Rundll32 hangs pc on shutdown

Rundll32 runs randomly on my computer - sometimes it opens, sometimes
not. IF it is open, and I try to shut down or restart, it just hangs.
Once in a while I can shut down Rundll32 with ctrl-E and the shut down
proceeds properly. Usually I have to power down and run scandisk on reboot.

Is there anything I can do about this?

Mike
Sun Oct 01 16:57:45 CDT 2006

What is the actual problem you are having? rundll32.exe is a valid
process and can be used by a number of genuine applications, one being
tweakui. Nevertheless this process is also implicated in several malware
attacks so it would be a very good thing to thoroughly check your PC for
unwanted malware using preferred antivirus and antispyware applications.
--
Mike Maltby
mike.maltby@gmail.com


betsy <betsy@nowh.ere> wrote:

> Rundll32 runs randomly on my computer - sometimes it opens, sometimes
> not. IF it is open, and I try to shut down or restart, it just hangs.
> Once in a while I can shut down Rundll32 with ctrl-E and the shut down
> proceeds properly. Usually I have to power down and run scandisk on
> reboot.
> Is there anything I can do about this?

Betsy
Mon Oct 02 01:55:09 CDT 2006

Mike M wrote:
> What is the actual problem you are having? rundll32.exe is a valid
> process and can be used by a number of genuine applications, one being
> tweakui. Nevertheless this process is also implicated in several
> malware attacks so it would be a very good thing to thoroughly check
> your PC for unwanted malware using preferred antivirus and antispyware
> applications.

The actual problem is, certain programs (I don't know exactly) trigger
rundll32 and then the computer locks up. I am very careful about
malware, virus, etc and I'm sure I don't have any problems. My pc was
just reformatted 5 days ago and the first thing I did was add zonealarm,
avg and adaware. I've used that combo for years and it's worked fine for me.

Do you want a list of the apps I've installed? I have been trying new
things - ie, looking for a notepad substitute, etc.

Thanks, Betsy

Mike
Mon Oct 02 04:33:05 CDT 2006

No-one is going to be able to help you unless you help yourself and to do
that means posting details of the application you have running that causes
this problem with rundll32.exe. Running rundll32 doesn't lock up a PC
otherwise there would be no point in having the process. I'm sorry but
you are going to have to do some detective work in you want help.

Look to ZoneAlarm as this could well be what is causing you your problems.
What version do you have installed? Are system restore checkpoints being
created?

Tracking down shutdown and power-off problems (they differ) can be
somewhat difficult but may I suggest that you start by having a look at MS
KB 273746 - "How to Troubleshoot Windows Me Shutdown Problems"
(http://support.microsoft.com?kbid=273746) and then move on to Jim
Eshelman's pages at http://aumha.org/win4/a/shutdown.htm and
http://aumha.org/win4/a/shtdwnme.htm which cover this topic. Hopefully
you will find advice there that will help your resolve your problem.

The Windows Me Startup and Shutdown Troubleshooting Wizard is located in
the Help and Support Centre in Windows Me or at the following Microsoft
Web site: http://support.microsoft.com/support/windows/tshoot/
--
Mike Maltby
MS-MVP Windows
mike.maltby@gmail.com


Betsy Garfield <betsy@nowh.ere> wrote:

> The actual problem is, certain programs (I don't know exactly) trigger
> rundll32 and then the computer locks up. I am very careful about
> malware, virus, etc and I'm sure I don't have any problems. My pc was
> just reformatted 5 days ago and the first thing I did was add
> zonealarm, avg and adaware. I've used that combo for years and it's
> worked fine for me.
> Do you want a list of the apps I've installed? I have been trying new
> things - ie, looking for a notepad substitute, etc.
>
> Thanks, Betsy

