RUNDLL Error loading ...

[Ferris]

Everytime my PC starts up, I get the following error messages:

RUNDLL
Error loading
C:/WINDOWS/system32/zatajipi.dll

..../rovomuwi.dll

..../kerumaju.dll

They don't seem to be causing any problems, other than delaying my start up
a little. Should I be worried about these? If so, how can I remedy what's
causing them?
Thanks...

 

[Tim Meddick]

They sound like malware to me. Open regedit.exe and go Edit > Find and
paste each dll name, in turn, into the box doing a search for each one and
then delete each and every reference to them. They are definitely NOT part
of Windows XP. This should stop the system looking to load them at startup.

 

[Pegasus [MVP]]

Everytime my PC starts up, I get the following error messages:

RUNDLL
Error loading
C:/WINDOWS/system32/zatajipi.dll

.../rovomuwi.dll

.../kerumaju.dll

They don't seem to be causing any problems, other than delaying my start
up
a little. Should I be worried about these? If so, how can I remedy what's
causing them?
Thanks...

This is probably a residue of a malware/virus infection that your virus
scanner cleaned up. There is still a reference to it in your startup tasks -
hence the error message. You can deal with it like so:
- Click Start / Run / msconfig{Enter}
- Click the Startup tab.
- Untick unknown items in this list. Leave the virus scanner in place.
- Reboot the machine.

If this fixes the problem then one of the unticked items caused it. If
it doesn't then you need to untick more items.

Note that unticking items will NOT prevent your machine from starting.
It may, however, reduce the functionality of some applications such
as RealPlayer. Since the process is completely reversible, there is
nothing to worry about.

 

[Pegasus [MVP]]

They sound like malware to me. Open regedit.exe and go Edit > Find and
paste each dll name, in turn, into the box doing a search for each one and
then delete each and every reference to them. They are definitely NOT
part of Windows XP. This should stop the system looking to load them at
startup.

This recipe sounds a little dangerous to me. If a novice in registry hacking
starts deleting registry keys then there is a severe risk of him getting rid
of a wrong key. Using msconfig.exe would be a much safer way to deal with
the issue: Same effect but fully reversible.

 

[Tim Meddick]

Hi Pegasus,
Do .dll files get started from entries in the Startup
section? I thought only .exe files could be placed into entries under the
Run key (or the startup folder for that matter)? Surely .dlls are loaded
from elsewhere in the registry at boot time? (I'm not trying to be clever,
I'd really like to know).

 

[Tim Meddick]

There really is no danger - if ALL you delete are the entries with the
offending names in ONLY. You are only going in there to look for one
specific thing (the searched names) which will be highlighted on finding
them and the delete key pressed. I feel sure that is within the competency
of anyone who feels that they can go into the registry in the first place.
Otherwise, non of us would ever go there if it were such a no-no. There are
plenty of procedures on the computer that I would NOT feel happy about
tackling (or advising others to do so). However, I think that you have to
find your on way as to what you think is ultimately in your best interests,
at the end of the day.

 

[Alister]

Hi Pegasus,
Do .dll files get started from entries in the Startup
section? I thought only .exe files could be placed into entries under the
Run key (or the startup folder for that matter)? Surely .dlls are loaded
from elsewhere in the registry at boot time? (I'm not trying to be clever,
I'd really like to know).

Hi Tim,

Don't mean to butt in on your thread, but yes, you can using the Windows
executable rundll32.exe. As an example, the following from my registry
loads the NVidia taskbar applet:

from:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
type: REG_SZ
data: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

Alister

 

[Pegasus [MVP]]

Hi Pegasus,
Do .dll files get started from entries in the Startup
section? I thought only .exe files could be placed into entries under the
Run key (or the startup folder for that matter)? Surely .dlls are loaded
from elsewhere in the registry at boot time? (I'm not trying to be
clever, I'd really like to know).

Correct - .dll files do not get loaded directly, there is always an
executable behind them. When OP disables the reference to executable then he
will get rid of the .dll warning issue too.

 

[PA Bear [MS MVP]]

You've got a Vundo infection, at minimum.

