Winlogon.Exe and RunDll32.exe

[Guest]

I seem to have some sort of wierd spyware/virus problem
with 2 PC's. When the PC's boot up I receive a
Winlogon.exe referenced memory. The exact error from the
event log is: Application popup: winlogon.exe -
Application Error : The instruction at "0x10017ef4"
referenced memory at "0x02658000". The memory could not
be "read". The Rundll32 error points to the same
instruction: Application popup: rundll32.exe - Application
Error : The instruction at "0x10017ef4" referenced memory
at "0x00bf4000". The memory could not be "read".

 

[Guest]

Hello,

I'm having this problem too, although my memory read addresses are likely
different. I get this now even when i'm trying to use add/remove in the
control panel (I get "value creation failed " at line 521" and then the
rundll32 error).

Anyone know how to fix this?

 

[George Hester]

You might want to look in the C:\WINNT\Downloaded Program Files. You can get into that folder in the command prompt and do an attrib. This will show you all that are in there. Make a new folder C:\hold and then copy these files or the ones you are unsure of to there. For example:

copy *.dll c:\hold

Then go into the hold folder, select one of the dlls you copied from the DPF and choose Properties. If there is no version tab the file is suspect and you might consider deleting it.

del nasty.dll

You should be able to remove it because the error is telling you it wasn't loaded (thank goodness).

If this removes the file(s) that are causing the rundll32 error then all that is left is to figure out in the registry where they are being called. hijackthis made by Merlin is good for that.

Lastly there are a few other folders to check for nasties:

C:\
C:\WINNT
C:\WINNT\Temp
C:\WINNT\system32
C:\Documents and Settings
C:\Documents and Settings\%profile%\Application Data
C:\Documents and Settings\%profile%\Local Settings\Application Data
C:\Documents and Settings\%profile%\Local Settings\Temp
C:\Documents and Settings\%profile%\Local Settings\Temporary Internet Files

HTH