rundll32.exe problems

Discussion in 'other software & services' started by puff-m-d, Jul 29, 2002.

Thread Status:
Not open for further replies.
  1. Technodrome

    Technodrome Security Expert

    Joined:
    Feb 13, 2002
    Posts:
    2,140
    Location:
    New York
    Try another Antivirus scanner! On-line av scanners don't check for memory resident viruses. Viruses like WNT/Infis.4608 and similar...These types of virus cold corrupt your files and you would not be able to repair them.


    Technodrome
     
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello all,

    I have now also ran Wormguard, TDS, done a system restore, and done a registry restore and profile restore with RegRun. The problem now is intermittent. Sometimes all works fine and then it doesn't. I will look for a trial version of another AV and do a scan. Also am going to do a SFC again and see what happens. Oh, I also ran adaware and spybot, they both came up with nothing. Thanks for all the help so far.

    Regards,
    Kent
     
  3. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  4. snowy

    snowy Guest

    http://mitglied.lycos.de/rose_swe/main.htm

    1) MemScan freeware

    2) VirScan shareware...



    Puff

    ok...so you didn't actually do a re-format.....an while I can understand your desire not to lose files you have not backed-up.....the way your os is right now is nearly useless..........plus do you really want to contune using an un-stable system even if you correct the present problem....the system went bad for a reason...you may succeed it briefly correcting the problem......notice the word "briefly"
    perhaps there is a conflict with the programs installed...to locate the conflict you will need to un-install every program an add each program back one at a time...even that may not work cause the problem may not be immediate.......you could be playing around with this until the first Monday in December....an still not locate the problem.........or perhaps call the computer some nasty names..insult its ego and self-esteem.....an it may decide in a moment of humility to fix inself....but I really would not depend on that......since most computers have no self-esteem to begin with.....
    noticed you have a cd-rw....lets say you use it to make back-up cd's......an lets say that there just might be a virus involded here......guess you would just be making a back up of the virus also....possibly ?? if its embedded in one of the programs you back up.......
    Restore is not going to do it.....imho. perhaps your concern should be for having a stable system for future use (respectfully said) otherwise....you got nothing.
    the time it takes to reformat will be much less....consider this as a learning experience.....ok I know thats not what you want to hear....you are already upset....an don't need the snowman giving you advice.....but the snowman just wants to see you around the BB....enjoying yourself....an when my ye ole puter takes a dive..you can advised me to REFORMAT!!!!!!!

    snowman
     
  5. MickeyTheMan

    MickeyTheMan Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    1,017
    Well if SFC cured the problem and problem showed up again at reboot, then you must likely have a nasty little worm playing with your registry.
    If you can't find it ,and you say SFC is no longer able to repair, then you will as snowy says most likely have no choice but do a reformat.
    Too bad you don't have an image of your sys you could have gone back to.
     
  6. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello all,

    I think I have solved my problem.

    I decided to a search for all instances of rundll32.exe on my machine. The search came up with 3 hits:
    1.) C:\WINDOWS\SYSTEM32
    2.) C:\Documents and Settings\puff-m-d
    3.) C:\Program Files\Diamond Computer Systems\TDS-3

    After checking the properties on these 3 files:
    1.) had a size of 31.0 KB (31,744 bytes) and a creation date of Thursday, April 11, 2002, 7:12:06 P.M.
    2.) and 3.) had a size of zero bytes and no dates at all listed.

    I went to the cab files on my WinXP disk and extracted the original rundll32.exe file to the above three locations. All 3 now have a size and date as in 1.).

    I just done this but so far my system is stable and I can access all of my control panel files (*.cpl).

    I will know with more certainty after a few days pass if the problem is solved for good and will let the forum know.

    Now comes the BIG question :eek: , can either a virus, worm, or trojan do this and if so, why after running so many different scans was nothing detected. It would be interesting to know what changed those 2 instances of rundll32.exe.

    Regards,
    Kent
     
  7. FanJ

    FanJ Guest

    Hi Kent,

    Here is what I have found on my W98SE:

    Rundll32.exe 24.576 5-5-99 22:22 a C:\WINDOWS\
    rundll32.exe 0 28-6-02 21:25 a < my TDS-3 dir>

    With respect to finding it in your TDS-3 directory:
    In general you will find from time to time some more zero-size files in that directory (for example I have now also wordpad.exe and some others there).
    As Gavin has stated in the past in the private TDS-forum:
    it is safe to delete them.
     
  8. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hi FanJ,

    Thanks for that info. So far it seems the culprit was the file in the documents and settings. Restoring it is what has made my system work again. Evidently I need rundll32.exe both in documents and settings and system32. Sometimes it is amazing what a little patience and help from guys like you can accomplish. Probably would have done a complete "clean" install of my OS but by hanging in there was able to avoid it. Just another example of not doing things to your system too hastily until you have researched the problem thoroughly.

