Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rundll32.exe Error On Shutdown


  • Please log in to reply
9 replies to this topic

#1 I_am_CanadianEh?

I_am_CanadianEh?

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 PM

Posted 15 February 2006 - 09:06 AM

Hello There! :thumbsup:

Recently, I've noticed an error when I shutdown my computer. It displays in a Windows dialogue box with a red X and an OK button.

Rundll32.exe - DLL Initialization failed. The application failed to initialize because the window station is shutting down

It appears only briefly and then shutdown continues normally.

I have no other symptoms with my computer. The speed is normal. However, I notice that this error ONLY seems to occur when I have Spy Sweeper loaded at startup. When I shut down Spy Sweeper (the icon in the system tray), I do NOT get this error.

Here's some more information:

- I use Windows 2000 Professional SP4
- my system is fully patched up to Feb. 2006 with all applicable updates from WINDOWS UPDATE
- I ran Spybot 1.4, Ad-Aware, Ewido, Spy Sweeper, MS Antispy Beta, Norton Antivirus, and Panda Activescan - all scans turned up negative.
- I use the Teatimer, MS-Antispy guards, SpySweeper, Spywareblaster, and Norton Antivirus Realtime protections all enabled at startup.

Any idea what this might be? I'm thinking it's some kind of bug either in Spy Sweeper or a recent Windows update that caused this problem.

Your help would be appreciated. :huh:

Thanks in advance. :(

BC AdBot (Login to Remove)

 


#2 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:05:26 PM

Posted 15 February 2006 - 11:49 AM

Check Start>Setings>Control Panel>Administrative Tools>Event Viewer to see if the event was logged.
"2007 & 2008 Windows Shell/User Award"

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,040 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:26 PM

Posted 15 February 2006 - 11:55 AM

Rundll32.exe is a Windows system file which is used to execute DLLs as programs. The file is located in the c:\windows\System32 folder. In other cases, rundll32.exe is a virus, spyware, trojan or worm! the difference being the capital letter or not. Either way the malware is probably reloading from startup on reboot. I would recommend you post a HiJack Log . Please follow these instructions an d be patient for help.


http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

After following those instructions Please post your log here

http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 RandomUser

RandomUser

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:26 PM

Posted 15 February 2006 - 12:21 PM

I would like to add to "Boopme's" post. he is correct in everything stated. However, I believe ha may have left a few things out.

In many cases Rundll32.exe becomes corrupt ON the HDD and needs to be replaced, also you should run MEMTEST86+ to be certain it's not an issues with Physical Address in RAM. In other words, it may be that a bad memory block is causing the error.

So it it possibly a Hardware problem. I mention the possibilty b/c it's ONLY happening when you have Spy Sweeper "Loaded" into memory. If you look at Even Viewer, Start:Control Panel: Admin Tools: Event Viewer.
Check the System and Application Logs. If you have a memory or "Read" error in both places, or Microsoft link states that No Further info is available, it is more likely an issues with Hardware. IE Rundll32.exe is A) Corrupted, or :thumbsup: You have a bad memory Block.

This is only one possibility, if you would like instructions for running MEMTEST86+ or how to run ChkDsk and fix errors, please let me know. I'll be glad to help. Be patient, I may not reply right away.

#5 I_am_CanadianEh?

I_am_CanadianEh?
  • Topic Starter

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 PM

Posted 15 February 2006 - 03:05 PM

Hi,

I'm not very bright with this stuff. :thumbsup:

I can tell you that there are 2 instances of this file. rundll32.exe is in the C:\WINNT\system32 folder and it's all in lowercase letters and it's also in the C:\WINNT\system32\dllcache folder in lowercase letters.


What would I look for in the Event Viewer?
What is this thing RandonUser is talking about?

I would like ONE person to advise me what I should try. :huh:

Or, should I move this topic to Hijack This forum and post a log?

Thanks again, for your help. :(

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,040 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:26 PM

Posted 15 February 2006 - 07:18 PM

I_am_CanadianEh?, I submit this to the moderator acklan. as what he suggests may also help to keep you from having to post a log.
glad to have been of any assistance
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 I_am_CanadianEh?

I_am_CanadianEh?
  • Topic Starter

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 PM

Posted 17 February 2006 - 09:20 AM

Hi Aklan,

I went to Event Viewer, I am seeing sections for Application log, system log & security log Where do I go from here and what am I looking for?

When I open it, it goes directly to System log and displays a lot of information. When I go to the other tabs, nothing is shown.. :thumbsup:

Thanks.

#8 I_am_CanadianEh?

I_am_CanadianEh?
  • Topic Starter

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 PM

Posted 17 February 2006 - 09:24 AM

You asked me to see if the event was logged, there is so much information that I don't understand. I don't recognize anything that references rundll32.

As you can see, I'm not very computer literate when it comes to these things. :thumbsup:

Thanks again.

#9 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:05:26 PM

Posted 17 February 2006 - 10:53 AM

Did you see any error messages? If you do please copy and paste them into a post.
"2007 & 2008 Windows Shell/User Award"

#10 I_am_CanadianEh?