Betsy
Wed Oct 04 01:57:39 CDT 2006

Mike M wrote:
> No-one is going to be able to help you unless you help yourself and to
> do that means posting details of the application you have running that
> causes this problem with rundll32.exe. Running rundll32 doesn't lock up
> a PC otherwise there would be no point in having the process. I'm sorry
> but you are going to have to do some detective work in you want help.
>
> Look to ZoneAlarm as this could well be what is causing you your
> problems. What version do you have installed? Are system restore
> checkpoints being created?
>
> Tracking down shutdown and power-off problems (they differ) can be
> somewhat difficult but may I suggest that you start by having a look at MS
> KB 273746 - "How to Troubleshoot Windows Me Shutdown Problems"
> (http://support.microsoft.com?kbid=273746) and then move on to Jim
> Eshelman's pages at http://aumha.org/win4/a/shutdown.htm and
> http://aumha.org/win4/a/shtdwnme.htm which cover this topic. Hopefully
> you will find advice there that will help your resolve your problem.
>
> The Windows Me Startup and Shutdown Troubleshooting Wizard is located in
> the Help and Support Centre in Windows Me or at the following Microsoft
> Web site: http://support.microsoft.com/support/windows/tshoot/

Ok. Sorry to take so long to get back but real life does make demands on me.

I'm willing to troubleshoot but don't know where to look. I googled
rundll.32 and get a lot of answers, many of which I don't think apply. I
looked at the articles you referenced and will try to step through them.

How would I know if ZA is causing a problem? I'm using V6.1.744.001.
This is an update since I reformatted, but I did have this problem
before, at random intervals. ZA is not set for constant logging.

One thing I think might set off the rundll-shutdown problem are web
applications. I was opening a PDF file or doing something the last time
rundll hung the computer. I'll be watching carefully to try to figure
out what exactly they could be.

One interesting thing you said is asking whether system restore
checkpoints are being created. The answer is ... sometimes ... and I
don't know what turns it on or off.

I set system restore points before I installed Office and Word. I wasn't
happy with a certain setting and tried to roll the installation back.
System restore was not able to roll back. Apparently if you install
Office ... it's yours.

Thanks for the ideas. If any of this information will help you point me
to clues, I'd appreciate it.

Mike
Wed Oct 04 05:01:09 CDT 2006

Betsy,

No need for any apologies, we all have lives to lead and that and families
must always come first.

I'll keep a look out for further updates and clues that you might post.
If you are using Acrobat Reader to access your PDF files then this is
quite possibly not exiting correctly when you close it and is likely to be
still running when you shutdown so could perhaps be a cause of shutdown
problems but this shouldn't involve rundll32.exe. What would be useful is
knowing which applications you use that cause rundll32.exe to be launched.

System Restore.
For some users recent versions of Zone Alarm have inhibited the creation
of automatic system restore checkpoints although the user still has the
ability to create manual checkpoints. The reason being I believe that Win
Me's state manager doesn't seem to detect any idle time which is when the
state manager creates automatic checkpoints and carries out maintenance of
the _RESTORE archive which includes "cabbing" to FS*.cab files those files
in the _RESTORE\TEMP folder which are needed for a restore (which it then
locates in the _RESTORE\ARCHIVE folder) and discarding those not required
for a restore.

I'd suggest you keep an eye on the _RESTORE\TEMP folder for the next few
days and report back if it grows in size and you see no FS*.cab files
appearing in the _RESTORE\ARCHIVE folder.

You should have been able to roll back your system using system restore
after installing Office unless you have the minimum 200MB allocated to the
restore archive. The reason being that installing Office causes around
300MB of files to be archived and if the archive is too small the earlier
checkpoint will be deleted as not all of the archived files would be
available for the roll back.

