Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

RUNDLL error messages appear at Startup


  • Please log in to reply
13 replies to this topic

#1 -KiKi-

-KiKi-

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 29 December 2011 - 05:39 PM

My cousin's computer was infected with the "Security Defender" virus. I followed BleepingComputer's steps here http://www.bleepingcomputer.com/virus-removal/remove-security-defender to remove it. MalwareBytes' removed it just fine.

After MalwareBytes removed the infected files, I allowed it to restart the computer to complete the removal process. After restarting the computer, I have now began receiving two RUNDLL error messages at startup. After Windows loads, I am presented with these two RUNDLL messages below:

Posted Image

They are both the same RUNDLL messages, but the part I covered up is my cousin's name. One of the messages shows it's under the "All Users" account, and the other message (the one that is censored) is under a different account which she named after herself.

These two messages occurred right after the "Security Defender" virus removal in which Malwarebytes successfully removed it. Now we're getting these RUNDLL error messages. How can I fix this? Obviously this isn't something good to be popping up after every bootup. What do I do? Please help me.

Edited by -KiKi-, 29 December 2011 - 05:40 PM.


BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 29 December 2011 - 05:59 PM

Hi

I think your operating system is windows xp

Click on start button

Go to RUN and type

%appdata% and click ok

On top ,click on TOOLS-Folder options

Click on View tab

Select -Show hidden files

Uncheck '' Hide operating system files'' option

Click ok

Now you should see the AVI OR ICO file with a lengthy name as mentioned in the error,DELETE it

Delete the same file present in

System32 and startup folder

Good luck

Edited by narenxp, 29 December 2011 - 05:59 PM.


#3 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 29 December 2011 - 08:53 PM

Yes it's Windows XP. Thanks a lot. That worked. But it only removed it from the particular folder which is under the account that is named after my cousin (the one that I censored above). The other one is still appearing in the "All Users" account on Startup. Should I browse to that particular folder and remove it from there as well?

Also, I did a hard drive search in Windows Explorer of this file and noticed this same file appears in these following folders as well:

C:\Documents and Settings\All Users\Application Data

C:\Documents and Settings\My Cousin's Name\Local Settings\Application Data

C:\Documents and Settings\All Users\Start Menu\Programs\Startup


Should I delete all traces of this file and remove it from these folders?

#4 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 29 December 2011 - 09:03 PM

Yes,on PC with multiple accounts we have more locations to search for.Remove it from those locations.Malwarebytes do not remove them.

The files located in startup folders and an entry for those files in MSCONFIG is responsible for these errors.

You can open command prompt and type this

dir /s /a xxxxxxxxxxxxxxxxxxx.avi

Replace xxxx with the actual name of the file

It should show you all the locations

Good luck

Edited by narenxp, 29 December 2011 - 09:06 PM.


#5 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 29 December 2011 - 09:59 PM

It worked. The error messages aren't popping up anymore. Thanks a lot. But there's another problem that has occurred after removal of the Security Defender virus which is regarding "shut down" of the computer now. Now there's an End Program box that pops up in which we have to "end" "rundll32.exe" each time before it will allow the computer to shut down.

I posted a new topic for this issue. Hopefully you'll read it and can help me. Thanks once again.

#6 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 29 December 2011 - 11:04 PM

Do you find any suspicious entries in msconfig?

Thanks

#7 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 29 December 2011 - 11:14 PM

How do I go about doing that? And how would I know exactly which entries are "suspicious"?

#8 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 29 December 2011 - 11:20 PM

By suspicious entries i mean any entry which is not related any application

Try this

Open msconfig

Checkmark selective startup

Uncheck Load startup items

Click on services tab,Check mark ''Hide all microsoft services'

Click on Disable all

Now try to restart the PC.

If you do not receive any errors,check mark important services and startups and restart the PC again and finally finding out the possible cause.

Good luck

Edited by narenxp, 29 December 2011 - 11:20 PM.


#9 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 30 December 2011 - 12:10 AM

How do I open msconfig? Do I open the "Run" box and type "msconfig" in?

Edited by -KiKi-, 30 December 2011 - 12:10 AM.


#10 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 30 December 2011 - 02:28 AM

Sorry ,yes you need open the RUN box and type

msconfig and click ok

#11 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 30 December 2011 - 03:29 PM

Okay..I just did this. After checking "Hide All Microsoft Services", I didn't have the option to "disable all". I only had the option to "enable all". So what do I do?

#12 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 30 December 2011 - 03:40 PM

Hi

I asked you to uncheck load startup items

Do not uncheck Load system services

Good luck

#13 -KiKi-

-KiKi-
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:56 AM

Posted 30 December 2011 - 03:45 PM

Okay..I made a mistake. I unchecked the wrong box. I just restarted the computer, and the same End Program box is still popping up whenever I try to restart or shut down the computer. So what do I do now? How else can I fix this? And do I go back and undo the changes you just had me to do above?

#14 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:01:56 AM

Posted 30 December 2011 - 03:51 PM

Not sure how this comes up even on a CLEAN BOOT.

Open msconfig

Select normal startup

Click ok,that should undo the changes.

You may take the help of experts by creating a topic here

http://www.bleepingcomputer.com/forums/forum22.html

Good luck




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users