I_am_CanadianEh?
  • Topic Starter

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:26 PM

Posted 21 February 2006 - 01:41 PM

A couple things first:

1) I have 3 real-time anti-spyware protection agents running and loaded at startup. Spy-Sweeper, MS-Antispy Beta, Teatimer

I ONLY get the Rundll32.exe error when BOTH MS-Antispy and Spy-Sweeper realtime protections are running. I tried all possible combinations of having each one or multiple ones loaded. If either SpySweeper or MS-Antispy or both of these are NOT running, then I do NOT get the error. Teatimer does not seem to contribute to the error.

Maybe there is a file conflict or something like that. Again, this is the only symptom. My computer runs beautifully and it is 100% clean. I'm suspecting a bug in one of these programs.

As far as the event viewer, yes, there are errors and warnings logged. I've saved the System info and the Application info No security info was logged in the event viewer.

Here are the logs:

SYSTEM LOG

Type Date Time Source Category Event User Computer
Warning 02/21/06 1:22:37 PM Dnsapi None 11151 N/A MSB-27
Information 02/21/06 1:22:37 PM Dnsapi None 11161 N/A MSB-27
Information 02/21/06 1:22:35 PM Removable Storage Service None 134 N/A MSB-27
Warning 02/21/06 1:07:19 PM W32Time None 54 N/A MSB-27
Information 02/21/06 1:06:33 PM eventlog None 6005 N/A MSB-27
Information 02/21/06 1:06:33 PM eventlog None 6009 N/A MSB-27
Error 02/21/06 1:07:12 PM Netlogon None 5719 N/A MSB-27
Information 02/21/06 8:45:14 AM eventlog None 6006 N/A MSB-27
Information 02/21/06 8:44:50 AM Removable Storage Service None 135 N/A MSB-27
Information 02/21/06 8:44:49 AM Removable Storage Service None 160 N/A MSB-27
Information 02/21/06 8:41:12 AM Removable Storage Service None 134 N/A MSB-27
Warning 02/21/06 8:39:17 AM W32Time None 54 N/A MSB-27
Information 02/21/06 8:38:47 AM eventlog None 6005 N/A MSB-27
Information 02/21/06 8:38:47 AM eventlog None 6009 N/A MSB-27
Error 02/21/06 8:38:49 AM Netlogon None 5719 N/A MSB-27
Information 02/21/06 8:12:58 AM eventlog None 6006 N/A MSB-27
Information 02/21/06 8:12:31 AM Removable Storage Service None 135 N/A MSB-27
Information 02/21/06 8:12:30 AM Removable Storage Service None 160 N/A MSB-27
Information 02/21/06 8:07:23 AM Removable Storage Service None 134 N/A MSB-27
Warning 02/21/06 8:06:49 AM Dnsapi None 11151 N/A MSB-27
Information 02/21/06 8:06:49 AM Dnsapi None 11161 N/A MSB-27
Warning 02/21/06 7:51:26 AM W32Time None 54 N/A MSB-27
Information 02/21/06 7:50:38 AM eventlog None 6005 N/A MSB-27
Information 02/21/06 7:50:38 AM eventlog None 6009 N/A MSB-27
Error 02/21/06 7:51:24 AM Netlogon None 5719 N/A MSB-27
Information 02/20/06 11:53:40 PM eventlog None 6006 N/A MSB-27
Information 02/20/06 11:53:25 PM Application Popup None 26 N/A MSB-27
Information 02/20/06 11:53:07 PM Removable Storage Service None 135 N/A MSB-27
Information 02/20/06 11:53:06 PM Removable Storage Service None 160 N/A MSB-27
Information 02/20/06 11:32:38 PM Removable Storage Service None 134 N/A MSB-27
Error 02/20/06 11:21:09 PM Netlogon None 5719 N/A MSB-27
Error 02/20/06 11:13:42 PM disk None 7 N/A MSB-27
Error 02/20/06 11:13:33 PM disk None 7 N/A MSB-27
Error 02/20/06 11:13:24 PM disk None 7 N/A MSB-27
Error 02/20/06 11:13:16 PM disk None 7 N/A MSB-27
Error 02/20/06 11:13:07 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:58 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:50 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:41 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:32 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:24 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:15 PM disk None 7 N/A MSB-27
Error 02/20/06 11:12:07 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:58 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:49 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:41 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:32 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:23 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:15 PM disk None 7 N/A MSB-27
Error 02/20/06 11:11:06 PM disk None 7 N/A MSB-27
Error 02/20/06 11:10:58 PM disk None 7 N/A MSB-27
Warning 02/20/06 10:50:49 PM W32Time None 54 N/A MSB-27
Warning 02/20/06 10:05:49 PM W32Time None 54 N/A MSB-27
Warning 02/20/06 9:40:40 PM Dnsapi None 11151 N/A MSB-27
Information 02/20/06 9:40:40 PM Dnsapi None 11161 N/A MSB-27
Information 02/20/06 9:25:09 PM Browser None 8033 N/A MSB-27
Warning 02/20/06 9:24:08 PM Dnscache None 11050 N/A MSB-27
Warning 02/20/06 9:20:49 PM W32Time None 54 N/A MSB-27
Error 02/20/06 9:20:36 PM Netlogon None 5719 N/A MSB-27
Information 02/20/06 9:19:38 PM eventlog None 6005 N/A MSB-27
Information 02/20/06 9:19:38 PM eventlog None 6009 N/A MSB-27
Information 02/20/06 11:19:43 AM eventlog None 6006 N/A MSB-27
Information 02/20/06 8:27:36 AM eventlog None 6005 N/A MSB-27
Information 02/20/06 8:27:36 AM eventlog None 6009 N/A MSB-27
Information 02/19/06 2:48:18 PM eventlog None 6006 N/A MSB-27
Information 02/19/06 2:48:02 PM RemoteAccess None 20159 N/A MSB-27
Error 02/19/06 2:47:14 PM DCOM None 10003 N/A MSB-27
Error 02/19/06 2:44:20 PM DCOM None 10003 N/A MSB-27
Error 02/19/06 2:44:15 PM DCOM None 10003 N/A MSB-27
Error 02/19/06 2:43:36 PM DCOM None 10003 N/A MSB-27
Error 02/19/06 2:41:02 PM DCOM None 10003 N/A MSB-27

