server and the main
console says it is up to date. I thought that if this was related to a virus
or malware that my internet searches would have certainly found something.
All the info I can find about SHLWAPI.DLL is related to older version of
Windows or just Windows XP. nothing sepecifically related to Windows Server
2003 or SBS 2003 (except as mentioned in other unrelated articles)

So I am stumped any suggestions what I should be trying next?
Tony


*****Error #1*****
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/1/2006
Time: 5:50:43 PM
User: N/A
Computer: MLHG
Description:
Faulting application inetinfo.exe, version 6.0.3790.1830, faulting module
shlwapi.dll, version 6.0.3790.2732, fault address 0x00022a25.


*****Error #2*****
Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date: 11/1/2006
Time: 1:23:10 PM
User: N/A
Computer: MLHG
Description:
Faulting application inetinfo.exe, version 6.0.3790.1830, stamp 42435bec,
faulting module shlwapi.dll, version 6.0.3790.2732, stamp 449c52d8, debug?
0, fault address 0x00022a25.


****#3****
Event Type: Information
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 11/2/2006
Time: 8:11:18 AM
User: N/A
Computer: MLHG
Description:
Reporting queued error: faulting application inetinfo.exe, version
6.0.3790.1830, faulting module shlwapi.dll, version 6.0.3790.2732, fault
address 0x00022a25.


****#4****
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 11/2/2006
Time: 8:12:50 AM
User: N/A
Computer: MLHG
Description:
Fault bucket 323823143.

Hi Tony,

Thanks for posting here.

From your post, my understanding on this issue is: you get the Event ID
1000 with shlwapi.dll error message, and SMTP virtual server stopped. If I
am off base, please feel free to let me know.

Based on my research, I suggest you try the following steps to solve this
issue:

1. Scan the problematic computers for malware. For your convenience, I
have included some online scan and software download links:
===============================
Microsoft Windows AntiSpyware (Beta)
<http://www.microsoft.com/athome/security/spyware/software/default.mspx>
RAV AntiVirus - Scan Online
<http://www.ravantivirus.com/scan/>
Trend Micro - Free online virus Scan
<http://housecall.trendmicro.com/housecall/start_corp.asp>
Panda Active Scan - Free online scanner
<http://www.pandasoftware.com/activescan/com/activescan_principal.htm>
Spy Bot
<http://www.spybot.info/en/mirrors/index.html>
HijackThis
<http://www.tomcoyote.org/hjt/>

2. Use Clean Boot to eliminate third-party interference
===============================
How to troubleshoot by using the System Configuration utility in Windows XP
http://support.microsoft.com/kb/310560

3. Perform a repair installation
===============================
How to perform an in-place upgrade (reinstallation) of Windows XP
http://support.microsoft.com/kb/315341

I hope the above information helps.

Have a nice day.

Best Regards,

Steven Zhu
MCSE
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
updated on February 14, 2006.? Please complete a re-registration process
by entering the secure code mmpng06 when prompted. Once you have
entered the secure code mmpng06, you will be able to update your profile
and access the partner newsgroups.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================