rundll32.exe consuming 98% of memory

[Guest]

Hi,

Hope someone here can help. Running XP Pro SP1 on a Thinkpad. Spyware and
antivirus scans up to date and clean. About 4-5 times a day, my computer will
slow to a crawl. If I pull up Task Manager, rundll32.exe is hogging 95-99%
of memory. I have extracted and installed a clean copy of the file and the
problem remains. Any ideas? The KB and 2 forums I checked have nothing to
say. Thanks!

 

[Gerry Cornell]

David

Rundll32.exe is a process which executes DLL's and places their
libraries into memory. It is also a process, which is used by Trojans.

Will you please use Windows Explorer to search your hard disk for all
copies of rundll32.exe and post a list of all the file paths to each.

I also suggest you download Process Explorer so that you can see the
tree leading to rundll32.exe.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Neal Ferrier]

Need more information does this just happen randomly or does it happen when
you do something specific?
try this site
http://www.kellys-korner-xp.com/xp_tweaks.htm
see if one of the lines applies to your situation. If not try updating to
SP2.
All i can think of.

 

[Wesley Vogel]

To see what piece of spyware rundll32.exe is running on your machine.

What's the suspicious Rundll32.exe process
http://www.mvps.org/sramesh2k/rundll32.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Wesley, Neal, Gerry,

Thanks for all the help. I'm running the Explorer search now. One odd path
is to the folder where I downloaded a cell phone toolkit. A copy of
rundll32.exe sits there at the top of the subfolders tree. This software is
not running, but yeah, it looks odd. I have a better toolkit now, so will
delete the first one, though nothing on it shows in "add/delete programs".
My Spysweeper and ZoneAlarm show nothing odd.

I ran the process list Wes suggested and will post it. I could use some help
sorting out what is a legit XP process and what is not.

Again, thanks

David

 

[Wesley Vogel]

David,

What's the name of the cell phone toolkit?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Name is motoconnect, motophone or SCRuntimeSetup23.exe - I changed the folder
name so I don't have the original name.

Rundll32 list that I could use some help interpreting:

ntdll.dll, kernel32.dll, msvcrt.dll, GDI32.dll, USER32.dll, ADVAPI32.dll,
RPCRT4.dll, IMAGEHLP.dll, LPK.DLL, USP10.dll, pwrmonit.dll, MFC42.DLL,
ole32.dll, OLEAUT32.dll, setupapi.dll, powrprof.dll, tppwrw32.dll,
uxtheme.dll, MSCTF.dll

 

[Wesley Vogel]

MotoConnect looks like something from motorola V60p
http://motoinfo.motorola.com/motoinfo/products.asp?product=V60p&y=2003

All Microsoft, except for two...
ntdll.dll, NT Layer DLL
kernel32.dll, Windows NT BASE API Client DLL
msvcrt.dll, Windows NT CRT DLL
GDI32.dll, GDI Client DLL
USER32.dll, GDI Client DLL
ADVAPI32.dll, Advanced Windows 32 Base API
RPCRT4.dll, Remote Procedure Call Runtime
IMAGEHLP.dll, Windows NT Image Helper
LPK.DLL, Language Pack
USP10.dll, Uniscribe Unicode script processor
pwrmonit.dll, a module which adds functionality to IBM Thinkpads and adds a
battery gauge icon in the Taskbar. <------
MFC42.DLL, MFCDLL Shared Library - Retail Version
ole32.dll, Microsoft OLE for Windows
OLEAUT32.dll, Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM)
Operating Systems
setupapi.dll, Windows Setup API
powrprof.dll, Power Profile Helper DLL
tppwrw32.dll, something to do with IBM Thinkpads <------
uxtheme.dll, Microsoft UxTheme Library
MSCTF.dll MSCTF Server DLL

See if this helps...

From a newsgroup post...
[[I had the same CPU usage problem with rundll32 on my T41 and XP SP2.
pwrmonit.dll is part of the power management utilities for IBM Thinkpads.
Updating to version 1.37a seemed to solve the issue:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-44226 ]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Wes,

Thanks for all the info. The link does not work, however, "page
unavailable". Any idea how to find my current version of the Thinkpad
configuration utility? I have to install a version highrer than 1.31 before
updating the power managment package. Thanks

MotoConnect looks like something from motorola V60p
http://motoinfo.motorola.com/motoinfo/products.asp?product=V60p&y=2003

All Microsoft, except for two...
ntdll.dll, NT Layer DLL
kernel32.dll, Windows NT BASE API Client DLL
msvcrt.dll, Windows NT CRT DLL
GDI32.dll, GDI Client DLL
USER32.dll, GDI Client DLL
ADVAPI32.dll, Advanced Windows 32 Base API
RPCRT4.dll, Remote Procedure Call Runtime
IMAGEHLP.dll, Windows NT Image Helper
LPK.DLL, Language Pack
USP10.dll, Uniscribe Unicode script processor
pwrmonit.dll, a module which adds functionality to IBM Thinkpads and adds a
battery gauge icon in the Taskbar. <------
MFC42.DLL, MFCDLL Shared Library - Retail Version
ole32.dll, Microsoft OLE for Windows
OLEAUT32.dll, Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM)
Operating Systems
setupapi.dll, Windows Setup API
powrprof.dll, Power Profile Helper DLL
tppwrw32.dll, something to do with IBM Thinkpads <------
uxtheme.dll, Microsoft UxTheme Library
MSCTF.dll MSCTF Server DLL

See if this helps...