and here is the other log:

APPLICATION LOG

Type Date Time Source Category Event User Computer
Information 02/21/06 1:13:46 PM Ci CI Service 4137 N/A MSB-27
Warning 02/21/06 1:08:37 PM WinMgmt None 61 N/A MSB-27
Information 02/21/06 1:07:27 PM Norton AntiVirus None 14 N/A MSB-27
Information 02/21/06 1:07:20 PM WMDM PMSP Service None 105 N/A MSB-27
Warning 02/21/06 8:40:58 AM WinMgmt None 61 N/A MSB-27
Information 02/21/06 8:39:43 AM Norton AntiVirus None 14 N/A MSB-27
Information 02/21/06 8:39:20 AM WMDM PMSP Service None 105 N/A MSB-27
Information 02/21/06 7:57:48 AM Ci CI Service 4137 N/A MSB-27
Warning 02/21/06 7:52:41 AM WinMgmt None 61 N/A MSB-27
Information 02/21/06 7:51:34 AM Norton AntiVirus None 14 N/A MSB-27
Information 02/21/06 7:51:27 AM WMDM PMSP Service None 105 N/A MSB-27
Information 02/20/06 9:27:00 PM Ci CI Service 4137 N/A MSB-27
Warning 02/20/06 9:21:42 PM WinMgmt None 61 N/A MSB-27
Information 02/20/06 9:20:31 PM Norton AntiVirus None 14 N/A MSB-27
Information 02/20/06 9:20:28 PM WMDM PMSP Service None 105 N/A MSB-27
Error 02/20/06 11:19:41 AM Userenv None 1000 SYSTEM MSB-27
Information 02/20/06 11:18:40 AM Userenv None 1000 SYSTEM MSB-27
Error 02/20/06 10:25:01 AM Userenv None 1000 SYSTEM MSB-27
Error 02/20/06 10:25:01 AM Userenv None 1000 SYSTEM MSB-27
Error 02/20/06 10:08:25 AM Userenv None 1000 timp MSB-27
Error 02/20/06 10:08:25 AM Userenv None 1000 timp MSB-27
Information 02/20/06 9:05:00 AM Norton AntiVirus None 2 N/A MSB-27
Warning 02/20/06 9:04:52 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:04:52 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:03:57 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:49 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:46 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:43 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:43 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:42 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:42 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:42 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:42 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:42 AM Norton AntiVirus None 6 N/A MSB-27
Warning 02/20/06 9:01:39 AM Norton AntiVirus None 6 N/A MSB-27
Information 02/20/06 9:00:43 AM Norton AntiVirus None 3 N/A MSB-27
Information 02/20/06 8:34:52 AM Ci CI Service 4137 N/A MSB-27
Warning 02/20/06 8:29:46 AM WinMgmt None 61 N/A MSB-27
Information 02/20/06 8:28:28 AM Norton AntiVirus None 14 N/A MSB-27
Error 02/20/06 8:28:18 AM Userenv None 1000 timp MSB-27
Error 02/20/06 8:28:18 AM Userenv None 1000 timp MSB-27
Information 02/20/06 8:28:15 AM WMDM PMSP Service None 105 N/A MSB-27
Error 02/20/06 8:27:57 AM Userenv None 1000 SYSTEM MSB-27
Error 02/20/06 8:27:57 AM Userenv None 1000 SYSTEM MSB-27

Clear as mud to me.. :thumbsup:

This problem is not concerning me, I'm more just curious as to why it's occuring.
Thanks again. :huh:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users