[cisco]

My laptop freezes and I get the message "Rundll32 is not responding." When I do End Task, everything is OK for awhile, but then it happens again. There's no pattern to it, I don't think, and it seems to do it both on and off the internet.

I have AdAware, SpyBot and I downloaded and ran Hijack This tonight. See HJT Log, below. I've only had this laptop for about 2 weeks. I wanted to solve this problem on my own, but I've gone as far as I can. Can someone please help me?

Logfile of HijackThis v1.97.7
Scan saved at 2:03:07 AM, on 5/29/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\PLUS!\SPIDER\SPIDER.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...8129.4085648148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

[Advertisements]

Welcome to Geeks to Go cisco!

I don't see any signs of spyware, but I also don't see any antivirus software:

We recommend AVG's free version:
http://www.grisoft.c...s_dwnl_free.php

Might also try a trojan scan:
http://www.www.moosoft.com

Since it's a new laptop you probably don't have much to backup, might want to consider a recovery.

Finally, if none of this works, try testing your memory:
http://www.memtest86.com

[admin]

Welcome to Geeks to Go cisco!

I don't see any signs of spyware, but I also don't see any antivirus software:

We recommend AVG's free version:
http://www.grisoft.c...s_dwnl_free.php

Might also try a trojan scan:
http://www.www.moosoft.com

Since it's a new laptop you probably don't have much to backup, might want to consider a recovery.

Finally, if none of this works, try testing your memory:
http://www.memtest86.com

[cisco]

Thanks. I downloaded AVG....no viruses. I also did a trojan scan....no Trojans. I tried to download memtest, but when I tried to install it, it would open WordPad, with a lot of gibberish written in it. Everything I tried turned out the same. Don't know what I was doing wrong.

I'd rather not do a recovery if at all possible.

What does Rundll32 do? Why does it come back, even though I close it? Do I need it? Can it be removed?

One more question. How can I change the name that appears on my OS? The guy that worked on my laptop got confused and used some one else's name instead of mine, when he reinstalled WinMe. He didn't realize what he'd done until he'd already shipped it back to me.

[admin]

I tried to download memtest, but when I tried to install it, it would open WordPad, with a lot of gibberish written in it

You need to insert a blank floppy drive, then run the memtest86 file you downloaded. It will create a bootable floppy, which then is used to restart the system, and perform the memory testing.

What does Rundll32 do?

Microsoft "Run a DLL as an App". RUNDLL32 is the Microsoft Windows program that loads DLLs into memory so that they can be used by specific programs or by Windows. Required by Windows, do not remove.

One more question. How can I change the name that appears on my OS?

Run the Registry Editor (Start > Run, type REGEDIT.EXE).
Open HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion.
To change the values of the RegisteredOrganization, RegisteredOwner, or ProductId, simply double-click on them.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.