• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
gooma

RUNDLL error loading c:\program

19 posts in this topic

can someone help me to fix this please here is my log file

 

Logfile of HijackThis v1.98.0

Scan saved at 20:08:37, on 28/07/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe

C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

C:\Program Files\Trend Micro\Internet Security\PccPfw.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

C:\WINDOWS\System32\carpserv.exe

C:\Program Files\Trend Micro\Internet Security\pccguide.exe

C:\Program Files\Trend Micro\Internet Security\PCClient.exe

C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe

C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\system32\mmc.exe

C:\WINDOWS\system32\DfrgFat.exe

C:\Program Files\AOL 9.0\waol.exe

C:\Program Files\AOL 9.0\shellmon.exe

C:\WINDOWS\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Gareth.X5X6W2\Desktop\hijackthis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd

O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"

O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"

O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0

O4 - Global Startup: Reboot.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Microsoft® JavaScript® Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra 'Tools' menuitem: JavaScript Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)

O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)

O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A3388CB-BF71-4423-805D-761DB1EE6DBB}: NameServer = 195.93.33.134

O17 - HKLM\System\CCS\Services\Tcpip\..\{6E57D8F3-7C1F-41D6-B6E2-F7F6F62FB29E}: NameServer = 152.163.0.26 205.188.64.153

O17 - HKLM\System\CS2\Services\Tcpip\..\{2A3388CB-BF71-4423-805D-761DB1EE6DBB}: NameServer = 195.93.33.134

O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

Share this post


Link to post
Share on other sites

can anybody help its been bugging me for weeks :grrr: i've tried adaware and spybot search and destroy but its still there any help would be great thanks

Share this post


Link to post
Share on other sites

Sorry for the delay gooma but are quite besy.

 

Just so that you know you are not being ignored - I will handle this case for you but

I need to ask for your patience while I review the log.

Please keep an eye on this message for a resolution.

Share this post


Link to post
Share on other sites

Hello gooma,

 

Your log is not clean but there is nothing to worry about.

Can you tell me the type of problems/difficulties you have having?

 

You can however fix these items.

 

But first I would like you to change the location of HijackThis.exe.

It's best for this tool NOT TO be located in your Desktop or in a TEMP folder.

This way you can undo any changes if something goes wrong and will prevent the tool placing shortcuts on your Desktop.

 

Create a new folder in your C: Drive

Name it C:\HJT or HijackThis and move the .exe file in it.

 

1 - Close all open Explorer windows and browsers

2 - Run HijackThis

3 - Click on the Scan button and when complete

4 - Put a check beside all of the items listed below

5 - Click on the "Fix Checked" button

6 - When complete and all files removed, close the application

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

 

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

*

Close the application.

 

Run HijackThis and submit a new log for review.

Share this post


Link to post
Share on other sites

hiya thank you for your reply and sorry for my impatience. The problem i'm have is that everytime windows opens an error message appears saying RUNDLL error loading C:/program

 

I have taken the advice in your last post and moved hijack this to its own folder and deleted the items suggested here is the new log file

 

 

Logfile of HijackThis v1.98.1

Scan saved at 14:44:52, on 03/08/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe

C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

C:\Program Files\Trend Micro\Internet Security\PccPfw.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

C:\WINDOWS\System32\carpserv.exe

C:\Program Files\Trend Micro\Internet Security\pccguide.exe

C:\Program Files\Trend Micro\Internet Security\PCClient.exe

C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe

C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\AOL 9.0\waol.exe

C:\Program Files\AOL 9.0\shellmon.exe

C:\Program Files\Soulseek\slsk.exe

C:\Program Files\Windows NT\Accessories\wordpad.exe

C:\Hijack This\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd

O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"

O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"

O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0

O4 - Global Startup: Reboot.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Microsoft® JavaScript® Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra 'Tools' menuitem: JavaScript Console - {5C909AB4-E47D-4CDF-924F-9C6CFE77A5AA} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra button: Microsoft® JavaScript® Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)

O9 - Extra 'Tools' menuitem: JavaScript Console - {DC44C3BA-46AB-4220-8D95-CB27DE733462} - C:\WINDOWS\SYSTEM32\COMDLG32.OCX (HKCU)

O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{0717969E-8FCF-4DCF-826A-A8ED5597DA03}: NameServer = 152.163.0.26 205.188.64.153

O17 - HKLM\System\CCS\Services\Tcpip\..\{3C3A4CC4-157C-46D1-83C1-7794BC4EE5CC}: NameServer = 195.93.33.134

O17 - HKLM\System\CS2\Services\Tcpip\..\{0717969E-8FCF-4DCF-826A-A8ED5597DA03}: NameServer = 152.163.0.26 205.188.64.153

O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Nelson Thornes\Science For You\0-7487-6693-6\hsppp.dll

Share this post


Link to post
Share on other sites

C:\Program Files is a Window folder. However if your error message is

c:\Program
and you did not create it then you may have some trojan/virus infection. Check it out.

