July 6, 2008 03:09am pdt

1. souseran 20,488
2. IndiGenus 7,500
3. BillDL 7,100
4. and235100 6,400
5. LeeTutor 5,100
6. war1 4,768
7. rpggamer... 3,950
8. SpYd3r05 3,500
9. johnb6767 3,440
10. nobus 3,402
11. apache09 3,000
12. Oslove 2,400
13. alikaz3 2,200
14. arnold 2,000
14. shasunder 2,000
14. scottdorsey 2,000
14. hlarse 2,000
14. smurf_ki... 2,000
14. VortexAdmin 2,000
14. GaryStevens 2,000
14. cpaglee 2,000
14. oBdA 2,000
14. qz8dsw 2,000
14. speshalyst 2,000
14. r-k 2,000
14. hypercat 2,000
14. HadleyR 2,000
14. vadimrapp1 2,000
14. Nyah247 2,000
14. ipcipher 2,000

1. souseran 31,553
2. rpggamer... 15,334
3. and235100 10,470
4. war1 9,228
5. IndiGenus 7,500
6. LeeTutor 7,300
7. BillDL 7,100
8. Sheharya... 6,125
9. orangutang 6,080
10. r-k 5,950
11. PeteLong 5,600
12. johnb6767 4,640
13. rindi 3,775
14. younghv 3,560
15. SpYd3r05 3,500
15. jkr 3,500
15. PUNKY 3,500
15. sramesh2k 3,500

02.11.2008 at 04:57AM PST, ID: 23152823

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

5.2

RUNDLL

Zone: Windows Registry Cleaners

Tags: RUNDLL The specified module could not be found Error Loading C:\Documents

Since approx. 1 month ago, each time I boot up I receive the following message: RUNDLL - The specified module could not be found - Error Loading C:\Documents. I use a PC with Windows XP.
I have not noticed any discernible lack of performance but I wish to eliminate the message permanently and so looked at your website for possible solutions.
I concluded that Uniblue RegistryBooster2 would probably solve the problem and so purchased it at $29.99. It found 412 errors on the first scan which were all backed up then corrected but the RUNDLL error still exists.
Any simple solutions, preferably cost-free, please.

Start your free trial to view this solution

Question Stats

Zone: Software

Question Asked By: impactuk

Solution Provided By: briancassin

Participating Experts: 1

Solution Grade: B

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

02.11.2008 at 05:19AM PST, ID: 20865979

briancassin:

I would need the full error message path i.e. c:\documents and settings\username.... etc...

I would say it probably is a virus or spyware if not then it is an application that is damaged. but looking at the path you have put so far I would say spyware or virus.

Download combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also download and run hijack this http://tomcoyote.org/hjt

Also run these

your going to need some anti spyware /malware utlities run too

http://www.superantispyware.com
http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11 - select to only download and install spyware doctor.

Additionally I would download and run rootkit revealer if it comes up with anything odd post it up here.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

02.11.2008 at 05:21AM PST, ID: 20865999

briancassin:

To make the scans faster and it could potentially eliminate the error message if it is in a temp directory download and run this first before anything else

http://www.ccleaner.com download it anaylyze and then run it DO NOT click on the registry section of this program.

02.11.2008 at 07:17AM PST, ID: 20866908

impactuk:

I downloaded ComboFix and think that I am enclosing the log for your further comments.
If you don't receive it, please advise how I should send it.

02.11.2008 at 07:39AM PST, ID: 20867156

briancassin:

I do not see the logfile, if you click on attach file at the bottom of the window when you hit reply. You can the browse to the location on your system where the file is located and attach it.

Also could you please provide the exact error message you are receiving in outlook

02.11.2008 at 09:48AM PST, ID: 20868408

impactuk:

Sorry for exclusion. I think you'll find that I've done it correctly this time.
Please appreciate that I am not at all technical with computers!
The message in it's entireity says "RUNDLL Error Loading C:\Documents The specified module could not be found"

log.txt (9 KB) (File Type Details)

ComboFix Logfile

02.11.2008 at 10:35AM PST, ID: 20868853

briancassin:

Ok what I would like you to do is the follwing

reboot your system so the error comes up DO NOT close the error box while it is on screen press the key on your keyboard that says "PRINT SCRN" it will be located towards the right and at the top of your keyboard.

Once you have pressed that key with the error message in front of you on the screen

go to start programs accesories Paint while in paint go to edit then select paste then save itas a JPG file type (you will have to select the type from the drop down box) once you have that then post that screenshot up here.

02.11.2008 at 10:42AM PST, ID: 20868916

briancassin:

In the meantime to troubleshoot this further after posting that screenshot do the following

Run hijack this and post a logfile

the URL is in the set of instructions referencing the different utilities
It is something in your startup folders that is the problem or it is the start section of your registry. We may be able to determine it from the hijack this logfile or we may have to use another program such as http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx and save a logfile and post it

Another way would be to go to start run type msconfig and hit enter then go to the startup tab write down anything that is currently disabled and then disable everything see then hit apply then ok if the message goes away then we can re-enable items one by one and then reboot until the error returns once that happens we will have identified the culprit

02.12.2008 at 12:17AM PST, ID: 20873147

impactuk:

Sorry for delay in responding due to frequently having to leave my PC.
Here is the screenshot.
I'll now attempt to run hijack.

screenshot.JPG (165 KB) (File Type Details)

Screenshot

02.12.2008 at 12:29AM PST, ID: 20873183

impactuk:

Here is the hijackthis logfile as requested.

hijackthis.log (11 KB) (File Type Details)

Hijackthis logfile

02.12.2008 at 05:26AM PST, ID: 20874460

briancassin:

Looking at yur hijack this log your LSP is broken

I think your error may be related to a virus or spyware but I am not seeing it in your hijack this log.

