1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

rundll32.exe error? confused

Discussion in 'Windows XP' started by JohnT24, Jan 8, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. JohnT24

    JohnT24 Thread Starter

    Joined:
    Jan 8, 2003
    Messages:
    4
    I'm new to the forum and I have come across this problem. Ok, I tried to install one of my old games, Rainbow Six. The CD autoruns fine, and comes up with the screen that asks for install. I click install, and nothing happens. So I think to myself, maybe the CD is scratched? Well, I go and get the same game from one of my friends, whom just installed the game a matter of days ago, and the same problem occurs. So, I try to go through Control Panel / Add Progs. It searched for the file to be ran(G:\SETUP.exe) and found it. When I clicked it, after about 10 seconds, it comes up with an error message.

    "End Program - rundll32.exe is not responding."

    So, I clicked End Now, and I get this message

    "You chose to end the nonresponding program Run a DLL as an APP, please let microsoft know by hitting send report bla bla"

    I am running Windows XP Home on a IBM Netvista 1.5ghz, 256mb ram, 64mb Geforce2

    I tried other games such as Half-Life and Quake 3. Neither worked. But, I tried Tribes 2 and it did work. I am very confused here. Help needed !
     
  2. steamwiz

    steamwiz

    Joined:
    Oct 4, 2002
    Messages:
    2,773
    Hi JohnT24

    This could be a trojan - spyware - any number of things

    If you post your startup list we may be able to spot something

    Please post your startup list by doing the following :-

    Please go here and download startuplist 1.5 :-

    http://www.lurkhere.com/~nicefiles/startuplist15.zip

    Download to any folder or your desktop
    Unzip the zipfile
    Double click the exe file
    go to Edit - select all - copy - and paste the results in a new post here


    steam
     
  3. JohnT24

    JohnT24 Thread Starter

    Joined:
    Jan 8, 2003
    Messages:
    4
    StartupList report, 1/8/2003, 3:22:29 PM
    StartupList version: 1.50
    Started from : C:\Documents and Settings\JT\My Documents\StartupList.EXE
    Detected: Windows XP (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 (6.00.2600.0000)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft Works\WksSb.exe
    C:\Program Files\SaveNow\SaveNow.exe
    C:\Program Files\DownloadWare\dw.exe
    C:\Program Files\Winamp\Winampa.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\System32\hphmon03.exe
    C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
    C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\KFH\cl\launcher.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\AIM95\aim.exe
    C:\WINDOWS\System32\Sktempdm.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\Skdaemon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
    C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnf.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\System32\HPZipm12.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\WINDOWS\System32\SKSMAILD.EXE
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\KaZaA\Kazaa.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\MSIEXEC.EXE
    C:\WINDOWS\System32\msiexec.exe
    C:\WINDOWS\System32\MsiExec.exe
    C:\WINDOWS\System32\MsiExec.exe
    C:\Program Files\Trend Micro\PC-cillin 2003\Tmntsrv.exe
    C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe
    C:\Documents and Settings\JT\My Documents\StartupList.exe

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Common Startup:
    [C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup]
    hp instant support.lnk = C:\Program Files\Hewlett-Packard\HP Instant Support DI\bin\matcli.exe
    hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    officejet 6100.lnk = ?

    --------------------------------------------------

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe
    Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
    NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    nwiz = nwiz.exe /install
    SaveNow = C:\Program Files\SaveNow\SaveNow.exe
    MediaLoads Installer = "C:\Program Files\DownloadWare\dw.exe" /H
    WinampAgent = "C:\Program Files\Winamp\Winampa.exe"
    HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    HPHmon03 = C:\WINDOWS\System32\hphmon03.exe
    CXMon = "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
    Share-to-Web Namespace Daemon = C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
    NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
    New.net Startup = rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
    Launcher = "C:\Program Files\KFH\cl\launcher.exe" /P
    Detect Kbd Daemon = SK2000DM.EXE
    pccguide.exe = "C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe"
    PCCClient.exe = "C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe"
    Pop3trap.exe = "C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe"

    --------------------------------------------------

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
    AIM = C:\Program Files\AIM95\aim.exe -cnetwait.odl
    MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"

    --------------------------------------------------

    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components
    (* = disabled by HKCU twin)

    [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
    StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

    [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

    [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
    StubPath = regsvr32.exe /s /n /i:U shell32.dll

    [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
    StubPath = %SystemRoot%\system32\ie4uinit.exe

    --------------------------------------------------

    Load/Run keys from C:\WINDOWS\WIN.INI:

    load=
    run=

    Load/Run keys from Registry:

    HKLM\..\Windows NT\CurrentVersion\WinLogon: load=
    HKLM\..\Windows NT\CurrentVersion\WinLogon: run=
    HKLM\..\Windows\CurrentVersion\WinLogon: load=
    HKLM\..\Windows\CurrentVersion\WinLogon: run=
    HKCU\..\Windows NT\CurrentVersion\WinLogon: load=
    HKCU\..\Windows NT\CurrentVersion\WinLogon: run=
    HKCU\..\Windows\CurrentVersion\WinLogon: load=
    HKCU\..\Windows\CurrentVersion\WinLogon: run=
    HKCU\..\Windows NT\CurrentVersion\Windows: load=
    HKCU\..\Windows NT\CurrentVersion\Windows: run=
    HKLM\..\Windows NT\CurrentVersion\Windows: load=
    HKLM\..\Windows NT\CurrentVersion\Windows: run=
    HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    *INI section not found*
    *INI section not found*
    *INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
    *Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: *Registry key not found*
    HKLM\..\Policies: *Registry value not found*

