Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rundll32.exe Not Running


  • Please log in to reply
14 replies to this topic

#1 DJSilk

DJSilk

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 30 March 2008 - 11:05 PM

This morning I turned on my computer and usually panda antivirus software ask me if I want to allow rundll32.exe to run but this time it never did. Also Im not being allowed to access the enter in normal xp mode, Im only allowed to access in safe mode. My computer takes awhile to load up the two computer monitors indicating that Im connected to the network. It shows up after awhile then I try to access the internet but it doesnt find the sites Im looking for.

BC AdBot (Login to Remove)

 


m

#2 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 02:12 AM

SmitFraudFix v2.300

Scan done at 2:54:36.17, Mon 03/31/2008
Run from C:\Documents and Settings\A\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts


VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


DNS

Description: SiS 900-Based PCI Fast Ethernet Adapter - Packet Scheduler Miniport
DNS Server Search Order: 192.168.15.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D15CD555-15CD-4E6A-AE4F-8D3E9E41F057}: DhcpNameServer=192.168.15.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D15CD555-15CD-4E6A-AE4F-8D3E9E41F057}: DhcpNameServer=205.152.144.23 205.152.132.23
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D15CD555-15CD-4E6A-AE4F-8D3E9E41F057}: DhcpNameServer=192.168.15.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{D15CD555-15CD-4E6A-AE4F-8D3E9E41F057}: DhcpNameServer=192.168.15.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.15.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=205.152.144.23 205.152.132.23
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.15.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.15.1


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

#3 dmndmn

dmndmn

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 31 March 2008 - 11:50 AM

I'm not so sure if this will help, but try running it from the start tab.

Start -> Run -> RUNLL32.EXE
then if panda av still asks for permission, let it.

also go through these if you want to :

http://www.file.net/process/rundll32.exe.html

http://www.free-web-browsers.com/support/r...r.shtml?regcure

you can probably try downloading the file from here ( Note : I have not tested this ) -

http://www.spywareinfo.com/~merijn/winfiles.php#rundll32.exe

Hope this helps.

#4 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 01:51 PM

I tried everything but still no progress. Thanks for the help but this did not solve my problem. Everytime I scan with RegCure after it finish scanning the program shuts down by itself.

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:12 PM

Posted 31 March 2008 - 02:31 PM

Also Im not being allowed to access the enter in normal xp mode, Im only allowed to access in safe mode.

The log file from smitfraudfix shows you ran it from normal mode so you need to clarify. Who advised you to use smitfraudfix?

panda antivirus software ask me if I want to allow rundll32.exe to run

RunDLL32.exe is a legit Windows file that loads .dll files which too can be legit or malware related. Do you know what that related file was?

Everytime I scan with RegCure...

Registry cleaners are extremely powerful applications. There are a number of them available and some are more safe than others. Keep in mind that no two registry cleaners work entirely the way. Each vendor uses different criteria as to what constitutes a "bad" entry. One cleaner may find entries on your system that will not cause a problem when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.

The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system unbootable.

The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly can have disastrous effects on your operating system such as preventing it from ever starting again. For routine use by those not familiar with the registry, the benefits to your computer are negligible while the potential risks are great.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 02:50 PM

I used smitfraudfix before to fix a registry problem in the past. I thought it might help in some kind of way. I've also tried to restore to a previous store point and that didnt work. Need help not more problems.

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:12 PM

Posted 31 March 2008 - 02:56 PM

I used smitfraudfix before to fix a registry problem in the past. I thought it might help in some kind of way.

This is a specialized fix tool intended for specific malware infections. It is not a registry cleaner and should not be used unless you have symptoms of the smitfraud infection. Using specialized fix tools incorrectly could lead to disastrous problems with your computer.

You did not answer my question about which .dll file was related to RunDLL32.exe. I would like to identify this file and determine if it should have been running in the first place.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 03:05 PM

I followed the instructions on this website http://windowsxp.mvps.org/rundll32.htm but command prompt indicates that "tasklist is not recognized as a internal or external command"

#9 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 03:08 PM

I believe it was lsass.exe because panda antivirus software ask me if I want to run that before rundll32

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:12 PM

Posted 31 March 2008 - 06:38 PM

You still did not clarify the conflict about whether or not you can boot normally. I'm also not sure what you mean by "it doesn't find the sites I'm looking for."

The more specific you can describe your issues, the better someone will be able to assist.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 06:46 PM

I could boot normally but my cd drives and printer doesnt work. I cant even access the internet in normal xp mode.

#12 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 31 March 2008 - 09:11 PM

Can anyone please assist me in fixing this computer?

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:12 PM

Posted 01 April 2008 - 07:01 AM

Ok then your issues are with cd drives and printer not working and problems accessing the Internet in normal mode. Your are going to have provide more specific info as to what is wrong with your cd drive and printer. Simply stating they are "not working" could mean a number of things and you may need to post for assistance in a Hardware forum.

So far from what you describe, these symptoms do not appear to be malware related.

As for your Internet, if your not finding any malware, see:
"It's not always malware: How to fix the top 10 Internet Explorer issues".

If not of those suggestions help, try resetting the IP address:
Go to Start > Run and type: cmd
Press OK or Hit Enter. A dos Window will appear.
At the commmand prompt type or copy/paste:: ipconfig /release
Hit Enter.
When the prompt comes back, type: ipconfig /renew
Hit Enter.
Close the command box and and see if that fixes the connection. No reboot needed.

Most Internet connectivity problems arise out of corrupt Winsock settings due to the installation of a networking software or malware infestation. Check with your ISP provider first and if they insist that your connection is coming through, the problem must be at your end.

If your using Windows XP SP2, log on as an administrator.
Go to Start > Run and type: cmd
Press OK or Hit Enter. A dos Window will appear.
At the command prompt, type or copy/paste: netsh winsock reset
Hit Enter.
When the program is finished, you will receive the message: "Successfully reset the Winsock Catalog. You must restart the machine in order to complete the reset."
Close the command box and reboot your computer.

Go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns
Hit Enter.
Close the command box.

Configure TCP/IP to use DNS. Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties.
Double-click on the Internet Protocol (TCP/IP) item.
Select the radio button that says "Obtain DNS servers automatically".
Click OK twice to get out of the properties screen and restart your computer.

CAUTION: It is possible that your Internet Service Provider requires specific settings here. Make sure you know if you need specific DNS settings here or not before you make these changes or you may lose your internet connection. If you are sure you do not need a specific DNS address, you may proceed.

If you continue to have connectivity problems, download WinSockFix from another computer, save to a usb stick, and transfer it to your computer.
Be sure to print out and follow the instructions for using this tool provided in the Winsock Repair Tutorial.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 DJSilk

DJSilk
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:12 PM

Posted 02 April 2008 - 01:51 AM

"Page cannot be displayed" errors

#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:12 PM

Posted 02 April 2008 - 09:35 AM

Did you read and do as recommended in "It's not always malware: How to fix the top 10 Internet Explorer issues"?

Also see:
"Internet Explorer stops responding, stops working, or restarts"
"Page cannot be displayed errors"
"Page cannot be displayed and similar errors".

If using Internet Explorer 7, see:
"A blank Web page is displayed when you start IE7".
"Webpage cannot be displayed after you install a Windows IE7 update".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users