rundll32.exe problem

I have a message that pops up on startup and when opening explorer and at
very new web page that I go to. It does not appear when opening or using
other apps.
It Is:
rundll32.exe has encounter a problem and needs to shut down .....
Have ran spybot & McAfee and do not find a virus. Spybot finds DSO exploits
and they seem to be being placed in by some spywear, as they continue to be
entered in the registry. I have taken them out and they will be back in as
soon as i run explorer again. Also, Spybot has immunize against what ever it
is, because now when the error message pops up in tells me that "Avenue A,
Inc." is attempting to download and the next one is "Doubleclick" or
"Fastclick".
I have tried to reload the rundll32.exe file from an XP CD but the problem
continues. I am using a XP pro CD I Own. I can find my XP Home CD. Is this
preventing me from successfully reloading the rundll32 file using:
expand D:\i386\rundll32.ex_c:\windows\rundll32.exe
Can anyone help?

Perry,

The particular rundll32.exe error message the system is throwing is due
to spy | ad | malware. Advise you to Enable hidden files and folders :
http://forum.aumha.org/viewtopic.php?t=6213

Download and install :

CWShredder http://www.bleepingcomputer.com/forums/tutorial47.html

AdAware SE http://www.bleepingcomputer.com/forums/tutorial48.html

Spybot http://www.bleepingcomputer.com/forums/tutorial43.html

The above links give a tutorial and links to the programs . IF you need
further assistance, download Hijack This. Create a folder on the
<root drive>, usually C:\, and name it HijackThis. Move hijackthis.exe
to that folder. http://www.bleepingcomputer.com/forums/tutorial42.html

STRONGLY advise you against using Hijack This to remove anything unless
you know EXACTLY what you're doing. Post the log to a forum that
specializes in interperting them. Read each forum's guidelines prior to
posting it :

http://computercops.biz/forum67.html

http://forum.aumha.org/viewforum.php?f=30

http://forums.spywareinfo.com/index.php?showforum=18

http://www.bleepingcomputer.com/forums/forum22.html


MowGreen [MVP]
===============
*-343-* FDNY
Never Forgotten
===============




Perry P wrote:
> I have a message that pops up on startup and when opening explorer and at
> very new web page that I go to. It does not appear when opening or using
> other apps.
> It Is:
> rundll32.exe has encounter a problem and needs to shut down .....
> Have ran spybot & McAfee and do not find a virus. Spybot finds DSO exploits
> and they seem to be being placed in by some spywear, as they continue to be
> entered in the registry. I have taken them out and they will be back in as
> soon as i run explorer again. Also, Spybot has immunize against what ever it
> is, because now when the error message pops up in tells me that "Avenue A,
> Inc." is attempting to download and the next one is "Doubleclick" or
> "Fastclick".
> I have tried to reload the rundll32.exe file from an XP CD but the problem
> continues. I am using a XP pro CD I Own. I can find my XP Home CD. Is this
> preventing me from successfully reloading the rundll32 file using:
> expand D:\i386\rundll32.ex_c:\windows\rundll32.exe
> Can anyone help?

Perry,

The particular rundll32.exe error message the system is throwing is due
to spy | ad | malware. Advise you to Enable hidden files and folders :
http://forum.aumha.org/viewtopic.php?t=6213

Download and install :

CWShredder http://www.bleepingcomputer.com/forums/tutorial47.html

AdAware SE http://www.bleepingcomputer.com/forums/tutorial48.html

Spybot http://www.bleepingcomputer.com/forums/tutorial43.html

The above links give a tutorial and links to the programs . IF you need
further assistance, download Hijack This. Create a folder on the
<root drive>, usually C:\, and name it HijackThis. Move hijackthis.exe
to that folder. http://www.bleepingcomputer.com/forums/tutorial42.html

STRONGLY advise you against using Hijack This to remove anything unless
you know EXACTLY what you're doing. Post the log to a forum that
specializes in interperting them. Read each forum's guidelines prior to
posting it :

http://computercops.biz/forum67.html

http://forum.aumha.org/viewforum.php?f=30

http://forums.spywareinfo.com/index.php?showforum=18

http://www.bleepingcomputer.com/forums/forum22.html


MowGreen [MVP]
===============
*-343-* FDNY
Never Forgotten
===============




Perry P wrote:
> I have a message that pops up on startup and when opening explorer and at
> very new web page that I go to. It does not appear when opening or using
> other apps.
> It Is:
> rundll32.exe has encounter a problem and needs to shut down .....
> Have ran spybot & McAfee and do not find a virus. Spybot finds DSO exploits
> and they seem to be being placed in by some spywear, as they continue to be
> entered in the registry. I have taken them out and they will be back in as
> soon as i run explorer again. Also, Spybot has immunize against what ever it
> is, because now when the error message pops up in tells me that "Avenue A,
> Inc." is attempting to download and the next one is "Doubleclick" or
> "Fastclick".
> I have tried to reload the rundll32.exe file from an XP CD but the problem
> continues. I am using a XP pro CD I Own. I can find my XP Home CD. Is this
> preventing me from successfully reloading the rundll32 file using:
> expand D:\i386\rundll32.ex_c:\windows\rundll32.exe
> Can anyone help?

On Wed, 24 Nov 2004 22:29:06 -0800, "Perry P" <Perry
> wrote:

>Have ran spybot & McAfee and do not find a virus. Spybot finds DSO exploits
>and they seem to be being placed in by some spywear, as they continue to be
>entered in the registry. I have taken them out and they will be back in as
>soon as i run explorer again. Also, Spybot has immunize against what ever it
>is, because now when the error message pops up in tells me that "Avenue A,
>Inc." is attempting to download and the next one is "Doubleclick" or
>"Fastclick".

THE DSO EXPLOITS:
They are not (re)placed there by spyware, they are incorrectly "fixed"
by Spybot S&D so they show up again on the next scan. If you are up to
date on your Microsoft updates and patches then you don't have to worry
about the DSO EXPLOITS, as that particular security "weakness" has been
corrected.

To get rid of the DSO EXPLOITS false flags you can set Spybot S&D to
ignore them:
-Open Spybot S&D, click on SETTINGS.
-Click on IGNORE PRODUCTS
-Click on SECURITY
-Check the DSP EXPLOIT box

Or you can download and install "Spybot S&D 1.3.1 TX" which corrects
the DSO EXPLOIT bug in Spybot S&D. This will replace the executable
ONLY, so you must already have either "Spybot S&D 1.3 FINAL" or "Spybot
S&D 1.3.1 BETA" installed. You can download "Spybot S&D 1.3.1 TX" from:

<http://www.majorgeeks.com/download4392.htm>

If neither of those solutions work, or are suitable to you, then reply
and I'll give you instructions on editing your registry to manually
correct the DSO EXPLOITS. Just deleting the entries does not correct
the problem (as you have found out), they need to be written and
formatted correctly to the registery.

THE ERROR MESSAGE POPUPS:
If you don't want these frequent error pop-ups you can disable them by:
-Open Spybot S&D, if you're not on the SPYBOT S&D tab click on it
-Click IMMUNIZE
-From the DROPDOWN MENU in the lower section, select "Block all bad
pages silently."
In order to see this dropdown menu you must have the "Permanently
running bad download blocker for IE" enabled.

--
dak