Note that any problems with system restore are likely to be unrelated to
your rundll32 and shutdown problems.
--
Mike Maltby
mike.maltby@gmail.com


Betsy Garfield <betsy@nowh.ere> wrote:

> Ok. Sorry to take so long to get back but real life does make demands
> on me.
> I'm willing to troubleshoot but don't know where to look. I googled
> rundll.32 and get a lot of answers, many of which I don't think
> apply. I looked at the articles you referenced and will try to step
> through them.
> How would I know if ZA is causing a problem? I'm using V6.1.744.001.
> This is an update since I reformatted, but I did have this problem
> before, at random intervals. ZA is not set for constant logging.
>
> One thing I think might set off the rundll-shutdown problem are web
> applications. I was opening a PDF file or doing something the last
> time rundll hung the computer. I'll be watching carefully to try to
> figure out what exactly they could be.
>
> One interesting thing you said is asking whether system restore
> checkpoints are being created. The answer is ... sometimes ... and I
> don't know what turns it on or off.
>
> I set system restore points before I installed Office and Word. I
> wasn't happy with a certain setting and tried to roll the
> installation back. System restore was not able to roll back.
> Apparently if you install Office ... it's yours.
>
> Thanks for the ideas. If any of this information will help you point
> me to clues, I'd appreciate it.

Betsy
Wed Oct 04 09:45:02 CDT 2006

Mike M wrote:
> Betsy,
>
> No need for any apologies, we all have lives to lead and that and
> families must always come first.
>
> I'll keep a look out for further updates and clues that you might post.
> If you are using Acrobat Reader to access your PDF files then this is
> quite possibly not exiting correctly when you close it and is likely to
> be still running when you shutdown so could perhaps be a cause of
> shutdown problems but this shouldn't involve rundll32.exe. What would
> be useful is knowing which applications you use that cause rundll32.exe
> to be launched.
>
> System Restore.
> For some users recent versions of Zone Alarm have inhibited the creation
> of automatic system restore checkpoints although the user still has the
> ability to create manual checkpoints. The reason being I believe that
> Win Me's state manager doesn't seem to detect any idle time which is
> when the state manager creates automatic checkpoints and carries out
> maintenance of the _RESTORE archive which includes "cabbing" to FS*.cab
> files those files in the _RESTORE\TEMP folder which are needed for a
> restore (which it then locates in the _RESTORE\ARCHIVE folder) and
> discarding those not required for a restore.
>
> I'd suggest you keep an eye on the _RESTORE\TEMP folder for the next few
> days and report back if it grows in size and you see no FS*.cab files
> appearing in the _RESTORE\ARCHIVE folder.
>
> You should have been able to roll back your system using system restore
> after installing Office unless you have the minimum 200MB allocated to
> the restore archive. The reason being that installing Office causes
> around 300MB of files to be archived and if the archive is too small the
> earlier checkpoint will be deleted as not all of the archived files
> would be available for the roll back.
>
> Note that any problems with system restore are likely to be unrelated to
> your rundll32 and shutdown problems.

Hmm. I found C:\WINDOWS\SYSTEM\RESTORE and don't seem to have \temp or
\archive. I have DataStor.ini that was created 10/3 but all the other
files are dated 2000. Right now, I have 2 restore points that I created
myself in the past 2 days.

I didn't know computer needs to rest to create restore. I tried to run a
thorough scandisk last night and things kept changing; I forgot to shut
down all my running processes first. But even if restore needs to rest,
SOMETIMES it creates restore points for days and days, sometimes it
doesn't. So that doesn't make sense to me.

When I installed Office I had the full size of restore available. I have
since trimmed it back to about 500 mb.

I do use Adobe Reader of course to view PDF files. And of course it's
v6. I'll keep an eye on TaskManager to see when rundll shows up.

Thanks.

Mike
Wed Oct 04 10:37:57 CDT 2006

> Hmm. I found C:\WINDOWS\SYSTEM\RESTORE and don't seem to have \temp or
> \archive.

Which could be why I said _RESTORE\TEMP and _RESTORE\ARCHIVE and should
have said C:\_RESTORE\TEMP and C:|_RESTORE\ARCHIVE. To see these and the
three other folders under C:\_RESTORE you need to enable the viewing of
hidden files and folders at Tools | Folder Options | View in Windows
Explorer or Folder Options | View in the Control Panel.

System Restore by default is set to create an automatic checkpoint roughly
every 10 hours of "up time", that is time measured whilst the PC is
running, subject to the system not being heavily loaded at the time.