 

[Guest]

Pegasus,

What about Rundll DllNameHere?

 

[Pegasus [MVP]]

Pegasus,

What about Rundll DllNameHere?

Rundll.exe is a Win98 executable. Rundll32.exe is a WinXP executable. Both
have an .exe extension.

 

[Guest]

Pegasus,

I used rundll generically not distinguishing between them

And both of them run dll's

Look at the nVidia control panel or some soundcard control panels. Both use
rundll to load them
The appwiz cpl also uses the rundll too if you want to split hairs

Lets not argue about it. It ain't worth it

 

[Tim Meddick]

Sorry to be the cause of such contention.

 

[Pegasus [MVP]]

Sorry to be the cause of such contention.

There is no need at all to apologise and there wasn't really any contention.
One of the important features of newsgroups is that all responses are
subject to peer review. This gives OPs a degree of confidence: When a
respondent posts incorrect advice, either unintentionally, through ignorance
or maliciously then the misleading advice gets picked up pretty quickly by
other respondents. At times there are genuine differences of opinions that
can result in a robust discussion that do not necessarily end in an
agreement. So what - no harm done!

The key issue in this thread is that .dll files must be invoked by some .exe
file. If the OP wishes to get rid of his error message then he must locate
the .exe file (probably rundll.exe) that attempts to invoke
C:\WINDOWS\system32/zatajipi.dll. The reference to this .exe file could be
in the registry but it could also be in a Startup folder. The tool
msconfig.exe will show it in either location. Scanning the registry may miss
it.

 

[Guest]

Definitely a malware remnant. I recently saw the same type of message
on startup on a machine that had been infected with conficker.a

Most likely you still have a reference to the dll in the run key in
the registry.

Open regedit.exe and navigate to:

HKLM\Software\Microsoft\Windows\Current Version\Run

and look on the right for any reference to your problem dll.

It will likely have some random name like jtktrjlj with a value
similar to:

rundll32.exe "C:\windows\system32\vyfilhun.dll,vyyklfw

Just delete the entire line and restart and you'r error message should
go away.


HTH

 

[Jose]

I went to "startup" and unchecked "onujidifeme.dll rundll32.exe" and it
quit showing up on startup as it has been doing for the last 2 weeks. I
read your post and decided to try the regedit to see if it was there. I
found 6 items.
1. (default)-- reg. sz--value not set.
2. command--reg. sz--rundll.exe "C:\Windows\onujidifeme.dll", startup.

3. hkey--reg.sz--HKLM
4. inimapping--reg.sz--O.
5. item--reg.sz--onujidifeme.
6  key--reg.sz--software\microsoft\Windows|Current Version\Run.
Do I delete just 2 and 5?
The three divisions are "name" "type" "data" Thank you for your advice.
greatgrannytoo

A "Cannot find...", "Could not run...", "Error loading... or "specific
module could not be found"
message is usually related to malware that was set to run at startup
but the referenced file(s)
has been deleted after a malware scan leaving behind a registry entry
pointing to a file that does not
exist.

Windows is trying to load this file but cannot locate it since the
file was mostly likely removed
during an scan for malicious software. However, an associated orphaned
registry entry remains and is
telling Windows to load the file when you boot up.

You need to remove the referenced entry so Windows stops trying to run
the file. It may or may
not be in the registry.

If you are comfortable editing the registry you can search for and
remove the reference from
or remove it using a popular third party tool called Autoruns.

Before making any changes to your registry by hand or with third party
tools, be sure to make a backup
of the registry first.

Here is a link to a popular registry backup tool:

http://www.larshederer.homepage.t-online.de/erunt/

Autoruns does not install anything on your computer. It will display
all of the startup locations
where the reference might be so you can disable it or just delete it
completely.

Here is the download link for Autoruns:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Launch Autoruns.exe and wait for it to finish populating the list of
entries.

When Autoruns is finished scanning your system, it will say "Ready" at
the bottom left corner.

Scroll through the list and look for a startup entry related to the
file(s) in the error message.

Right-click on the offending entry and choose to delete it.

Reboot your computer and troubleshoot remaining issues.