From a newsgroup post...
[[I had the same CPU usage problem with rundll32 on my T41 and XP SP2.
pwrmonit.dll is part of the power management utilities for IBM Thinkpads.
Updating to version 1.37a seemed to solve the issue:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-44226 ]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Name is motoconnect, motophone or SCRuntimeSetup23.exe - I changed the
folder name so I don't have the original name.

Rundll32 list that I could use some help interpreting:

ntdll.dll, kernel32.dll, msvcrt.dll, GDI32.dll, USER32.dll, ADVAPI32.dll,
RPCRT4.dll, IMAGEHLP.dll, LPK.DLL, USP10.dll, pwrmonit.dll, MFC42.DLL,
ole32.dll, OLEAUT32.dll, setupapi.dll, powrprof.dll, tppwrw32.dll,
uxtheme.dll, MSCTF.dll

 

[Wesley Vogel]

IBM Personal computing support - Battery MaxiMiser and Power Management
features for Windows - ThinkPad General
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-44226#APPLYCOUNTRY
or...
http://www-3.ibm.com/pc/support/sit...yle=ibm&lndocid=MIGR-44226&velxr-layout=print

README for Battery MaxiMiser and Power Management Features package
ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/1xu105u1.txt

Battery MaxiMiser and Power Management Features package
http://www-307.ibm.com/pc/support/site.wss/license.do?filename=mobiles/1xu105u1.exe

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wes,

Thanks for all the info. The link does not work, however, "page
unavailable". Any idea how to find my current version of the Thinkpad
configuration utility? I have to install a version highrer than 1.31
before updating the power managment package. Thanks

MotoConnect looks like something from motorola V60p
http://motoinfo.motorola.com/motoinfo/products.asp?product=V60p&y=2003

All Microsoft, except for two...
ntdll.dll, NT Layer DLL
kernel32.dll, Windows NT BASE API Client DLL
msvcrt.dll, Windows NT CRT DLL
GDI32.dll, GDI Client DLL
USER32.dll, GDI Client DLL
ADVAPI32.dll, Advanced Windows 32 Base API
RPCRT4.dll, Remote Procedure Call Runtime
IMAGEHLP.dll, Windows NT Image Helper
LPK.DLL, Language Pack
USP10.dll, Uniscribe Unicode script processor
pwrmonit.dll, a module which adds functionality to IBM Thinkpads and
adds a battery gauge icon in the Taskbar. <------
MFC42.DLL, MFCDLL Shared Library - Retail Version
ole32.dll, Microsoft OLE for Windows
OLEAUT32.dll, Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM)
Operating Systems
setupapi.dll, Windows Setup API
powrprof.dll, Power Profile Helper DLL
tppwrw32.dll, something to do with IBM Thinkpads <------
uxtheme.dll, Microsoft UxTheme Library
MSCTF.dll MSCTF Server DLL

See if this helps...

From a newsgroup post...
[[I had the same CPU usage problem with rundll32 on my T41 and XP SP2.
pwrmonit.dll is part of the power management utilities for IBM Thinkpads.
Updating to version 1.37a seemed to solve the issue:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-44226
]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Name is motoconnect, motophone or SCRuntimeSetup23.exe - I changed the
folder name so I don't have the original name.

Rundll32 list that I could use some help interpreting:

ntdll.dll, kernel32.dll, msvcrt.dll, GDI32.dll, USER32.dll,
ADVAPI32.dll, RPCRT4.dll, IMAGEHLP.dll, LPK.DLL, USP10.dll,
pwrmonit.dll, MFC42.DLL, ole32.dll, OLEAUT32.dll, setupapi.dll,
powrprof.dll, tppwrw32.dll, uxtheme.dll, MSCTF.dll

:

David,

What's the name of the cell phone toolkit?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In David0250 <[email protected]> hunted and pecked:
Wesley, Neal, Gerry,

Thanks for all the help. I'm running the Explorer search now. One odd
path is to the folder where I downloaded a cell phone toolkit. A copy
of rundll32.exe sits there at the top of the subfolders tree. This
software is not running, but yeah, it looks odd. I have a better
toolkit now, so will delete the first one, though nothing on it shows
in "add/delete programs". My Spysweeper and ZoneAlarm show nothing
odd.

I ran the process list Wes suggested and will post it. I could use
some help sorting out what is a legit XP process and what is not.

Again, thanks

David

:

To see what piece of spyware rundll32.exe is running on your machine.

What's the suspicious Rundll32.exe process
http://www.mvps.org/sramesh2k/rundll32.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In David0250 <[email protected]> hunted and pecked:
Hi,

Hope someone here can help. Running XP Pro SP1 on a Thinkpad.
Spyware and antivirus scans up to date and clean. About 4-5 times a
day, my computer will slow to a crawl. If I pull up Task Manager,
rundll32.exe is hogging 95-99% of memory. I have extracted and
installed a clean copy of the file and the problem remains. Any
ideas? The KB and 2 forums I checked have nothing to say. Thanks!