Rundll32 freezes booting process from time to time

[Lokalaskurar]

Right, so another of my PC's is experiencing trouble again.

I'm running XP (32 bit Media Center Edition 2005). System-components described below.

Process: I start up the PC, the booting works like a charm. I log onto my account*, and all of a sudden: everything freezes. I can se my desktop, but no icons, no taskbar. Everything but the task manager has halted (good old Ctrl+Alt+Del).

(Btw, explorer.exe IS up and running)

As I'm pretty experienced, I tried ending the Rundll32-process, and all of a sudden: everything started working again. This happens from time to time, and the ending of Rundll32 always fixes the problem. Also what's interesting, is that Rundll32 also starts again automatically, something I've never experienced before on any PC.

*This only happens on my profile on the computer.

As Rundll32 is basically a process for dumping data into the RAM, could it be that the RAM is in fact damaged? My father peeks inside the PC from time to time and he does not believe in ESD at all...

Conclusive question: In order to save hours of my life ending the Rundll32-process in order to combat this freezing of mine, what should I do now?

Should I perhaps run a memtest? Are there any possible risks involved with stressing the memory further or anything alike?

I am in no need of a hurry, but some help would be much appreciated!

Computer: Evelina
CPU: AMD Athlon II 3700+ - 2219MHz FSB
Motherboard: Asus A8N-E (Targa Edition)
Memory: 2GbB DDR SDRAM (4*Siemens 512MbB ~350MHz) OC
Videocard: 1GbB XFX (ATi) Radeon HD4550 Passive, 512MbB HyperX included
Cooling: Cat-hair
Soundcard/Speakers: Sweex SC015 7.1 / Pioneer SE-L40 from 1972 & Panasonic RX-CS780
Hard Disk(s): 2*7200rpm Hitachi, 300GbB, 1024GbB
Operating System: Windows MCE 2005 (32-bit)

 

[Mark56]

Do a search for the file, it should only be in Windows\System32, if it appears anywhere else it is likely to be an infection. Open a new thread in the Malware forum to get the help needed to remove it.

Follow this guide to replace your user profile just incase it is corrupted.
http://www.ehow.com/how_5778771_fix-profile-windows-xp-professional.html

Click on the Start button and type sfc /scannow (you must include the gap) in the search box and hit enter. You will be asked to insert the XP CD. This will check your file system for errors.

If the above produces nothing usefull then run through this guide below to test your memory.

Power off the PC and remove the mains connection, always touch the metal of the case with your hands to avoid any static electricity from causing component damage. (On laptops ALWAYS remove the battery before removing or replacing memory modules). Remove all your memory modules. Clean the contacts with a soft rubber (up and down not from end to end) then insert just one module and reboot to test for any change in performance. Repeat this for every module one at a time. Obviously if you only have one module this cannot be done, but you should still remove and clean the module and reseat it and test.

If you only have one stick download this to test it. http://www.memtest.org/

You need to scroll down the page until you see the three blue screenshots. Just below is the list of downloads for Memtest86+ V4.10. Click on Download - Pre-Compiled Bootable ISO (.zip)and save to your desktop, When the download is complete right click the file and select Extract Here and burn the image to a CD. In windows 7 right click the extracted file, select Open With, then select Windows Disc Image Burning Tool then follow the prompts. For all other versions of windows (if you do not have an ISO burner) download this free software. http://www.isoimageburner.com/

Boot the PC into the Bios setup and set the CD/DVD drive to 1st in the boot sequence. Insert the disk in the drive then reboot and the disc will load into dos. Leave the test to run through at least 5 cycles.

The memtest will not be 100% accurate but should easily detect any major faults.

 

[Lokalaskurar]

1. Pardon, I forgot to mention that I've run 2 huge avast! scans - not those extension-based quick ones, but true deep and thorough scans that take ~18 hours to complete. If there's an infection (i.e. replaced Rundll32-file) I'll get to know it in a while.

2. I cannot perform the sfc /scannow -command because the PC in question is a Windows XP MCE, not Pro. or Home. I have tried c´scanning XP Homes with (multiple) XP Pro CD's, and it always ends up in smoke

(not literary of course)

3. I'll get back with the memtest results - you're supposed to check each module right? That'll be 4x a lot of time I guess... And I'm a bit more familiar with ESD than my father, so don't worry about any hardware-related damage before I post another reply .

 

[Mark56]

No Anti Virus software is 100%, when cleaning an infected PC it is always necessary to use at least three scans from different manufacturers. A full scan with Avast could have missed something that may be Malwarebytes would find. This is why I suggested doing a search just to quickly check that the Rundll file was in the right place and there was only one.

I thought that SFC would run on MCE, may be not.

My guide to test your memory only suggests the use of Memtest if you only have one memory stick. As you have four then it will be a far more accurate test to run the PC on one stick at a time for about 24 hours to see if any particular stick produces faults. If you want to use memtest you can run this with all sticks fitted but the results will not be as accurate and it may miss minor faults.

You've not responded to my link for repairing the user profile. As the fault only occurs when you are using your profile I would think this is the most likely resolution. User profiles can and do become corrupted.

 

[Lokalaskurar]

Ah yes, I cannot perform the XP-account replacement as the computer has maxed out the available amounts of users - even the guest account have been safely turned into a stadalone account.

(Running diagnostics before the memtest)

 

[craniumrat]

Try this

Run 'msconfig' on your system. Open the 'Startup' tab. You should get the list of all programs that are run on startup. Can you list all the entries under the 'Command' column that contain RunDll32.exe ?

Most likely the dll that is causing the problem is not something that is compulsary for Windows to run. You might get away with just disabling the entry.

CraniumRat.

 

[Lokalaskurar]

I should have mentioned that I have already checked the MsConfig after autostart entries and found nothing that I consider suspicious. I will check them again in 12 days or so (I currently lack access to the PC in question, you see).

From what I've gathered, the RunDll32.exe is a very, very, very important program, as it provides basic memory-loading functions. Disabling RunDll32.exe is actually a very dangerous operation - although when I disable the RunDll32.exe on startup, I automatically starts up again. And I think this little "restart" fixes the problem which occurs from time to time on startup.

I'll get back with the list of all the programs which contain RunDll32 soon. I can call the guy who has the PC and ask him to check the entries, he wouldn't mind at all (I help him out too... from time to time ).

 

[Mark56]

I think you have misunderstood Craniumrat, he is suggesting you disable programs that run at start up which use RunDll32 not that you disable RunDll32. Although, I am not sure how you will determine this.

I have looked again at this thread after a couple of weeks away from it and see I suggested running sfc /scannow and you said you could not because you are running Windows MCE.
Well, you can run this command without doubt, all you need to hand is the Windows XP Professional disks. During the running of sfc /scannow, if it finds any damaged files, it will ask for the discs.

You should also be able to replace/repair your user profile without any problem following the guide I gave in post 2. This I believe is the most important thing to try in order to resolve the problem as the error only happens when you sign in so it has to be something to do with your user set up or the profile is corrupted. Perhaps you should compare the msconfig start up programs listed when you are signed in with those listed when other users are on.