rundll32.exe problems

Nevermind people I believe I fixed it myself...Thx for all your help!

but nobody helped You !:)

what did you do to fix it ,always nice to know

I just found the bridgedll.exe in the scan that i did with hijackthis and fixed it, and everything was fine!

Hi Moxin,

I am experiencing exactly the same problem on my laptop as you were. I am running Win2000 but assume the cause is the same. The problem has only started recently and on shutdown, it cannot close rundll32.exe automatically and requires me to click on I have checked my msconfig startup and there is a line which is as follows:

Startup Item - Bridge
Command - rundll32.exe "C:\WINNT\system32\bridge.dll",Load
Location - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

You mention the fix involves this file, but you do not explain exactly how you fixed it. Can you provide me with some more information ?

Kind Regards

Simon

You can either navigate to the bridge.dll locations & delete them, (after backing up your registry, of course).
Or, you can download & run HijackThis & delete all instances of it with that.

Hi Crunchie, and thanks for the quick reply.

I have done a quick search of my system and the only bridge.dll file can be found in my c:\winnt\system32\bridge.dll.

What I have done is disabled the start up of this, using msconfig. This fixes the problem and does not seem to cause any adverse affects. I will leave this in safe startup mode for the time being to check it does not affect anything else.

I assume that if all is ok, my next steps will be to:

a) Use regedit to permenantly remove the row "rundll32.exe "C:\WINNT\system32\bridge.dll",Load" from the registry folder "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

b) Delete bridge.dll from C:\winnt\system32\ folder?

Or should I leave the bridge.dll file where is is and just delete the registry row?

Cheers again for all your help.

Delete all instances of bridge.dll & nothing else. It is linked to a trojan virus so I wouldn't be surprised if it's on it's Pat Malone (alone).
Probably advisable to post a HJT log, up to you.

Hi Crunchie,

Thanks for you help.

One more question, if this bridge.dll is linked to a trojan virus, why has my virus checker (Sophos) not picked it up. I ran a full scan and it does not see it as a virus? Is this just a .dll file which a trojan virus uses? Very strange. Having said that, my virus checker did block a virus earlier last week. Could this file have been installed then?

Anyway, I have deleted it and the registry entry and all is ok.....so far ;)

Cheers

Simon

A lot of AV's do not pick up all trojans, as you are probably already aware. Even when you get rid of the trojan/virus, they tend to leave behind files that they used. That would be why you get the error messages. I'm no expert though, but this is my understanding of it.

I'm having, i think, i similar problem with the rundll32.exe. when i look at my task manager and look at the processes it says that this process is using up 99 of my CPU. my CPU is being used a 100%! i can't run anything efficiently. i've ran spybot-s&d and ad-aware numerous times but it won't get rid of it. can anyone tell me what i need to do?

I'm having, i think, i similar problem with the rundll32.exe. when i look at my task manager and look at the processes it says that this process is using up 99 of my CPU. my CPU is being used a 100%! i can't run anything efficiently. i've ran spybot-s&d and ad-aware numerous times but it won't get rid of it. can anyone tell me what i need to do?

Depends what OS you have. If you have Windows 2000 then search on google for a program called msconfig.exe. Download it and install it in your Windows/System32 folder.

If you have WinXP, or earlier windows apps then you probably have this app already. Either way, once you have it, click on the start menu and then Run. Type in msconfig and hit enter and this will launch the app. Click on the startup tab and expand the command column. Check each of the rows carefully to see if any of them do not look valid. If you have any doubt about any of the .exe files started when Windows launches, go to google and type in the file name (either .exe or .dll). Keep an eye on the results if a website http://www.liutilities.com. This tends to provide info on all good and bad startup files. If you find out that one of your startup lines is a virus or the like, keep a note of the command file address and also the registry location (next column). Also check task manager and see if that is the process that is slowing up your machine or if there are any others in there that look a bit dodgy. Also check your startup folder (start>all programs>startup) to ensure nothing has been added without your permission. If you don't recognise anything here you can delete the file as it will go to your recycle bin and you can always retrieve it later.

Right back to msconfig. Untick the dodgy processes on the start up list and click apply. It will ask you to reboot your machine so make sure all applications are closed and saved. Your machine will now reboot in safe mode so that you can see if the process was needed or not. If your machine reboots ok and all your apps still work and task manager is looking ok, locate the files in the command and delete them to your recycle bin.

Now is the tricky bit. Click on Start and select cmd again, this time enter regedit. Now if you mess this bit up, you could end up having to rebuild your machine so be careful. Best thing to do before starting is export the registry as it stands. Click File and export and save your registry where you can find it later....if required. Now on the tree menu on the left locate HKEY_Current_User and expand this. Locate Software and expand this. Locate Microsoft on this list and expand. Locate Windows and expand this and then CurrentVersion. In this list should be a folder called Run. Click on this and a list of startup commands will be displayed on the right. Is your dodgy one in there? If not then locate the same folder in HKEY_Local_Machine. To be honest your problem is likely to be in the Local Machine folder rather than Current User but it is always worth checking both.

Once you find the offending command, highlight it. Right Click and select delete. The row should now be deleted. If this has all worked ok, close down regedit. If you have any doubts over what you have deleted or you have deleted something else by mistake, there is no undo so before you close regedit, re-install the registry you exported and start again.

If you have successfully deleted the file and closed regedit, now re-launch msconfig again as you did above. Check the startup list and the offending items should now be removed. Before you close msconfig, click on the general tab and check that the startup selection is set to Normal.

Reboot your machine and hopefully you should have now sorted your problems.....hopefully.

If any of the above sounds too complicated, let me know and I will try to add a bit more explanation.

Cheers

Si

can anyone tell me what i need to do?

jcourt- Please do not post your questions in threads started by other members- you need to start your own thread. Read our posting rules to familiarize yourself with our guidelines.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:59 PM, on 7/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
C:\Program Files\Lexmark 2300 Series\ezprint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\lxcgcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\RegCure\RegCure.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\HPZinw12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\RegistryFix\RegistryFix.exe
C:\WINNT\system32\cmd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Mike and Val\Desktop\Spyware Tools\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKCU\..\Run: [MoneyAgent] C:\Program Files\Microsoft Money\System\Money Express.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll
O15 - Trusted Zone: login.live.com
O15 - Trusted Zone: g.msn.com
O15 - Trusted Zone: http://moneycentral.msn.com
O15 - Trusted Zone: *.passport.com
O15 - Trusted Zone: *.passport.net
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://wf2dnvr5.webfeat.org/dK9pH1375/url=http://site.ebrary.com/lib/cecybrary/support/plugins/ebraryRdr.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1150554327211
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcg_device - Unknown owner - C:\WINNT\System32\lxcgcoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10898 bytes

ummm i got no idea wt u r talking about people but i have the same as the guy on top of my post so i will take your advice about deleting the bridge.dll but .................. how can i delete the registry and do i delete the registry then delete the bridge or shred it ..............or should i delete or shred the bridge.dll and then clean the registry???

Far out guys. This thread is 3 years old. Do yourselves a favour and start your own threads where you may get the help you need :).

really??

really??

Really what??

Read post # 13 above.

Process Name : NvCplDaemon

File Name : rundll32.exe NvCpl.dll, NvStartup

Description: Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card