?
Solved

RUNDLL

Posted on 2008-02-11
21
Medium Priority
?
5,008 Views
Last Modified: 2013-11-30
Since approx. 1 month ago, each time I boot up I receive the following message: RUNDLL - The specified module could not be found - Error Loading C:\Documents. I use a PC with Windows XP.
I have not noticed any discernible lack of performance but I wish to eliminate the message permanently and so looked at your website for possible solutions.
I concluded that Uniblue RegistryBooster2 would probably solve the problem and so purchased it at $29.99. It found 412 errors on the first scan which were all backed up then corrected but the RUNDLL error still exists.
Any simple solutions, preferably cost-free, please.
0
Comment
Question by:impactuk
  • 11
  • 10
21 Comments
 
LVL 21

Expert Comment

by:briancassin
ID: 20865979
I would need the full error message path i.e. c:\documents and settings\username.... etc...

I would say it probably is a virus or spyware if not then it is an application that is damaged. but looking at the path you have put so far I would say spyware or virus.

Download  combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Also download and run hijack this http://tomcoyote.org/hjt


Also run these

your going to need some anti spyware /malware utlities run too

http://www.superantispyware.com 
http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11    - select to only download and install spyware doctor.

Additionally I would download and run rootkit revealer if it comes up with anything odd post it up here.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20865999
To make the scans faster and it could potentially eliminate the error message if it is in a temp directory download and run this first before anything else

http://www.ccleaner.com  download it anaylyze and then run it DO NOT click on the registry section of this program.
0
 

Author Comment

by:impactuk
ID: 20866908
I downloaded ComboFix and think that I am enclosing the log for your further comments.
If you don't receive it, please advise how I should send it.
0
Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

 
LVL 21

Expert Comment

by:briancassin
ID: 20867156
I do not see the logfile, if you click on attach file at the bottom of the window when you hit reply. You can the browse to the location on your system where the file is located and attach it.

Also could you please provide the exact error message you are receiving in outlook
0
 

Author Comment

by:impactuk
ID: 20868408
Sorry for exclusion. I think you'll find that I've done it correctly this time.
Please appreciate that I am not at all technical with computers!
The message in it's entireity says "RUNDLL Error Loading C:\Documents The specified module could not be found"
log.txt
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20868853
Ok what I would like you to do is the follwing

reboot your system so the error comes up DO NOT close the error box while it is on screen press the key on your keyboard that says "PRINT SCRN"  it will be located towards the right and at the top of your keyboard.

Once you have pressed that key with the error message in front of you on the screen

go to start programs accesories Paint while in paint go to edit then select paste then save itas a JPG file type (you will have to select the type from the drop down box) once you have that then post that screenshot up here.
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20868916
In the meantime to troubleshoot this further after posting that screenshot do the following

Run hijack this and post a logfile

the URL is in the set of instructions referencing the different utilities
It is something in your startup folders that is the problem or it is the start section of your registry. We may be able to determine it from the hijack this logfile or we may have to use another program such as http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx and save a logfile and post it

Another way would be to go to start run type msconfig and hit enter then go to the startup tab write down anything that is currently disabled and then disable everything see then hit apply then ok if the message goes away then we can re-enable items one by one and then reboot until the error returns once that happens we will have identified the culprit
0
 

Author Comment

by:impactuk
ID: 20873147
Sorry for delay in responding due to frequently having to leave my PC.
Here is the screenshot.
I'll now attempt to run hijack.
screenshot.JPG
0
 

Author Comment

by:impactuk
ID: 20873183
Here is the hijackthis logfile as requested.
hijackthis.log
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20874460
Looking at yur hijack this log your LSP is broken

I think your error may be related to a virus or spyware but I am not seeing it in your hijack this log.

Do the following
download and run the LSP fix available here
http://www.cexx.org/lspfix.htm  make sure all windows are closed before running it.

Next get this program and post a logfile from it
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx 
this will show me everything that is configured to start when windows starts

next do the following in the meantime after posting that logfile while I am reviewing it...

