Jump to content


Photo

RUNDLL error loading c:\program


  • This topic is locked This topic is locked
18 replies to this topic

#1 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 July 2004 - 02:11 PM

can someone help me to fix this please here is my log file

Logfile of HijackThis v1.98.0
Scan saved at 20:08:37, on 28/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\DfrgFat.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Gareth.X5X6W2\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Reboot.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Microsoft® JavaScript® Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra 'Tools' menuitem: JavaScript Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A3388CB-BF71-4423-805D-761DB1EE6DBB}: NameServer = 195.93.33.134
O17 - HKLM\System\CCS\Services\Tcpip\..\{6E57D8F3-7C1F-41D6-B6E2-F7F6F62FB29E}: NameServer = 152.163.0.26 205.188.64.153
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A3388CB-BF71-4423-805D-761DB1EE6DBB}: NameServer = 195.93.33.134
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

#2 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 02 August 2004 - 09:49 AM

can anybody help its been bugging me for weeks :grrr: i've tried adaware and spybot search and destroy but its still there any help would be great thanks

#3 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 02 August 2004 - 09:57 AM

Sorry for the delay gooma but are quite besy.

Just so that you know you are not being ignored - I will handle this case for you but
I need to ask for your patience while I review the log.
Please keep an eye on this message for a resolution.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#4 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 02 August 2004 - 06:35 PM

Hello gooma,

Your log is not clean but there is nothing to worry about.
Can you tell me the type of problems/difficulties you have having?

You can however fix these items.

But first I would like you to change the location of HijackThis.exe.
It's best for this tool NOT TO be located in your Desktop or in a TEMP folder.
This way you can undo any changes if something goes wrong and will prevent the tool placing shortcuts on your Desktop.

Create a new folder in your C: Drive
Name it C:\HJT or HijackThis and move the .exe file in it.

1 - Close all open Explorer windows and browsers
2 - Run HijackThis
3 - Click on the Scan button and when complete
4 - Put a check beside all of the items listed below
5 - Click on the "Fix Checked" button
6 - When complete and all files removed, close the application

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

*
Close the application.

Run HijackThis and submit a new log for review.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#5 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 03 August 2004 - 08:50 AM

hiya thank you for your reply and sorry for my impatience. The problem i'm have is that everytime windows opens an error message appears saying RUNDLL error loading C:/program

I have taken the advice in your last post and moved hijack this to its own folder and deleted the items suggested here is the new log file


Logfile of HijackThis v1.98.1
Scan saved at 14:44:52, on 03/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Reboot.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Microsoft® JavaScript® Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra 'Tools' menuitem: JavaScript Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0717969E-8FCF-4DCF-826A-A8ED5597DA03}: NameServer = 152.163.0.26 205.188.64.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C3A4CC4-157C-46D1-83C1-7794BC4EE5CC}: NameServer = 195.93.33.134
O17 - HKLM\System\CS2\Services\Tcpip\..\{0717969E-8FCF-4DCF-826A-A8ED5597DA03}: NameServer = 152.163.0.26 205.188.64.153
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

#6 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 03 August 2004 - 10:37 AM

C:\Program Files is a Window folder. However if your error message is

c:\Program

and you did not create it then you may have some trojan/virus infection. Check it out.
If you have files in that folder look at the properties and find out where they came from.

Norton/Symantec AntiVirus
On Line check of your computer.
http://security.syma...cv6/default.asp

And/Or

McAfee, Network Security & Management
McAfee, OnLine free Scan
http://us.mcafee.com...lt.asp?cid=9914
*

Before you run a scan, kindly open Task Manager>Processes tab. End the task of hrtcm.exe then close Task Manager. Go ahead in running an online scan.

Reboot the system and confirm your work by running another scan.