    Thanks one and all for your help (especially Wayne over at DCS :D ).

    Regards,
    Kent
     
  9. FanJ

    FanJ Guest

    Hi Kent,

    I'm glad your system is now OK again. :D

    I didn't know about that "documents and settings", but I don't have XP....

    Cheers, Jan.
     
  10. snapdragin

    snapdragin Registered Member

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    hi Kent,

    sorry to hear of the trouble you've been having.

    i just checked for that file too, to see where it shows up, since i am also using XP-Home.

    i have the rundll32.exe in the Windows System32 folder (31KB) and also in the TDS-3 folder (0KB), but i do not have one listed in the Documents & Settings.....i do though, have about 9 listed as prefetch files (pf)

    i am not that familiar yet myself with XP so i'll just post what M$ says about them...not sure if it will help or just be informative. :)

    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/appendix/hh/appendix/enhancements5_3oc3.asp

    if you want a system to compare with, please let me know, or IM me, and i'll help any way i can.

    Goodluck!
     
  11. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello all,

    What I think happens in Win XP Home is if you have more than one user set up, for some reason, WinXP puts a copy of rundll32.exe in your folder under documents and settings. I have several other *.exe files there also. Although I am probably wrong, this is the only reason I can think of for it being there. Snapdragin, I assume you have yours set up as a single user machine? If I am wrong, hopefully someone else with a Win XP machine set up for multiple users will correct me. All I know for sure is that restoring the file in that location seems to, so far at least, have fixed my problems.

    Regards,
    Kent
     
  12. snapdragin

    snapdragin Registered Member

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Kent - yes i am set up as a single user, i haven't set up any other user acc'ts on this pc (not that i haven't offered to set up another user, but no one's brave enough to come near my pc) ~LOL~ .....so i think you might be right about rundll32.exe needing to also be in the documents & settings folder if there are other user acc'ts set up (?)

    i am not really sure though, since i do have a documents & settings folder under my user's name, but nothing ever goes there (yup, the whole additional user thing baffles me, even though i know it is safer to log on as a user with Admin rights and not as just the Admin user only)

    is your system still stable since you put the rundll32.exe into the documents & settings folder?

    ------
    babbles?? LOL (note to self...never post when she's tired) :p
     
  13. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello all,

    It has been quite a while since my last post or update here, so now that all is OK here, I thought I needed to bring everyone up to date.

    After all of the suggestions in this thread, and even at times thinking I had fixed my problems, they still kept reappearing.

    I finally decided to do a complete reformat of my hard drive and reinstall everything on a "clean" machine. Well, even after this, the problems were still there.

    I also had been having major problems with Reg Run Suite and had been working with Dmitry trying to figure out the problem. I had sent him numerous files for him to analyze but he could not find anything wrong. We basically came to a dead end.

    In a totally unrelated issue, I decided to check the the required system files and versions for TDS-3 even tho I was not having any problems with TDS-3 (guess I am just curious and want to stay updated :D ) . See this thread for info on these required system files and their version numbers: https://www.wilderssecurity.com/showthread.php?t=2906

    After checking this out, I found 3 files with older version numbers, so I downloaded and updated them.

    So to move on, the updating of these system files solved all my problems (rundll32.exe, control panel, and RegRun Suite). I got back with Dmitry @ Greatis (RegRun) and he confirmed that RegRun also relies on these system files.

    It seems that some program I use installs an old version of some of these system files on setup thus causing the problems.

    I would advise anyone having software problems to check these required system files for TDS-3 as it may also just solve your problem too.

    Also, Dmitry had me place these files in backup and anti-replacement in RegRun so I hopefully will not have this problem again.

    I think it is a good idea to place these files under watch for changes if you have a program to do so. If you do not have a program like this, I would strongly suggest you check out javacool's File Checker. You con find info and the download here: https://www.wilderssecurity.com/filechecker.html

    I hope this info may help someone to avoid all the grief I went thru solving this problem. My system is working better than ever and even tho I had no problems with TDS-3, even it is running faster and smoother than before.

    Regards,
    Kent
     
  14. FanJ

    FanJ Guest

    Hi Kent,

    Thanks for the heads-up.

    I am really sorry that we didn't think about the required system files for TDS-3.
     
  15. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Jan,

    The weird thing was TDS-3 was working fine.... o_O

    And I just by chance decided to check out those files.... :rolleyes:

    I reason that many programs use those files and all it takes is one install of something that changes them to an older version to cause so many problems..... :D

    Regards,
    Kent
     
  16. FanJ

    FanJ Guest

    Yes: DLL-Hell .......
    (well, and other extensions).
     