If you have files in that folder look at the properties and find out where they came from.

 

Norton/Symantec AntiVirus

On Line check of your computer.

http://security.symantec.com/sscv6/default.asp

 

And/Or

 

McAfee, Network Security & Management

McAfee, OnLine free Scan

http://us.mcafee.com/root/mfs/default.asp?cid=9914

*

 

Before you run a scan, kindly open Task Manager>Processes tab. End the task of hrtcm.exe then close Task Manager. Go ahead in running an online scan.

 

Reboot the system and confirm your work by running another scan.

 

Verify that hrtcm.exe is not running as a service. If it's there, end it again via Task Manager>Processes tab.

*

 

Follow up with an online AV scan at any of the following:

 

Panda's Active Scan

http://www.pandasoftware.com/activescan/co...n_principal.htm

 

Trend Micro (PC-cillin) - Free on-line Scan

http://housecall.antivirus.com

 

RAV Antivirus Online Scan

http://www.ravantivirus.com/scan/

 

eTrust AV web scanner (Computer Associates)

http://www3.ca.com/virusinfo/virusscan.aspx

 

If any infected files are found, delete them.

*

 

If however you have created that folder rename it MY_Programs or any other name but not Program or Programs that can interfere with the operating system.

Share this post


Link to post
Share on other sites

i've used all the virus checkers listed above and they've come up with nothing and i've not created the folder

 

just on a side though does it matter that theres several user accounts on the computer or will hijack this pick them all up ?

Share this post


Link to post
Share on other sites

Does the folder c:\Program exist in your profile or any others?

Check with the other users.

 

If you are the only one having this problem then it's in your profile settings.

 

One way that I know in Windows 98 is to execute MSCONFIG with the Start/Run applet. Look in all the sections (tab), if anything is referencing C:\Program.... Disable it.

 

Let me know what you find and where.

Share this post


Link to post
Share on other sites

the folder c:/program doesnt appear to exist in any of the user profiles althought it might have and been deleted with noone realising it and the problem happens for all the users have tried the msconfig but there is nothing that references c:/program

Share this post


Link to post
Share on other sites

Look at this search at Google.com

 

"RUNDLL error loading C:/program"

 

I suspect now that one malware program was removed incorrectly and left some entries in your registry.

 

Looking at this search can you remember removing, NewDotNew or WildTangent, or some others?

 

If not I will to get help from some of the more knowledgeable experts in this forum.

Share this post


Link to post
Share on other sites

i cant remember deleting those files however kazza was installed upon the computer and then deleted so it could be one of the malwares associated with that maybe ?

Share this post


Link to post
Share on other sites

Just notice something. Is your message exactly like this?

 

RUNDLL error loading C:/program

 

or is it

 

RUNDLL error loading C:\program?

 

The path to a program should be identified with a back slash { \ } you have a Slash { / } in your message. If that should be the case then you may have a wrong entry in your Autoexec.bat or config.sys file.

 

Note that any swtiches associated with a DOS command should be called with a back slash like C:\Windows\Command\Mscdes.exe /D: etc....

 

If not certain copy and paste the text of your Autoexec.bat and Config.sys file for review.

Share this post


Link to post
Share on other sites

Have seeked help from the other experts in this forum. Will get back to you.

Share this post


Link to post
Share on other sites

Here is one recommendation.

 

Perhaps they could try disabling this entry through MSConfig:

O4 - HKLM\..\Run: [Cmaudio] RunDll32 c:\Program Files\C-Media\WIN_ME\CMICNFG.CPL,CMICtrlWnd

 

It's the only thing that refences RunDll and C:\Program [files]

Do you have C-Media products, or did you remove something that may have left that 04 in your log?

 

Can you disable this with MsConfig?

Share this post


Link to post
Share on other sites

disabling that seems to have done the trick as it doesnt pop up with the message now Thanks a lot for spending the time to help cheers :thumbsup:

Share this post


Link to post
Share on other sites

Great nice to see that all is well.

*

Here are some suggestions to reduce the potential for spyware infection in the future. I strongly recommend installing the following :

  • SpywareBlaster - It will prevent most spyware from ever being installed.
  • SpywareGuard - It offers realtime protection from spyware installation attempts.
  • IE-Spyad - IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

I also recommend reading this article.

How did I get infected in the first place?

http://forums.net-integration.net/index.php?showtopic=3051

:wave:

Share this post


Link to post
Share on other sites

Glad to see you were able to resolve your problem.

 

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0