    --------------------------------------------------

    Checking for EXPLORER.EXE instances:

    C:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    C:\WINDOWS\Explorer\Explorer.exe: not present
    C:\WINDOWS\System\Explorer.exe: not present
    C:\WINDOWS\System32\Explorer.exe: not present
    C:\WINDOWS\Command\Explorer.exe: not present

    --------------------------------------------------

    Checking for superhidden extensions:

    .lnk: HIDDEN! (arrow overlay: yes)
    .pif: HIDDEN! (arrow overlay: yes)
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .shb: HIDDEN!
    .vbs: not hidden
    .vbe: not hidden
    .wsh: not hidden
    .scf: HIDDEN! (arrow overlay: NO!)
    .url: HIDDEN! (arrow overlay: yes)
    .js: not hidden
    .jse: not hidden

    --------------------------------------------------

    Enumerating Browser Helper Objects:

    (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    (no name) - C:\Program Files\NewDotNet\newdotnet4_50.dll - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
    MediaLoads Enhanced - C:\Program Files\MediaLoads Enhanced\ME1.DLL - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    FRU Task #Hewlett-Packard#hp psc 2100 series#1041185185.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [{41F17733-B041-4099-A042-B518BB6A408C}]
    CODEBASE = http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe

    [HouseCall Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
    CODEBASE = http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab

    [Update Class]
    InProcServer32 = C:\WINDOWS\System32\iuctl.dll
    CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37628.6926273148

    [HeartbeatCtl Class]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\CONFLICT.1\hrtbeat.ocx
    CODEBASE = http://fdl.msn.com/zone/datafiles/heartbeat.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    --------------------------------------------------

    Enumerating Winsock LSP files:

    NameSpace #4: C:\Program Files\NewDotNet\newdotnet4_50.dll
    Protocol #1: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
    Protocol #2: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
    Protocol #16: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
    Protocol #17: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL

    --------------------------------------------------
    End of report, 9,934 bytes
    Report generated in 0.641 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
     
  4. steamwiz

    steamwiz

    Joined:
    Oct 4, 2002
    Messages:
    2,773
    Hi JohnT24 - you have a lot of spyware\adware\ foistware

    The first nastie you need to get rid of is NEWDOTNET - if you don't do this right you could lose your internet connection - do this :-

    PROCEDURE 1 (Add/Remove Programs):

    1. Click on Start.
    2. Click on Settings.
    3. Click on Control Panel.
    4. From the Control Panel, double-click on Add/Remove Programs.
    5. Click on the Install/Uninstall tab in the Add/Remove Programs Properties window.
    6. Locate either New.net Application or New.net Domains and select it.
    7. Click on the Add/Remove button.
    8. After removal of our software, you may be prompted to reboot. Please reboot after removing our software.
    9. If this does not fully remove our software, please proceed to PROCEDURE 2.

    if you need more see this :-

    http://www.newdotnet.com/#remove

    After you have removed newdotnet and only after do this

    Please Download and install SpyBot,

    http://www.lurkhere.com/~nicefiles/spybot11r3.exe

    click the online tab to search for and download the updates, then shut down and relaunch SpyBot.

    Go to the Settings tab > File Sets, and uncheck 'System Internals' and 'Tracks' .
    These aren't needed for our present purpose, and you can always experiment with them later on.

    Finally, after closing down Internet Explorer, click 'Check for problems', and have SpyBot remove all it finds 'Fix selected problems'

    you may have to run spybot more than once to clear everything

    steam
     
  5. JohnT24

    JohnT24 Thread Starter

    Joined:
    Jan 8, 2003
    Messages:
    4
    ok i am becoming a bit irritated.

    i try to log on my account on the windowsXP start screen, and it works, but it runs slow as molasses. i cannot click hardly anything without it coming up with the "not responding" thing. so i have to manually shutdown my computer and log on another one of my family members name, who does not have administrative privelages on the computer. therefore i cannot delete the new.net or install the spybot because it will not let me on the other accounts.
     
  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Try following Steamwiz's directions, but first go to Start>Run and enter msconfig

    Take the check out of "load startup items" and reboot. Can you carry on now?

    You may also try the same directions by booting into Safe Mode first. You will need administrator priveleges

    Hold f8 down at the start to get the Safe Mode boot option. This might even be preferable to using msconfig when doing removals or actually running Spybot. Of course you will have no internet access here.

    edit: I see you beat me to it.

    It is essential though that you install, update and run Spybot!!
     
  7. JohnT24

    JohnT24 Thread Starter

    Joined:
    Jan 8, 2003
    Messages:
    4
    well it turns out PC-cillin was clogging up my comp. i deleted it in safe mode and now my computer is running fine. i am now going to try and fix the game problems.
     
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - rundll32 error confused
  1. thp83
    Replies:
    9
    Views:
    598
  2. ehbowen
    Replies:
    7
    Views:
    768
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/112146

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice