O.T. Issue signing off computer

[Navyguy]

I have a Dell Dimension 8200 running IE8 with XP, SP3 , Windows
Firewall, Avira antivirus, Spybot (for updates only), Spywareblaster,
ATF and Hive Cleanup and all the programs work well together and are
up to date.


For some time now, whenever I log off my computer, a dialog box
appears with this message:

Rundll32.exe

This Program is not responding.

Ending program. If you choose to end program you will loose any
unsaved data. To end program click end now.

Eventually the dialog box does close and the computer shuts off but I
don’t remember this popping up before and it does it every time. Is
this something to worry about and/or is there some way to stop this
from occurring?


Thanks,
Robert

 

[Unk]

I have a Dell Dimension 8200 running IE8 with XP, SP3 , Windows
Firewall, Avira antivirus, Spybot (for updates only), Spywareblaster,
ATF and Hive Cleanup and all the programs work well together and are
up to date.


For some time now, whenever I log off my computer, a dialog box
appears with this message:

Rundll32.exe

This Program is not responding.

Ending program. If you choose to end program you will loose any
unsaved data. To end program click end now.

Eventually the dialog box does close and the computer shuts off but I
don’t remember this popping up before and it does it every time. Is
this something to worry about and/or is there some way to stop this
from occurring?


Thanks,
Robert

Create a new text file and copy & paste the following to it. Then rename it to
"AutoendTasks.reg". Then double-click it to add it to the registry.


Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"
[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"ActiveWndTrkTimeout"=dword:00000000
"AutoEndTasks"="1"

 

[Ken Springer]

I have a Dell Dimension 8200 running IE8 with XP, SP3 , Windows
Firewall, Avira antivirus, Spybot (for updates only), Spywareblaster,
ATF and Hive Cleanup and all the programs work well together and are
up to date.


For some time now, whenever I log off my computer, a dialog box
appears with this message:

Rundll32.exe

This Program is not responding.

Ending program. If you choose to end program you will loose any
unsaved data. To end program click end now.

Eventually the dialog box does close and the computer shuts off but I
don’t remember this popping up before and it does it every time. Is
this something to worry about and/or is there some way to stop this
from occurring?

What if Rundll32.exe is munged or infected?

My first simpleton effort would be to copy the file from a known good
system and see what happens?

Logically to me, if this is happening, something is wrong somewhere.

And I'm not knowledgeable enough to do Unk's instructions.

--
Ken

Mac OS X 10.6.8
Firefox 7.0.1
Thunderbird 7.0.1
LibreOffice 3.3.4

 

[Navyguy]

What if Rundll32.exe is munged or infected?

My first simpleton effort would be to copy the file from a known good
system and see what happens?  

Logically to me, if this is happening, something is wrong somewhere.

And I'm not knowledgeable enough to do Unk's instructions.

--
Ken

Mac OS X 10.6.8
Firefox 7.0.1
Thunderbird 7.0.1
LibreOffice 3.3.4- Hide quoted text -

- Show quoted text -

You've lost me,.. and I don't relish the idea of messing around with
my registry unless absolutely necessary. Please understand that not
everyone is computer literate as yourself. I can follow steps but you
have to be a little clearer such as how do I create a new text file
and how and where do I add it to the registry? Also what if
Rundll32.exe is munged or infected? If so, wouldn't the antivirus
detected a virus? I also don't have the option of copying the file
from a known good system.

There's something else that has happened that may or may not have a
bearing on this.

I recently upgraded Avira and did a scan afterwards. It didn't find
any viruses but it did give me this warning:

C:\WINDOWS\SoftwareDistribution\Download
\9fb5ed881f4ba5e862205ff43febecec\BITD.tmp
[0] Archive type: CAB SFX (self extracting)
--> _sfx_0012._p
[WARNING] The file could not be written!


Tonight, while I was checking Spybot for updates it would not complete
the immunization process and left 5 items unprotected. I then received
a message from Avira saying that my hostfile is blocked for my
protection.

I've never had either of these occurrences happen before.

Thoughts/suggestions?
Thanks,
Robert

 

[Ken Springer]

On 10/21/11 12:32 AM, Navyguy wrote:

You've lost me,.. and I don't relish the idea of messing around with
my registry unless absolutely necessary. Please understand that not
everyone is computer literate as yourself. I can follow steps but you
have to be a little clearer such as how do I create a new text file
and how and where do I add it to the registry? Also what if
Rundll32.exe is munged or infected? If so, wouldn't the antivirus
detected a virus? I also don't have the option of copying the file
from a known good system.

Hi, Robert,

I can't tell if the above paragraph is for me, Unk, or the both of us.

I can't help you with Unk's instructions, that's more than I know how to do.

As for Rundll32.exe, you should find that file in your
C:\Windows\System32 directory. My possible solution would be to find
that file on a working computer, and use a copy of it to replace the one
on your computer. I do not know if you can do that while your computer
is running. You may have to removed your drive, and attach it to a
working computer in order to replace it. No matter what, replacing the
file using another computer will ensure a possible malware install
cannot corrupt it.

AFAIK, antivirus software won't tell you if you file is just munged.

There's something else that has happened that may or may not have a
bearing on this.

I recently upgraded Avira and did a scan afterwards. It didn't find
any viruses but it did give me this warning:

C:\WINDOWS\SoftwareDistribution\Download
\9fb5ed881f4ba5e862205ff43febecec\BITD.tmp
[0] Archive type: CAB SFX (self extracting)
--> _sfx_0012._p
[WARNING] The file could not be written!


Tonight, while I was checking Spybot for updates it would not complete
the immunization process and left 5 items unprotected. I then received
a message from Avira saying that my hostfile is blocked for my
protection.

I've never had either of these occurrences happen before.

Thoughts/suggestions?

I can't help with those messages either. I just futz with these things
for the fun and frustration! LOL

Given your system is around 10 years old, you might consider a failing
hard drive as the problem, and not an infection. I once fixed an old
laptop that would not boot and reported that HAL.DLL was missing or
corrupted at boot up. It wasn't missing, it was right there in the
directory. So I simply replaced it, as I suggested you might try with
Rundll.exe. It booted a few times, then something else was missing or
corrupted.

At that point, I simply reinstalled everything, assuming it was a
malware /virus type issue. I don't mess around trying to find and
destroy them. I happen to believe the one and only way to remove
malware is a format and reinstall. And it turns out, the same opinion
is held by a MS support engineer on the TechNet website.

http://technet.microsoft.com/en-us/library/cc700813.aspx

About two weeks after I did that, the owner said the computer wasn't
booting again. Red flag for me, something more was wrong. It turned
out, we were in the beginnings of a hard drive failure.

To protect your data from total loss, I would put *all* your data on a
separate physical drive, ASAP, but *not* on the cloud! I consider
the cloud or any kind of internet storage to be a security hazard.

And I would store any new data created on the other drive, until you've
determined the problem with your computer.

But read that technet article first, and as soon as you can.



--
Ken

Mac OS X 10.6.8
Firefox 7.0.1
Thunderbird 7.0.1
LibreOffice 3.3.4

 

[Navyguy]

On 10/21/11 12:32 AM, Navyguy wrote:

You've lost me,..  and I don't relish the idea of messing around with
my registry unless absolutely necessary. Please understand that not
everyone is computer literate as yourself. I can follow steps but you
have to be a little clearer such as how do I create a new text file
and how and where do I add it to the registry? Also what if
Rundll32.exe is munged or infected? If so, wouldn't the antivirus
detected a virus? I also don't have the option of copying the file
from a known good system.

Hi, Robert,

I can't tell if the above paragraph is for me, Unk, or the both of us.  

I can't help you with Unk's instructions, that's more than I know how to do.

As for Rundll32.exe, you should find that file in your
C:\Windows\System32 directory.  My possible solution would be to find
that file on a working computer, and use a copy of it to replace the one
on your computer.  I do not know if you can do that while your computer
is running.  You may have to removed your drive, and attach it to a
working computer in order to replace it.  No matter what, replacing the
file using another computer will ensure a possible malware install
cannot corrupt it.

AFAIK, antivirus software won't tell you if you file is just munged.

There's something else that has happened that may or may not have a
bearing on this.

I recently upgraded Avira and did a scan afterwards. It didn't find
any viruses but it did give me this warning:

C:\WINDOWS\SoftwareDistribution\Download
\9fb5ed881f4ba5e862205ff43febecec\BITD.tmp
   [0] Archive type: CAB SFX (self extracting)
   -->  _sfx_0012._p
       [WARNING]   The file could not be written!

Tonight, while I was checking Spybot for updates it would not complete
the immunization process and left 5 items unprotected. I then received
a message from Avira saying that my hostfile is blocked for my
protection.

I've never had either of these occurrences happen before.

Thoughts/suggestions?

I can't help with those messages either.  I just futz with these things
for the fun and frustration!  LOL

Given your system is around 10 years old, you might consider a failing
hard drive as the problem, and not an infection.  I once fixed an old
laptop that would not boot and reported that HAL.DLL was missing or
corrupted at boot up.  It wasn't missing, it was right there in the
directory.  So I simply replaced it, as I suggested you might try with
Rundll.exe.  It booted a few times, then something else was missing or
corrupted.

At that point, I simply reinstalled everything, assuming it was a
malware /virus type issue.  I don't mess around trying to find and
destroy them.  I happen to believe the one and only way to remove
malware is a format and reinstall.  And it turns out, the same opinion
is held by a MS support engineer on the TechNet website.

http://technet.microsoft.com/en-us/library/cc700813.aspx

About two weeks after I did that, the owner said the computer wasn't
booting again.  Red flag for me, something more was wrong.  It turned
out, we were in the beginnings of a hard drive failure.

To protect your data from total loss, I would put *all* your data on a
separate physical drive, ASAP, but *not* on the cloud!    I consider
the cloud or any kind of internet storage to be a security hazard.

And I would store any new data created on the other drive, until you've
determined the problem with your computer.

But read that technet article first, and as soon as you can.

--
Ken

Mac OS X 10.6.8
Firefox 7.0.1
Thunderbird 7.0.1
LibreOffice 3.3.4- Hide quoted text -

- Show quoted text -

Hello Ken,
Sorry if my reply was somewhat confusing. I was actually trying to
answer both of you but I should have made it clear whom I was
resonding to.

As I stated, I do not have the option of using another computer and
using it to repair mine. Even if I did, I don’t think many people
would let me install my drive on their computer to ‘test it’ and/or
fix the problem.

I’ve already upgraded my computer with a new HD however it may be the
case where I’ll have to reformat/reinstall everything. I hope not. If
this isn’t a malware/virus, then I can live with the pop-up unless it
deteriorates further but that is the question isn't it?

Regaring reinstalling, Here’s something from the Technet:


•You can’t clean a compromised system by reinstalling the operating
system over the existing installation. Again, the attacker may very
well have tools in place that tell the installer lies. If that
happens, the installer may not actually remove the compromised files.
In addition, the attacker may also have put back doors in non-
operating system components.

At this point however we don’t know if it’s malware or munged or what
and I’m leery of trying this or that without knowing exactly what is
causing the problem? That’s why I say I’m leery of going into the
registry unless absolutely necessary because you can really screw
things up then.

‘If’ however I need to reinstall or go into the registry to fix this
then I’m willing to do so but I need a little more information before
doing so.

As stated (to UNK) just where and how do I create a text file? Do I
use Wordpad, Word? or what? and where do I insert it into the
registry? I appreciate the assisatance but as I stated not everyone is
computer literate and need some explantion to go along with
instructions.

I’ve heard the term ‘on the cloud’ before but wasn't exactly sure what
it was. I assume from the context it means online storage? I agree
that that would definitely be very 'iffy' and something I wuld not
subscribe to. I don’t have an external HD but I have put all my data
on DVD-RW discs. It’s allot slower and time consuming but at least
it’s something.

Thanks,
Robert

 

[Tim Meddick]

Hi Navyguy,
I really do not think that the [two] problems are
related in any way.

The simplest reason I can give for this is that the failed "Software
Distribution" was, I think, the latest AntiVirus-Signatures download for
your AV software. As this had failed, it impacted on other Anti-Malware
operations.

This problem should clear itself up after another successful "definitions"
update to your regular AV software suite, and also updating your SpyBotSD
installation.

But returning to the [RunDLL32.exe] "not responding" problem - the
suggestion mentioned by "Unk" was, I can confirm, a sound one. You would
create a new text-file by opening "Notepad" and copying (highlight by
left-clicking and holding the mouse, then dragging it across the desired
text) the text from "Unk"'s post and pasting (left-click anywhere in a
blank text-file using Notepad and choosing "paste"), then save the text to
file using the top menus - "File" > "Save As..." (you should write
"somefile.reg" including quotes, into the "Save As" box).

Remember where you placed this file and [re]locate it and double-click on
it answering "Yes" to complete the import.

Alternatively, I have done it for you and posted it here for you to
download, if you like :
http://www.4shared.com/file/ukTEZLcq/AutoEndTasks.html

Please don't feel intimidated by my registry file - it only contains one
setting - that of deciding whether Window's asks you for permission to end
an un-responsive application at shutdown, or whether Windows "auto-ends"
the "task". And that's all it does!

==

Cheers, Tim Meddick, Peckham, London.

 

[Navyguy]

Hello Tim,
I tried doing Unk's version first but since I have my computer set up
for single click it didn't import so I clicked on your link and
download the instruction. Hopefully I did it correctly and will
eliminate the problem.

Regarding the other issue, As I mentioned at the start of the message
I don't actually use Spybot per se except for updates only but it
should complete its passive immunization in any case. So hopefully it
will clear itself up with the next updates as you say.

I'll let you know one way or another if the problem is resolved.

Many thanks,
Robert

 

[Navyguy]

Ok, after doing the above and signing off the computer it gave me the
same dialog box and so I logged off to think about the problem.

I decided I would log back on and try doing Unk's instructions, so I
changed my mouse setting back to double click and then copy/pasted his
instructions onto a text document and changed it's name as he
instructed and saved it in My Documents. I then doubled clicked on it
but nothing happened. I did this more than once to make sure I had
done it correctly but with the same result.

I then logged off again but this time the dialog box was gone.
Apparently the first time I did it worked which may be why when I
doubled clicked on it nothing happened? In any case, it seems that it
required a re-start of the computer to take effect.

I then decided to check and see if there were any updates for the
computer so that I could address the other problem of Spybot’s passive
immunization from not completing normally and Avira giving me the
message that the ‘host file is blocked for my protection’. Avira did
have (2) updates but Spybot had none.

Nevertheless, I tried running the immunization with the same results.
So am I correct in assuming that I need to wait for Spybot’s next
update to resolve this issue?


Thoughts/Suggestions?
Robert

 

[James D Andrews]

Navyguy snuck on to your hard drive to scribble:

Ok, after doing the above and signing off the computer it gave me the
same dialog box and so I logged off to think about the problem.

I decided I would log back on and try doing Unk's instructions, so I
changed my mouse setting back to double click and then copy/pasted his
instructions onto a text document and changed it's name as he
instructed and saved it in My Documents. I then doubled clicked on it
but nothing happened. I did this more than once to make sure I had
done it correctly but with the same result.

I then logged off again but this time the dialog box was gone.
Apparently the first time I did it worked which may be why when I
doubled clicked on it nothing happened? In any case, it seems that it
required a re-start of the computer to take effect.

I then decided to check and see if there were any updates for the
computer so that I could address the other problem of Spybot’s passive
immunization from not completing normally and Avira giving me the
message that the ‘host file is blocked for my protection’. Avira did
have (2) updates but Spybot had none.

Nevertheless, I tried running the immunization with the same results.
So am I correct in assuming that I need to wait for Spybot’s next
update to resolve this issue?


Thoughts/Suggestions?
Robert

Could be. Every once in awhile, bad defs files get put out there.
Avast had an issue a few months back with a bad defs file. After
enough complaints, the next update fixed the problem.

--
-There are some who call me...
Jim


"Distrust any enterprise that requires new clothes."
- Henry David Thoreau (1817-1862)

 

[Tim Meddick]

You can manually search for updates using SpyBotSD's settings, but will
still have to wait until any new updates are available. You should also
make certain your AntiVirus software is up-to-date with it's "signiture
definitions" updates, as I belive the "Software Distribution" failiure was
referring to this.

