UNSOLVED

bvasel

updated

23 years ago

B

bvasel

63 Posts

0

20026

April 6th, 2004 13:00

Rundll32.exe Question

Recently I installed Ad-Aware 6 to try to minimize the number of pop-ups that I was getting.  After doing the first run of the system a few hundred items were identified and quarantined.  Since I ran that program I have been getting an error every time I log off or switch users that rundll32.exe was not responding and I have to end the program manually.  Did Ad-Aware delete something that I really needed?  Should I restore the items from quarantine and identify any items that should not be quarantined?  I also set a system restore point before I loaded Ad-Aware.  Do I need to go back to that point?

I'm not sure how important rundll32.exe or if it really isn't running.  Everything else seems to be running OK.

Thanks for the advice!

  • Denny Denham

    2 Intern

    •

    18798 Posts

    651

    0

    Posted April 6th, 2004 14:00

    bvasel,

    The error you describe is usually due to the continue presence of spyware. I have never known Ad-aware to delete (or quarantine) anything required for proper system operation. Spybot does so for a very few items but they do not cause the rundll32.exe error you have. There is a possibility that some spyware may remain on your system which Ad-aware did not detect. If this is the case you may be able to remove it with Spybot. (I run both programs routinely as one sometimes finds things the other misses.) You can download Spybot from here.

    Rundll32.exe is required for proper operation. It allows .dll files to run as executables.

  • bvasel

    63 Posts

    651

    0

    Posted April 6th, 2004 16:00

    Thanks Denny for the info.  I will give this a try.  I have used Spybot S&D on a different PC.  I didn't realize that they can be run together.
  • 651

    0

    Posted April 9th, 2004 12:00

    Hi, I seem to have the same problem as bvasel, but after I used the spybot S&D, it still doesnt work, the rundell32.exe still appears as I try to shut down. Is there anything else I can do to stop this?
  • mkmeier

    16 Posts

    651

    0

    Posted May 4th, 2004 11:00

    were you ever able to fix the problem and if so, please advise how you did so
  • mkmeier

    16 Posts

    651

    0

    Posted May 4th, 2004 11:00

    did you ever fix the problem with rundll32? If so, could you please advise as to how?
  • 652

    0

    Posted May 4th, 2004 13:00

    not really, I just reinstalled windows XP, now instead of having the rundll32 message appear when I shut down, it appears when I start up, saying some module could not be found, otherwise it works fine.

  • JRosenfeld

    2 Intern

    •

    4383 Posts

    652

    0

    Posted May 4th, 2004 16:00

    Assuming that you did a repair install rather than a clean install (including reformat), if it happens at startup with the message that some module could not be found, that is probably the malware module that adaware removed, but for som reason the registry key telling Windows to load it at startup has not been deleted.
  • 652

    0

    Posted May 5th, 2004 11:00

    So, I should perform a clean install with the reformat? or is there any other way to fix this problem without doing that?
  • JRosenfeld

    2 Intern

    •

    4383 Posts

    652

    0

    Posted May 5th, 2004 12:00

    No that would be a last resort.

    The first thing to find out is what the module is that could not be found, to make sure it is not a system file that has gone missing, but really as I suggested a rogue malware file that adaware deleted.

    The message should give the name, please post it if you cannot determine yourself whether it is a legitimate file.

    If it is not a required file then there are a coupole of things you could try:

    1. Look in the startup tab of msconfig to see if any items there have an entry in the command column that looks like it is calling rundll32.exe to load that module. The line might look like:

    %SystemRoot%\system32\rundll32.exe C:\some path\modulename possibly followed by',' and some switches

    or C:\Windows\System32\rundll32.exe modulename

    or rundll32.exe modulename,.....

    [As an example of a command line that uses rundll32.exe to open a module is:

    rundll32.exe %SystemRoot%\System32\mshtml.dll,PrintHTML "%1"

    which means 'use rundll32.exe to load mshtml.dll to print the html file']

    2. Search the registry for modulename and delete any values that have it as part of its data.

    to see startup tab of msconfig, click start, run, type msconfig, click OK. click startup tab

    to search the registry, click start, run, type regedit, click OK. With the My computer icon at the top of the tree in the left pane of regedit highlighted,  edit menu, click find, type in the module name, check all three boxes, click find next. If it finds an instance to delete right click on the icon in the data column, click delete; press F3 to search for next entry if any.

  • 174

    0

    Posted May 5th, 2004 20:00

    Ok,  the message that pops up says: "Error loading C:\windows\image.dll; the specified module could not be found". Then, as I try to access msconfig, it says this operation has been cancelled to restrictions on my computer, please contact the system administrator. Now, I am the system administrator, as there is no other users, so I do not know how to lift the restrictions, any advice would be greatly appreciated.