"There was a problem starting . . ." Rundll32.exe problem

[ray2003]

Hi, I think my rundll32.exe was corrupted by a virus. I've already deleted the virus files (I think). I just need rundll32.exe to stop running the file (which is already deleted) whenever I start up my computer, which gives me the message "There was a problem starting . . . The specified module could not be found" since I've already deleted the file. How do I remove the process (?) from the rundll32.exe file. Thanks a bunch!

 

[DelJo63]

Fyi: this technique is a common virus vector.

Your real issue is a registry entry asking for rundll32 to load that file

 

[LookinAround]

I agree with jobeard. "Conduit" in the directory is also telling. Conduit is a search engine hijack. It's "foistware". It gets downloaded along with something else you really mean to install. Be careful to
> NEVER do "Express" installs
> Always do "Custom" installs and don't simply accept every "Recommended" option. Read every screen option as there's often other things you "agree" to install without you realizing it

That said: Removing Conduit is usually not bad
> Look for Conduit in CtlPnl->Programs and Features. Uninstall if there
> Now look add the add-ons in every browser you use (IE, chrome, etc.) Disable or remove anything for Conduit

If that message remains, let us know. It's easy to fix too. (There's a reference in your registry to file on disk that was already removed)

 

[ray2003]

Thanks a bunch for the help. I've finished the steps. I've deleted the conduit files (?) with regedit (is this correct?). But the damn warning still pops up whenever I start my computer. Can anyone help? Thanks!

 

[LookinAround]

Download and run Autoruns. Wait for it to finish scanning and it shows Ready in lower left corner of the window.

Press Ctl-F and search for conduit. I believe you should find a matching entry. Right click->Delete. If any issue or question File->Save. Save the as Autoruns.arn file on your Desktop. Zip it and upload. I'll take a look

 

[ray2003]

Cool. I did the steps and have uploaded the file. What do you think?

 

[LookinAround]

Huh. Thought the name conduit would of been found. I'll take a closer look but do this to help rule out some of the entries for me

Run Autoruns again. Hit Escape to stop the scan. Click Options->Filter Options then check box for each of these
> Verify code signatures
> Hide Microsoft entries
Then click Rescan button

Create and upload another Autoruns.arn zip

 

[LookinAround]

P.s. Your Autoruns DOES have LOTS of entries where File not Found. (a few are expected). But I'd like to see the 2nd autoruns before starting to remove things

 

[ray2003]

Hi, I followed these instructions. Unfortunately, every time I followed the instructions, Autoruns stops working and gives me an error message ("Autostart program viewer has stopped working . . ."). However, after following the first instructions, the original error message doesn't appear anymore so I guess that part is fixed so much thanks!

 

[LookinAround]

Hey Hey! Glad to hear it works!

p.s. And everytime you install anything - especially any freeware - be sure to read and check settings of every install option on every install screen carefully. It's a pain - but you'll be surprised to see how much tag along crap can get installed if one's not careful

Happy and Safe Computing!