rundll32.exe has generated errors

[churin]

I am getting an error message as follows:

rundll32.exe has generated errors and will be closed by Windows.
You will need to restart the program.

What program to "restart"? How can I suppress this message?

Kaz

 

[David H. Lipman]

From: "churin" <[email protected]>

| I am getting an error message as follows:
|
| rundll32.exe has generated errors and will be closed by Windows.
| You will need to restart the program.
|
| What program to "restart"? How can I suppress this message?
|
| Kaz

Often it is caused by malware...



If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[churin]

David,

Thanks for your response. I am not familiar with Java but I reviewed
ADD/Remove of Control Panel and the following is in the list:

J2SE Runtime Environment 5.0 Update 2
Java 2 Runtime Environment, SE v1.4.2_04

Is any of these what you are referring to?

Kaz

From: "churin" <[email protected]>

| I am getting an error message as follows:
|
| rundll32.exe has generated errors and will be closed by Windows.
| You will need to restart the program.
|
| What program to "restart"? How can I suppress this message?
|
| Kaz

Often it is caused by malware...



If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[David H. Lipman]

From: "churin" <[email protected]>

| David,
|
| Thanks for your response. I am not familiar with Java but I reviewed
| ADD/Remove of Control Panel and the following is in the list:
|
| J2SE Runtime Environment 5.0 Update 2
| Java 2 Runtime Environment, SE v1.4.2_04
|
| Is any of these what you are referring to?
|
| Kaz

Remove them both !

Then install JRE Runtime Environment 5.0 Update 6

http://www.java.com/en/download/manual.jsp

 

[churin]

I removed them but the message came back. I installed the latest Java
anyway, but the problem still lingers. Any further suggestion will be
appreciated.

 

[David H. Lipman]

From: "churin" <[email protected]>

| I removed them but the message came back. I installed the latest Java
| anyway, but the problem still lingers. Any further suggestion will be
| appreciated.
|

The RUNDLL32 error is NOT directly related to Java.

Manytime malware uses RUNDLL32 to execute. many are badly written and cause RUNDLL32
errors.

It was assumed that you had malware thus generating the message.

Did you scan the PC in Safe Mode using Ad-aware SE and SpyBot S&D ?

Did you scan the PC using at least one anti virus scanner using the Multi AV Scanning Tool ?

 

[churin]

No luck yet. I have done exactly what were suggested. So far I have not
seen any application not working. So I will just ignore the error
message since repair installation of the OS will probably not fix this.

 

[David H. Lipman]

From: "churin" <[email protected]>

| No luck yet. I have done exactly what were suggested. So far I have not
| seen any application not working. So I will just ignore the error
| message since repair installation of the OS will probably not fix this.
|

You can try replacing RUNDLL32.EXE

Open a command prompt and enter the following command line...

{ assuming your Win2K distribution CDROM is in drive "D:" }


expand d:\i386\rundll32.ex_ %windir%\rundll32.exe

 

[churin]

From: "churin" <[email protected]>

| No luck yet. I have done exactly what were suggested. So far I have not
| seen any application not working. So I will just ignore the error
| message since repair installation of the OS will probably not fix this.
|

You can try replacing RUNDLL32.EXE

Open a command prompt and enter the following command line...

{ assuming your Win2K distribution CDROM is in drive "D:" }


expand d:\i386\rundll32.ex_ %windir%\rundll32.exe

I did that but the same error message still comes back. I wonder what
rundll32.exe do and what application uses this.

 

[David H. Lipman]

From: "churin" <[email protected]>


| I did that but the same error message still comes back. I wonder what
| rundll32.exe do and what application uses this.

It akes an entru point routine in a DLL file and executes it. This way a DLL, a library of
functions, can have a function execute like a EXE file.

The question is what is using RUNDLL32 ?

You can execute MSCONFIG.EXE tp determine what is using RUNDLL32.EXE

http://www.gwynfryn.co.uk/downloads/msconfig.zip

Unzip the file and place it in your system path (i.e; c:\winnt) and look at the Startup Tab
for what is using RUNDLL32. You can then disable it.

 

[churin]

From: "churin" <[email protected]>


| I did that but the same error message still comes back. I wonder what
| rundll32.exe do and what application uses this.

It akes an entru point routine in a DLL file and executes it. This way a DLL, a library of
functions, can have a function execute like a EXE file.

The question is what is using RUNDLL32 ?

You can execute MSCONFIG.EXE tp determine what is using RUNDLL32.EXE

http://www.gwynfryn.co.uk/downloads/msconfig.zip

Unzip the file and place it in your system path (i.e; c:\winnt) and look at the Startup Tab
for what is using RUNDLL32. You can then disable it.

It is ATIRW.EXE !! I disabled item of RUNDLL32 and another which seemed
related to rundll32.exe but the error message did not stop, so I took a
tedious trial-and-error approach to determine the culprit.

The file is for ATI Multimedia which came in ATI video card CDROM. I am
not using this feature so I may just leave it disabled or uninstall the
ATI Multimedia features. I may be able to fix the error message problem
by reinstalling ATI Multimedia if I want to use in the future.

Thank you very much for your help. I certainly learned a lot about how
to trouble shoot error message problem.

 

[David H. Lipman]

From: "churin" <[email protected]>


| It is ATIRW.EXE !! I disabled item of RUNDLL32 and another which seemed
| related to rundll32.exe but the error message did not stop, so I took a
| tedious trial-and-error approach to determine the culprit.
|
| The file is for ATI Multimedia which came in ATI video card CDROM. I am
| not using this feature so I may just leave it disabled or uninstall the
| ATI Multimedia features. I may be able to fix the error message problem
| by reinstalling ATI Multimedia if I want to use in the future.
|
| Thank you very much for your help. I certainly learned a lot about how
| to trouble shoot error message problem.

Hey that's good troubleshooting !

I am certainly glad I was able to help you along the way.

If you do install the ATI Multimedia, make sure you download the latest version (for Win2K)
first.

 

[churin]

From: "churin" <[email protected]>

If you do install the ATI Multimedia, make sure you download the latest version (for Win2K)
first.

Thank you for the suggestion.