> I do use Adobe Reader of course to view PDF files

Well there's no "of course" about using Adobe Reader. <g> You could be
using Foxit or one of the other PDF readers that are available.

Returning to system restore
If you were unable to restore your system to prior to the Office install
and had more than 500MB allocated to the store then it would appear that
system restore is or was broken. This could be for as simple a reason as
the 290700 patch not being installed.

It might now be a good time to test that system restore is working
correctly. You can do this by performing the following quick test.
a) Create a shortcut on your desktop to a file (any file will do).
b) Create a manual checkpoint
Could you create a checkpoint?
c) Delete the shortcut you made at a)
d) Restore your PC to the checkpoint you created.at b)
Was the shortcut restored? Did you see any error messages?
e) Reboot your PC
Was the checkpoint retained?

If the test fails please post back the full text of any and all error
messages seen and we can try taking it forward from there.
--
Mike Maltby
mike.maltby@gmail.com


Betsy <betsy@nowh.ere> wrote:

> Hmm. I found C:\WINDOWS\SYSTEM\RESTORE and don't seem to have \temp or
> \archive. I have DataStor.ini that was created 10/3 but all the other
> files are dated 2000. Right now, I have 2 restore points that I
> created myself in the past 2 days.
>
> I didn't know computer needs to rest to create restore. I tried to
> run a thorough scandisk last night and things kept changing; I forgot
> to shut down all my running processes first. But even if restore
> needs to rest, SOMETIMES it creates restore points for days and days,
> sometimes it doesn't. So that doesn't make sense to me.
>
> When I installed Office I had the full size of restore available. I
> have since trimmed it back to about 500 mb.
>
> I do use Adobe Reader of course to view PDF files. And of course it's
> v6. I'll keep an eye on TaskManager to see when rundll shows up.
>
> Thanks.

Betsy
Thu Oct 05 20:26:23 CDT 2006

Mike M wrote:
... <snip>
>
> System Restore by default is set to create an automatic checkpoint
> roughly every 10 hours of "up time", that is time measured whilst the PC
> is running, subject to the system not being heavily loaded at the time.
>
... <snip>
>
> It might now be a good time to test that system restore is working
> correctly. You can do this by performing the following quick test.
> a) Create a shortcut on your desktop to a file (any file will do).
> b) Create a manual checkpoint
> Could you create a checkpoint?
> c) Delete the shortcut you made at a)
> d) Restore your PC to the checkpoint you created.at b)
> Was the shortcut restored? Did you see any error messages?
> e) Reboot your PC
> Was the checkpoint retained?
>

Did steps a through e exactly and passed the test. No error messages.
Yes, the checkpoint is still there.

Mike
Fri Oct 06 02:33:55 CDT 2006

Betsy <betsy@nowh.ere> wrote:

> Did steps a through e exactly and passed the test. No error messages.
> Yes, the checkpoint is still there.

Good that means you should be able to use system restore if you hit a
problem in future. Keep an eye on it to see if it is making regular
checkpoints and if in doubt create a manual checkpoint before making any
major changes so that you have a "known good" to return to if you have a
problem.

All we need to do now is establish the cause of your problems with
rundll32.
--
Mike Maltby
mike.maltby@gmail.com

Betsy
Sat Oct 07 01:15:03 CDT 2006

Mike M wrote:
> Betsy <betsy@nowh.ere> wrote:
>
>> Did steps a through e exactly and passed the test. No error messages.
>> Yes, the checkpoint is still there.
>
> Good that means you should be able to use system restore if you hit a
> problem in future. Keep an eye on it to see if it is making regular
> checkpoints and if in doubt create a manual checkpoint before making any
> major changes so that you have a "known good" to return to if you have a
> problem.
>
> All we need to do now is establish the cause of your problems with
> rundll32.

Yes, I always make a restore before adding software etc. just in case.
That's why I was surprised I couldn't reverse the Office-Word
installations. But ... that's ok. I can live without the fonts for now.