Regarding the [RunDll32.exe] problem and the registry-file; something has
not worked correctly here, as you should never have "nothing happen" on
double-clicking a registry file...

If the registry file was constructed / downloaded correctly, it's contents
should have looked like this (minimum) :

------------------- copy between lines -------------------


Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"


------------------- copy between lines -------------------

(...but without the "copy between lines" lines!)

The registry file is a plain text file (often, but not necessarily in
Unicode format) but must also be named with the *.reg file extension for
"double-click" to work (alternatively, you could type "regedit
x:\path\filename.reg" into the "Run" box, to make sure the right thing is
happening to the file, as should happen when you "double-click" on one)

All being well, on double-clicking on a [valid] registry file will always
result in you being asked for confirmation that you would like to import
the settings it contains. Answering [Yes] should result in a message
stating that the settings were successfully imported, else that the
registry file is corrupted.

You could try again - but go to the "Kelly's Corner" website, a site very
well spoken of in these groups, and scroll down to line 354 - second [far]
column - for :

http://www.kellys-korner-xp.com/xp_tweaks.htm
354 "Auto End Tasks per User or Per System"

It's your choice which you choose - User or System - either should work,
and you won't have to tell the system to end a hung or unresponsive task
again.

==

Cheers, Tim Meddick, Peckham, London.





Ok, after doing the above and signing off the computer it gave me the
same dialog box and so I logged off to think about the problem.

I decided I would log back on and try doing Unk's instructions, so I
changed my mouse setting back to double click and then copy/pasted his
instructions onto a text document and changed it's name as he
instructed and saved it in My Documents. I then doubled clicked on it
but nothing happened. I did this more than once to make sure I had
done it correctly but with the same result.

I then logged off again but this time the dialog box was gone.
Apparently the first time I did it worked which may be why when I
doubled clicked on it nothing happened? In any case, it seems that it
required a re-start of the computer to take effect.

I then decided to check and see if there were any updates for the
computer so that I could address the other problem of Spybot’s passive
immunization from not completing normally and Avira giving me the
message that the ‘host file is blocked for my protection’. Avira did
have (2) updates but Spybot had none.

Nevertheless, I tried running the immunization with the same results.
So am I correct in assuming that I need to wait for Spybot’s next
update to resolve this issue?


Thoughts/Suggestions?
Robert

 

[Navyguy]

Normally, I manually search for updates every 3 days or so for Spybot,
Avira, Spywareblaster and Windows to make sure everything is up to
date and then make a System Restore point afterwards. So again, I'll
just have to wait until Spybot does another update?

Regarding the (RunDll32.exe) issue, I did go to Kelly Corner and went
to line 354, far right but it wouldn't open for me.

I then tried copy/pasting Unk's fix once again, then renamed it and
made sure it had the reg extension, then saved it to My Documents. I
then tried to double click on it but the same thing occured, it just
opened it up but there was no confirmation message.

If the problem still exists then how is it that the dialog box has
disappeared when shutting off? Of course, it doesn't explain why I'm
not able to get a confirmation when I double click on the saved
message which as you pointed out I should whether it's fixed or not or
why Kelly's Corner wouldn't open for me. Strange,....

Thoughts?
Robert

 

[Navyguy]

In addition to the above; I decided instead of saving it in My
Documents I saved it to my program files on the C drive. This time it
worked when I doubled clicked on it because it came back and asked if
I really wanted to do this etc. I declined since the problem seems to
be resolved.

So it seems it does matter where you save it.

Now I just need to wait for Spybot updates to hopefully resolve that
issue.

Thanks,
Robert

 

[Navyguy]

As a final post,

As I stated above I was finally able to get Unk's suggestion working.
The problem resided in putting the file in My Documents vs the C:
drive program files because then it responded as it normally should.
In any case the computer now signs off normally.

I was able to update Spybot and finish the passive immunization
although Avira again came up with the message that it is blocking the
hostfile for my protection which I believe is normal and just a matter
of course.

I want to thank everyone for their help and assistence.

Best Regards,
Robert