Do the following
download and run the LSP fix available here
http://www.cexx.org/lspfix.htm make sure all windows are closed before running it.

Next get this program and post a logfile from it
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
this will show me everything that is configured to start when windows starts

next do the following in the meantime after posting that logfile while I am reviewing it...

Download combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also go to http://www.tomcoyote.org/hjt download hijack this run it and post the logfile here

If combofix reports it removed files then continue on through this if not then post it's logfile and a hijack this logfile

I would then get

http://www.ccleaner.com download it and run it to clear out all the windows junk files and make the scans faster.

http://www.superantispyware.com download it update it and run it

http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11 - select to only download and install spyware doctor.

online anti virus scanners

http://www.pandasoftware.com - panda activescan
http://www.bitdefender.com
http://housecall.trendmicro.com

Additionally I would download and run rootkit revealer if it comes up with anything odd post it up here.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

02.12.2008 at 06:57AM PST, ID: 20875259

impactuk:

Ihave run lspfix and got a message stating that problems were found. It advises keeping:-
mswsock.dll Tcpip
winmr.dll NTDS
mdnsNSP.dll mdnsNSP
rsvp.dll (Protocol handler)

and removing:-
POP3Interc... (Protocol handler)
Please advise if I should continue or close without changes before continuing

02.12.2008 at 08:13AM PST, ID: 20876093

briancassin:

continue because it means your winsock is damaged

02.12.2008 at 10:25AM PST, ID: 20877295

impactuk:

Here is the autoruns data.

AutoRuns.txt (65 KB) (File Type Details)

Autoruns Text

02.12.2008 at 10:45AM PST, ID: 20877479

briancassin:

Have you tried booting into safe mode ? If not try the following reboot the system then then press f8 and select safe mode see if you still get that message or not in the meantime i will look over your log file.

02.12.2008 at 04:38PM PST, ID: 20880726

impactuk:

I still get RUNDLL on normal reboot but not in safe mode ( but neither did I get any of my start-up progs. other than desktop, nor internet connection in safe mode!)
Requested logs enclosed.

ComboFix-Log.txt (9 KB) (File Type Details)

ComboFix Log

hijackthis-Log.txt (10 KB) (File Type Details)

hijackthis Log

RootkitReveal-Log.txt (3 KB) (File Type Details)

RootkitReveal Log

02.12.2008 at 05:26PM PST, ID: 20880942

briancassin:

Did you have anything else open when you ran rootkit revealer it is showing quite a bit of odd entries but that can happen if you had other files and folders open while it was running

Has any of the anti spyware applications picked up anything as of yet ?

Try this for now and let me know what happens go to start run type MSCONFIG then hit enter go to the STARTUP tab and uncheck everything. then checkmark the first item and reboot see if you get the error if so go back to msconfig uncheck it and go to the next one and check it then reboot and see if the problem occurs again. Your going to repeat this process of enabling and disabling them one by one until you get the error once you get the error look at the one that is checked in msconfig as this will be the culprit

02.13.2008 at 07:45AM PST, ID: 20885113

impactuk:

Just spent several hours on problem.
Only thing open when running rootkit revealer was this page on experts-exchange.
Nothing to report yet on anti-spamware.
Went through MSCONFIG exercise and determined that RUNDLL appears on everyone of 25 but when I go back to MSCONFIG there are always the same 2 progs opened with whichever prog I choose even though I only tick one box.
I then tried not ticking any boxes and RUNDLL still appeared and the same 2 progs were ticked.
I then disabled the 2 progs from startup and RUNDLL did not appear but I would prefer the 2 progs to start on startup if possible.
To prevent the 2 boxes being permanently ticked on startup I have had to leave System Config Utility in Selective Startup Mode which eliminates RUNDLL but brings another box up on startup advising me to revert to normal startup and load all device drivers and services.

02.13.2008 at 07:55AM PST, ID: 20885215

briancassin:

What two programs then were those ? can you post a screenshot showing them ?

If you have narrowed down to those two then those are the cause of the error.

You can make the system config utility go away on startup if you check the box in the lower left hand corner that says do not start system configuration utility when windows starts

02.13.2008 at 11:05AM PST, ID: 20887044

impactuk:

I have rebooted 2 or 3 times since my last message without changing anything and RUNDLL has not appeared again. The 2 progs are Uniblue Registry Booster 2 and FreeMem Professional which now, without me changing anything, open on startup without RUNDLL which is what I wanted!
The system now appears to work OK but I will need to monitor it for a couple of days to be sure.
I attach a screenshot of the 2 progs I unticked in the Selective Startup Mode which I have retained.
Am I alright leaving things as they now are or do you think I should change anything?
Many thanks for your help & assistance.
John Barlow

RUNDLL-Problem-Progs.JPG (224 KB) (File Type Details)

RUNDLL Problem Progs.

02.13.2008 at 11:24AM PST, ID: 20887199

briancassin:

OK if those are the two culprits you have a couple of options

1. Uninstall and then Reinstall both programs make sure they are both shutdown when you do this.

2. Leave them unchecked but this means they will not start when the computer starts

3. Try removing free memory pro... Quite honestly these do little in performance increase. if you want a performance increase increase your memory to 1GB or beyond run a program called ccleaner and also get another AV product other then Norton AV which causes a 30% performance hit.

I would go with option 3 and then re-enable your uniblue and see if the problem continues if not then you know it is either a conflict between the two (although i personally don't use registry cleaners as they can cause a lot of problems if they do something wrong ). If option 3 does not work then I would go with option 1 and if neither work stick with option 2 just leave them both disabled at startup

Accepted Solution

20080236-EE-VQP-29 / EE_QW_2_20070628