Verify that hrtcm.exe is not running as a service. If it's there, end it again via Task Manager>Processes tab.
*

Follow up with an online AV scan at any of the following:

Panda's Active Scan
http://www.pandasoft...n_principal.htm

Trend Micro (PC-cillin) - Free on-line Scan
http://housecall.antivirus.com

RAV Antivirus Online Scan
http://www.ravantivirus.com/scan/

eTrust AV web scanner (Computer Associates)
http://www3.ca.com/v.../virusscan.aspx

If any infected files are found, delete them.
*

If however you have created that folder rename it MY_Programs or any other name but not Program or Programs that can interfere with the operating system.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#7 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 05 August 2004 - 12:46 PM

i've used all the virus checkers listed above and they've come up with nothing and i've not created the folder

just on a side though does it matter that theres several user accounts on the computer or will hijack this pick them all up ?

#8 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 05 August 2004 - 03:09 PM

Does the folder c:\Program exist in your profile or any others?
Check with the other users.

If you are the only one having this problem then it's in your profile settings.

One way that I know in Windows 98 is to execute MSCONFIG with the Start/Run applet. Look in all the sections (tab), if anything is referencing C:\Program.... Disable it.

Let me know what you find and where.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#9 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 05 August 2004 - 03:56 PM

the folder c:/program doesnt appear to exist in any of the user profiles althought it might have and been deleted with noone realising it and the problem happens for all the users have tried the msconfig but there is nothing that references c:/program

#10 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 05 August 2004 - 10:10 PM

Look at this search at Google.com

"RUNDLL error loading C:/program"

I suspect now that one malware program was removed incorrectly and left some entries in your registry.

Looking at this search can you remember removing, NewDotNew or WildTangent, or some others?

If not I will to get help from some of the more knowledgeable experts in this forum.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#11 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 09 August 2004 - 11:58 AM

i cant remember deleting those files however kazza was installed upon the computer and then deleted so it could be one of the malwares associated with that maybe ?

#12 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 09 August 2004 - 08:25 PM

Just notice something. Is your message exactly like this?

RUNDLL error loading C:/program


or is it

RUNDLL error loading C:\program?

The path to a program should be identified with a back slash { \ } you have a Slash { / } in your message. If that should be the case then you may have a wrong entry in your Autoexec.bat or config.sys file.

Note that any swtiches associated with a DOS command should be called with a back slash like C:\Windows\Command\Mscdes.exe /D: etc....

If not certain copy and paste the text of your Autoexec.bat and Config.sys file for review.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#13 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 12 August 2004 - 01:12 PM

no yeh sorry it does say c:\program that was just a typing error by me sorry

#14 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 12 August 2004 - 02:32 PM

Have seeked help from the other experts in this forum. Will get back to you.
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#15 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 12 August 2004 - 06:16 PM

ok cheers and thanks for the help you've put in so far :thumbsup:

#16 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 12 August 2004 - 06:58 PM

Here is one recommendation.

Perhaps they could try disabling this entry through MSConfig:
O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd

It's the only thing that refences RunDll and C:\Program [files]

Do you have C-Media products, or did you remove something that may have left that 04 in your log?

Can you disable this with MsConfig?
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#17 gooma

gooma

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 17 August 2004 - 02:08 PM

disabling that seems to have done the trick as it doesnt pop up with the message now Thanks a lot for spending the time to help cheers :thumbsup:

#18 nasdaq

nasdaq

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 49,091 posts

Posted 17 August 2004 - 05:50 PM

Great nice to see that all is well.
*
Here are some suggestions to reduce the potential for spyware infection in the future. I strongly recommend installing the following :
  • SpywareBlaster - It will prevent most spyware from ever being installed.
  • SpywareGuard - It offers realtime protection from spyware installation attempts.
  • IE-Spyad - IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
I also recommend reading this article.
How did I get infected in the first place?
http://forums.net-in...?showtopic=3051
:wave:
nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.
We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

#19 WinHelp2002

WinHelp2002

    Taking back the Internet

  • Global Moderator
  • PipPipPipPipPip
  • 5,365 posts

Posted 29 September 2004 - 07:42 AM

Glad to see you were able to resolve your problem.

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.
Mike
Former Microsoft MVP Posted Image 1999-2012
"There's no place like 127.0.0.1"
Posted Image
Blocking Malware, Parasites, Hijackers, Trojans, http://www.mvps.org/...p2002/hosts.htm with a HOSTS file




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button