RUNDLL Error Message on Boot-Up

[Guest]

I think my children inadvertently downloaded on my PC a file that changed my internet home page in IE 6.0 among other things

I would start IE 6.0 and there was a home page that was actually a DLL on my harddrive. I looked at the DLL in Wordpad and it was nothing more than some HTML and XML code that created a webpage. Oddly enough, when I found the DLL on the harddrive, I woul
delete the file, named MSHP.DLL
change my home page
and restart the computer
When I restarted the computer, I found that the same DLL file had been created again and changed my internet home page back to the DLL
I went looking for unknown applications that were installed and found some type of Cursor application and an application for a Web Navigation toolbar. I uninstalled both applications, deleted the MSHP.DLL file again, reset my home page, and restarted the computer
Finally, I hit something because the DLL was no longer my default web homepage. However, now I have an error message box pop-up every time I boot. The error message is: RUNDLL. RUNDLL cannot find Image.DLL
It seems that there is still some portion of an application on my PC that is starting the RUNDLL application upon boot-up and trying to register some components

Any ideas as to how I can stop RUNDLL from trying to register this Image.DLL everytime I start the PC?

 

[Guest]

-----Original Message-----
I think my children inadvertently downloaded on my PC a

file that changed my internet home page in IE 6.0 among
other things.

I would start IE 6.0 and there was a home page that was

actually a DLL on my harddrive. I looked at the DLL in
Wordpad and it was nothing more than some HTML and XML
code that created a webpage. Oddly enough, when I found
the DLL on the harddrive, I would

delete the file, named MSHP.DLL,
change my home page,
and restart the computer.
When I restarted the computer, I found that the same DLL

file had been created again and changed my internet home
page back to the DLL.

I went looking for unknown applications that were

installed and found some type of Cursor application and
an application for a Web Navigation toolbar. I
uninstalled both applications, deleted the MSHP.DLL file
again, reset my home page, and restarted the computer.

Finally, I hit something because the DLL was no longer

my default web homepage. However, now I have an error
message box pop-up every time I boot. The error message
is: RUNDLL. RUNDLL cannot find Image.DLL.

It seems that there is still some portion of an

application on my PC that is starting the RUNDLL
application upon boot-up and trying to register some
components.

Any ideas as to how I can stop RUNDLL from trying to

register this Image.DLL everytime I start the PC?

.
The problem is now in your registry. The registry tells

the OS that a particular file is needed and where to go
but it isn't there. Unless you're an advanced user, then
I would suggest Spybot Search & Destroy to help you out.
It's a FABULOUS program for getting rid of page hijackers
worms and all those other nasties. It will find your
problem and clear it up. Also, your virus scan (you do
have on, right?)and if it finds anything than you will
probably have to turn off your system restore, rescan
then turn back on sys restore. The reason for turning it
off is that NOTHING can get into and alter/delete those
files. If you have something nasty on the computer, than
it's more than likely been put into a restore point which
is bad of coarse. Use the Spybot then see what it says
and go from there. Good luck.

 

[roger]

Hi David,

I think my children inadvertently downloaded on my PC a file that changed my internet home page in IE 6.0 among other things.

[...]

Parasite fighting list of resources
http://www.aumha.org/a/parasite.htm

Download the utility CWshredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Unzip - close *all* instances of IE & OE, hit the executable and
follow
the prompts.

You can also download Hijack This from here:

http://www.mjc1.com/files/merijn/hijackthis.exe

Go here:
http://mjc1.com/mirror/hjt/

For instructions on how to use it; you have to post the log it
produces so experts tell you what is good and what is malware


Try downloading, installing and updating the
spyware removers from the links below. Run both of them.

Ad-aware
http://www.lavasoftusa.com/support/download/

Spybot S&D
http://www.safer-networking.org/index.php?lang=en&page=download


If these don't correct the problem, then get yourself a copy of
BHODemon, available at
http://www.definitivesolutions.com/bhodemon.htm .

It does not need installing - simply unzip and run the EXE program. It
is easy to use. It will find the hijackware DLL files, and give you
the ability to disable them.

Hope this helps.