  17. snapdragin

    snapdragin Registered Member

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    OOooh! ~yikes~....i just checked those version Jan has listed there with the files i have on my XP and i have 3 that are not the most current version.....hummm...even after that install of XP's SP1, dangit! LOL!

    thank you puff-m-d!! guess it's time to try out javacool's File-Checker----i've been putting it off, cause i didn't really understand it.

    thank you too Jan for the thread above...i don't know how i missed that one?

    snap
     
  18. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    snap,

    Just knowing that all the mess that I went thru might help someone else is thanks enough.....

    ;)

    Regards,
    Kent
     
  19. FanJ

    FanJ Guest

    Hi,

    As far as I remember those files are also by default in the file crcfiles.txt in TDS-3.
    What does this file crcfiles.txt do?
    It contains the list of files that TDS-3 checks, using the CRC32-checksum-HASH, for changes.
    You can go to this list this way:
    In TDS-3:
    TDS > Edit Config Text Files > crcfiles.txt
    Then that file will be opened in Notepad.
    Have a look yourself whether those files are indeed in that list. If not, just add them with their full path; when you're ready: hit save.
    This CRC-checksum checking works like FileChecker from Javacool, but there is one big difference:
    FileChecker from Javacool works more or less in real-time, while the CRC-checking in TDS-3 does not do that.
    If you made your TDS-3 basic configuration like I described in that thread in the TDS-forum-section, the CRC-checking will be done every time you start TDS-3 and every time you do a full system scan.
    You can also do that CRC-checking yourself this way:
    when TDS-3 is running:
    System Testing > System Files CRC32 Test
    In the console of TDS-3 you will see an alert in case a file contained in the crcfiles.txt is changed.
    You can add files yourself to that list too. For example: at the moment I have about 116 files contained in it for checking.
    To give an example: it might be a good idea to add AdAware and its reference-file in it:
    ad-aware.exe and reffile.awr (both with their full path).
    In case you have bought Ontrack Powerdesk Pro, it is very easy to copy/paste the full path of a file, but of course you can also do that yourself without Powerdesk Pro.

    I hope this helps.

    (BTW: if you think it would be a good idea, I could also post about the CRC32-feature of TDS-3 in the TDS-forum-section).
     
  20. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    FanJ,

    I had forgotten all about TDS-3's CRC32 Test........

    Thanks for bringing back to my attention.

    You have already brought PowerDesk to my attention and I love it !! And the advice of using it to copy paths worked great. I added 53 more files to my TDS-3 crcfiles.txt file in no time at all. That was sure easier than all that typing especially when I am not that good of a typer..... I know you have the Pro version but I am using the free version and like it a lot.

    I think it would be good to post this on the TDS forum since it kind of goes hand in hand with watching those important system files that TDS and many other programs need. I checked the default crcfiles.txt file and those files are not included.

    And yes you did help..... Have a Karma Cookie on me....

    Regards,
    Kent
     
  21. Prince_Serendip

    Prince_Serendip Registered Member

    Joined:
    Apr 8, 2002
    Posts:
    819
    Location:
    Canada
    :) Hi puff-m-d!

    Here's your thanks! This post has helped me understand more about my Rundll problems. I have Win98se and I have two Rundll's, both in the Windows folder. They both have the same date. The Rundll.exe is a 16-bit app left over from Win95 of 5KB. It appears to be required for desktop operations. The second one is a Rundll32.exe of 24KB that runs this system's power usage.

    I learned by trial and error that if both apps are running at shutdown my system would invariably hang/crash. My remedy is before shutdown I press Ctrl+ALT+Delete, highlight the Rundll (16-bit) and press End Task. The Rundll32 runs hidden in the background. I then shutdown normally and no more hangs/crashes (very rarely anyway).

    The only problem now is I seem to get the odd blue screen hang at shutdown after playing Half-Life. I have to shut off a lot of apps in order to play it. I only have 128 Mb of RAM. (This may/may not be related to this. I put this here because it happened yesterday.)

    Since Rundll32 manages your systems power needs I would suggest that you update it if that is possible. This is an extremely inportant app since it is a Power Process Driver. You could check with MS.

    When I get help I like to share what help I have. I sure hope this helps you too. We both benefit.

    Best regards from Larry! :)
     
  22. I too have one Laptop with the exact same rundll's and OS as Larry. My Harddrive is setup for Drive converted to (FAT32)..therefore in most case the Rundll32.exe will be used when needed.

    But I do have some older software on it that is 16 and I think there are some games out there which you also need this rundll.exe (without the 32)

    98 always did have a hard time with all of that on shutdown

    Some of the old third party software I have replaced...but that trick he posted came in very handy when I only had 64 MEG of RAM installed. and many other Apps running.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.