rundll32.exe

[noitisnotme]

I have this running in task manager when my computer
comes up and it was not there until this week. I have
check msconfig and the run and run once in the registry
and cannot find out what is starting this. If I click on
it and stop it in the task manager then it cause the dr
watson to run showing a problem. Any ideas why this is
running now and how I stop it?

[MAP]

"noitisnotme" wrote:

http://www.mvps.org/sramesh2k/rundll32.htm

Sometimes,when you remove malware it will stop your TCP/IP
stack from working (Internet connection).
Winsock or LSP-fix will correct the problem,Download first.
Note to anyone using NOD32 Anti-Virus software,Do Not delete the
"imon.dll" this fix reports,That is your e/mail scanning engine.

LSP-fix- http://www.cexx.org/lspfix.htm
Spybot S&D - http://www.safer-networking.org/en/index.html
CWS Smart Killer- http://www.safer-networking.org/minifiles.html

About Buster- http://www.spychecker.com/program/aboutbuster.html
Ad-Aware SE - http://www.lavasoftusa.com/software/adaware/
CWShredder - http://www.majorgeeks.com/download4086.html
Hijack this - http://www.majorgeeks.com/download3155.html
SpywareBlaster - http://www.javacoolsoftware.com/spywareblaster.html
SpywareGuard - http://www.javacoolsoftware.com/spywareguard.html
WinPatrol - http://winpatrol.com
BHODemon - http://pcworld.com/downloads/file_download.asp?fid=23611&fileidx=1
Bazooka -http://www.kephyr.com/spywarescanner/index.html
asquared2 "Trojan Remover" - http://www.emsisoft.com/en/
Sygate Firewall- http://smb.sygate.com/download_buy.htm
NOD32Anti-Virus Free 30 day trial
http://nod32.com/download/trial.htm
Backup your registry with:
Erunt- http://home.t-online.de/home/lars.hederer/erunt/index.htm

A link for free online virus and trojan scanners.
http://virusall.com/downscan.html

A listing of BHO's
http://www.spywaredata.com/bho.php?current_page=0

To see if that freeware program you are about to inststall
is infested with spyware check it out first at this link.
http://www.spychecker.com/

To help stop unauthorized downloads via your activex controls change your
default settings.
These settings are good for XP. The wording should be close for other systems
as well.
Go to control panel and open "internet options.
Click on the security tab then custom level.
make sure these settings are as follows.

Download signed active x controls>set to prompt
Download unsigned active x controls>set to disable
Initialize and script active x controls not marked as safe>set to disable
Run active x controls and pluggins>set to enable
Script active x controls marked safe for scripting>set to enable
Java permissions>set to high
Launching programs and files in a IFRAME" > Prompt
Installation of Desktop items"> Prompt
Navigate sub-frames across different domains>prompt

Free Firewalls
ZoneAlarm (Free and up)
http://snipurl.com/6ohg

Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/

Sygate Personal Firewall (Free and up)
http://smb.sygate.com/buy/download_buy.htm

NTbackup link
http://www.onecomputerguy.com/software/ntbackup.msi

[S.Sengupta]

Rundll32 runs dynamic linked files and which can be used from a
variety of programs. If you are using Nvidia's software then that may be
one of the possible causes.
regards,
ssg MS-MVP
pronetworks.org

[noitisnotme]

Thanks to both of you the first post took me to a site
that had me type
Tasklist /m /fi "imagename eq rundll32.exe"
>C:\rundll32.txt

at cmd and it gave me a list of dlls to look at the only
one that was not microsoft and it was the one but I had
to be difficult and keep looking until I gave up and
removed the bad copy of the program and that fixed the
problem.

thanks to both of you

>.
>

[Ramesh [MVP]]

Thanks for the feedback. This method is much accurate, easy to spot the
rundll32.exe and the DLL file as well:
http://www.mvps.org/sramesh2k/listproc.htm

--
Ramesh, MS-MVP XP Shell/UI
http://www.mvps.org/sramesh2k

"noitisnotme" <anon...@discussions.microsoft.com> wrote in message
news:145d01c4a396$da1d4630$a501...@phx.gbl...

[Ray]

I have a problem with Nvidia files. I changed video brands. I uninstalled
NVidia's drivers, etc. and installed ATI. ATI works fine. However, About 3-4
NVidia files remain. I have tried several ways of getting rid of them. When I
delete them or remove them from msconfig or the registry, they simply
replicate themselves, even before I leave regedit. If I delete them manually
from the windows/system32 subdirectory, I get two error menus when I start
the computer. After "X" out of them, everything is fine until the next boot.
Any ideas of how to permanently rid my computer of these self replicating
files?
Ray

[Rock]

Ray wrote:

Boot into safe mode and delete them.

[Ray]

"Rock" wrote:

> Boot into safe mode and delete them.
>

Rock:
That didn't work. When I rebooted, two menus popped up. At the top it states
Rundll32 or something like that, and in the message part it states it cannot
find those files to run. These two will continue popping up until I put
NVcpl.dll and nvmctray.dll back in the windows\system32 subdir. I even went
to msconfig and removed three of the NVidia lines where it loads nvmctray,
nwiz, and nvcpl. Of course those three lines are back and each one is
rechecked. I have even used regedit to delete all mention of these files and
one other one, but after I have deleted them, registry replicates them almost
as fast as I delete them. I can't figure out what is telling rundll32 to run
them. Any ideas?

[Mook]

"Ray" <R...@discussions.microsoft.com> wrote in message
news:95893BF7-FAAF-4669...@microsoft.com...

Have you tried Driver Cleaner 3?
http://www.drivercleaner.net/dc.htm

[Rock]

Ray wrote:

Only thing I can think of is to reinstall the nvidia driver and then
uninstall it. Did you remove them by using add/remove programs?

Also have you done a thorough scan for malware?

[Ray]

Thanks fellows. I downloaded the program, followed the instructions, and
everything is working A-OK now. Wow! Thanks a-million.

Ray

[Ray]

I spoke too soon. When I turned the computer off to install a new mouse, when
it came up again, there were those two error menus telling me that rundll32
could not find either nvcpl.dll or nvmctray.dll. So, not even Driver Cleaner3
helped. I have used automenu and several other programs, but nothing seems to
help. Any more ideas on how to get rid of NVidia from my computer? I've
already tried reinstalling and then using "Add or Remove Programs" but that
didn't work either.
Ray

[Mook]

"Ray" <R...@discussions.microsoft.com> wrote in message

news:747A963E-BDCE-48DA...@microsoft.com...

I haven't seen the whole thread so you might of already done this. Have you
looked in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
?

[Ray]

"Mook" wrote:
> I haven't seen the whole thread so you might of already done this. Have you
> looked in the registry:
> HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
?

Mook:
Yes I have. When I delete those lines and leave regedit, as well as the
offending lines in msconfig/startup, the offending menus return. When I go
back to the registry and msconfig/startup, the lines are back which I either
deleted or unchecked. In msconfig, they are rechecked. I can't figure out
what is causing them to be reinstalled, rechecked, and replicated.
Ray

[Rock]

Ray wrote:

Ray, please include a portion of the post you're responding to in your
response. Otherwise it gets hard to figure out what you're talking about.

Seems like the files were removed because now you're getting a different
error, right. If it can't find the files then now go back to msconfig
and uncheck the rundll32 command line that is trying to invoke them.