 

[Guest]

Hi

I've run into just about exactly the same problem that David Hambright mentions here. My computer got hit by a web-hijacker, and using Ad-aware as well as Spybot Search and Destroy, I was able to clean up the problem. However, the same as with David, my computer now expects RUNDLL to be able to find Image.dll upon booting up the machine. As best as I can tell, it causes no real harm, but it is aggravating to get that pop-up error window each time I turn on my computer. I did attempt to deal with the probable registry problem using Spybot S&D, but I had no luck there. I also tried BHODemon as suggested by Roger, but again, no change

Presumably what is needed is to tell RUNDLL that it doesn't need to look for Image.dll, but my software knowledge is lacking in this area, so I have no clue how to go about that. I would greatly appreciate it if anyone could provide me with information as to how to go about fixing this

Thanks

----- (e-mail address removed) wrote: ----

-----Original Message----
I think my children inadvertently downloaded on my PC a

file that changed my internet home page in IE 6.0 among
other thingsactually a DLL on my harddrive. I looked at the DLL in
Wordpad and it was nothing more than some HTML and XML
code that created a webpage. Oddly enough, when I found
the DLL on the harddrive, I woul

delete the file, named MSHP.DLL
change my home page
and restart the computer
When I restarted the computer, I found that the same DLL

file had been created again and changed my internet home
page back to the DLL

I went looking for unknown applications that were

installed and found some type of Cursor application and
an application for a Web Navigation toolbar. I
uninstalled both applications, deleted the MSHP.DLL file
again, reset my home page, and restarted the computer

Finally, I hit something because the DLL was no longer

my default web homepage. However, now I have an error
message box pop-up every time I boot. The error message
is: RUNDLL. RUNDLL cannot find Image.DLL

It seems that there is still some portion of an

application on my PC that is starting the RUNDLL
application upon boot-up and trying to register some
componentsregister this Image.DLL everytime I start the PC

The problem is now in your registry. The registry tells

the OS that a particular file is needed and where to go
but it isn't there. Unless you're an advanced user, then
I would suggest Spybot Search & Destroy to help you out.
It's a FABULOUS program for getting rid of page hijackers
worms and all those other nasties. It will find your
problem and clear it up. Also, your virus scan (you do
have on, right?)and if it finds anything than you will
probably have to turn off your system restore, rescan
then turn back on sys restore. The reason for turning it
off is that NOTHING can get into and alter/delete those
files. If you have something nasty on the computer, than
it's more than likely been put into a restore point which
is bad of coarse. Use the Spybot then see what it says
and go from there. Good luck

 

[roger]

Hi a1962,

Hi,

I've run into just about exactly the same problem that David Hambright mentions here. My computer got hit by a web-hijacker, and using Ad-aware as well as Spybot Search and Destroy, I was able to clean up the problem. However, the same as with David, my computer now expects RUNDLL to be able to find Image.dll upon booting up the machine. As best as I can tell, it causes no real harm, but it is aggravating to get that pop-up error window each time I turn on my computer. I did attempt to deal with the probable registry problem using Spybot S&D, but I had no luck there. I also tried BHODemon as suggested by Roger, but again, no change.

Presumably what is needed is to tell RUNDLL that it doesn't need to look for Image.dll, but my software knowledge is lacking in this area, so I have no clue how to go about that. I would greatly appreciate it if anyone could provide me with information as to how to go about fixing this.

Thanks!

(Courtesy of Dee)

"You can do the following:

Click start and then run.
Type regedit
Go to:
HKEY_Local_Machine\Software\Microsoft\Windos\CurrentVersion|Run
On the right you'll find
image REG_SZ rundll32 c:\Windows\image.dll,install
delete image.dll,install

and while still in the registry editor:
Go to:
HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\policies\explorer\run

On the right you'll find:
image REG_SZ rundll32 c:\Windows\image.dll,install
delete image.dll,install

Plus...collapse everything to the left of the registry editor until
only My
Computer with the + sign in front of it shows:
At the top, click Edit and then Find.
Where you see Find What, type in:
image.dll
Click Find Next.
You'll see a window that says "Searching the Registry".
This will stop on each instance of image.dll when found. Just right
click and delete.
Hit F3 on the keyboard to continue searching the rest of the registry
and delete all of the image.dll references it comes up with.
(delete next instance, hit F3 again, etc...to continue searching and
finding - then deleting)
When finished...you'll see the message, Finished Searching the
Registry. Close it out.
IMPORTANT: Be sure to create a restore point before you go editing in
the registry."

Good luck