Download  combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also go to http://www.tomcoyote.org/hjt download hijack this run it and post the logfile here


If combofix reports it removed files then continue on through this if not then post it's logfile and a hijack this logfile

I would then get

http://www.ccleaner.com   download it and run it to clear out all the windows junk files and make the scans faster.

http://www.superantispyware.com download it update it and run it

http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11    - select to only download and install spyware doctor.

online anti virus scanners

http://www.pandasoftware.com   - panda activescan
http://www.bitdefender.com 
http://housecall.trendmicro.com


Additionally I would download and run rootkit revealer if it comes up with anything odd post it up here.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
0
 

Author Comment

by:impactuk
ID: 20875259
Ihave run lspfix and got a message stating that problems were found. It advises keeping:-
mswsock.dll   Tcpip
winmr.dll         NTDS
mdnsNSP.dll    mdnsNSP
rsvp.dll            (Protocol handler)

and removing:-
POP3Interc...   (Protocol handler)
Please advise if I should continue or close without changes before continuing
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20876093
continue because it means your winsock is damaged
0
 

Author Comment

by:impactuk
ID: 20877295
Here is the autoruns data.
AutoRuns.txt
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20877479
Have you tried booting into safe mode ? If not try the following reboot the system then then press f8 and select safe mode see if you still get that message or not in the meantime i will look over your log file.
0
 

Author Comment

by:impactuk
ID: 20880726
I still get RUNDLL on normal reboot but not in safe mode ( but neither did I get any of my start-up progs. other than desktop, nor internet connection in safe mode!)
Requested logs enclosed.
ComboFix-Log.txt
hijackthis-Log.txt
RootkitReveal-Log.txt
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20880942
Did you have anything else open when you ran rootkit revealer it is showing quite a bit of odd entries but that can happen if you had other files and folders open while it was running

Has any of the anti spyware applications picked up anything as of yet ?


Try this for now and let me know what happens go to start run type MSCONFIG then hit enter go to the STARTUP tab and uncheck everything. then checkmark the first item and reboot see if you get the error if so go back to msconfig uncheck it and go to the next one and check it then reboot and see if the problem occurs again. Your going to repeat this process of enabling and disabling them one by one until you get the error once you get the error look at the one that is checked in msconfig as this will be the culprit
0
 

Author Comment

by:impactuk
ID: 20885113
Just spent several hours on problem.
Only thing open when running rootkit revealer was this page on experts-exchange.
Nothing to report yet on anti-spamware.
Went through MSCONFIG exercise and determined that RUNDLL appears on everyone of 25 but when I go back to MSCONFIG there are always the same 2 progs opened with whichever prog I choose even though I only tick one box.
I then tried not ticking any boxes and RUNDLL still appeared and the same 2 progs were ticked.
I then disabled the 2 progs from startup and RUNDLL did not appear but I would prefer the 2 progs to start on startup if possible.
To prevent the 2 boxes being permanently ticked on startup I have had to leave System Config Utility in Selective Startup Mode which eliminates RUNDLL but brings another box up on startup advising me to  revert to normal startup and load all device drivers and services.
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20885215
What two programs then were those ? can you post a screenshot showing them ?

If you have narrowed down to those two then those are the cause of the error.

You can make the system config utility go away on startup if you check the box in the lower left hand corner that says do not start system configuration utility when windows starts
0
 

Author Comment

by:impactuk
ID: 20887044
I have rebooted 2 or 3 times since my last message without changing anything and RUNDLL has not appeared again. The 2 progs are Uniblue Registry Booster 2 and FreeMem Professional which now, without me changing anything, open on startup without RUNDLL which is what I wanted!
The system now appears to work OK but I will need to monitor it for a couple of days to be sure.
I attach a screenshot of the 2 progs I unticked in the Selective Startup Mode which I have retained.
Am I alright leaving things as they now are or do you think I should change anything?
Many thanks for your help & assistance.
John Barlow
RUNDLL-Problem-Progs.JPG
0
 
LVL 21

Accepted Solution

by:
briancassin earned 375 total points
ID: 20887199
OK if those are the two culprits you have a couple of options

1. Uninstall and then Reinstall both programs make sure they are both shutdown when you do this.

2. Leave them unchecked but this means they will not start when the computer starts

3. Try removing free memory pro... Quite honestly these do little in performance increase. if you want a performance increase increase your memory to 1GB or beyond run a program called ccleaner and also get another AV product other then Norton AV which causes a 30% performance hit.

I would go with option 3 and then re-enable your uniblue and see if the problem continues if not then you know it is either a conflict between the two (although i personally don't use registry cleaners as they can cause a lot of problems if they do something wrong ). If option 3 does not work then I would go with option 1 and if neither work stick with option 2 just leave them both disabled at startup
0
 

Author Closing Comment

by:impactuk
ID: 31429774
I think we managed to sort the problem and I thank you for your co-operation
0

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The article will include the best Data Recovery Tools along with their Features, Capabilities, and their Download Links. Hope you’ll enjoy it and will choose the one as required by you.
Considering today’s continual security threats, which affect Information technology networks and systems worldwide, it is very important to practice basic security awareness. A normal system user can secure himself or herself by following these simp…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …
Suggested Courses

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question