Did I rant yet about the Internet Explorer update that set itself as my
default browser without asking?

No rundll32 issues yet. Will report if/when.

Thanks.

Mike
Sat Oct 07 03:04:36 CDT 2006

> Did I rant yet about the Internet Explorer update that set itself as
> my default browser without asking?

Just wait until you start installing some of the patches for MS Office.
Especially if you have Outlook installed but don't use it as your primary
mail client. <g>
--
Mike Maltby
mike.maltby@gmail.com


Betsy <betsy@nowh.ere> wrote:

> Mike M wrote:
> Yes, I always make a restore before adding software etc. just in case.
> That's why I was surprised I couldn't reverse the Office-Word
> installations. But ... that's ok. I can live without the fonts for
> now.
> Did I rant yet about the Internet Explorer update that set itself as
> my default browser without asking?
>
> No rundll32 issues yet. Will report if/when.
>
> Thanks.

Betsy
Sat Oct 07 08:50:36 CDT 2006

Mike M wrote:
>> Did I rant yet about the Internet Explorer update that set itself as
>> my default browser without asking?
>
> Just wait until you start installing some of the patches for MS Office.
> Especially if you have Outlook installed but don't use it as your
> primary mail client. <g>

Well, I took ALL the updates Microsoft offered me at the download center
(about 40 of 'em, I think) in one go. After all, I was catching up on 5
years worth of updates. Lucky there wasn't more damage. M$ft did add
some items to the startup list and my computer slowed down *immediately*
and *noticeably* but I knew what to do :-)

Mike
Sat Oct 07 08:59:42 CDT 2006

Betsy <betsy@nowh.ere> wrote:

> Well, I took ALL the updates Microsoft offered me at the download
> center (about 40 of 'em, I think) in one go. After all, I was
> catching up on 5 years worth of updates. Lucky there wasn't more
> damage. M$ft did add some items to the startup list and my computer
> slowed down *immediately* and *noticeably* but I knew what to do :-)

Download Centre or Windows Update site? If the former be careful since
some of those patches have prerequisites. It is usually safer to use the
Windows Update site although, with Win Me, some products are not supported
at WU (such as MS Office) so require a separate visit to get the required
patches. This has changed somewhat for XP where the Microsoft Update site
includes not only system patches but also patches for some other products
including, Office, Exchange and SQL.
--
Mike Maltby
mike.maltby@gmail.com

Betsy
Sat Oct 07 21:04:02 CDT 2006

Mike M wrote:
> Betsy <betsy@nowh.ere> wrote:
>
>> Well, I took ALL the updates Microsoft offered me at the download
>> center (about 40 of 'em, I think) in one go. After all, I was
>> catching up on 5 years worth of updates. Lucky there wasn't more
>> damage. M$ft did add some items to the startup list and my computer
>> slowed down *immediately* and *noticeably* but I knew what to do :-)
>
> Download Centre or Windows Update site? If the former be careful since
> some of those patches have prerequisites. It is usually safer to use
> the Windows Update site although, with Win Me, some products are not
> supported at WU (such as MS Office) so require a separate visit to get
> the required patches. This has changed somewhat for XP where the
> Microsoft Update site includes not only system patches but also patches
> for some other products including, Office, Exchange and SQL.

Downloaded from the WU site (sorry - should have clarified) but didn't
know I need to go separately for Office. Should I go get the Office
downloads (still running Office 97) ? Thanks.

Mike
Sun Oct 08 03:03:47 CDT 2006

Betsy <betsy@nowh.ere> wrote:

> Downloaded from the WU site (sorry - should have clarified) but didn't
> know I need to go separately for Office. Should I go get the Office
> downloads (still running Office 97) ? Thanks.

Yes, you will have to update/patch Office by visiting the Office site.
See http://office.microsoft.com/en-us/officeupdate/CD010224961033.aspx for
what is available for Office 97 including Service Pack/Release 2b. I
don't think however that you will find that any recent updates or patches
have been released.
--
Mike Maltby
mike.maltby@gmail.com