6 Replies Latest reply on Sep 6, 2012 6:44 PM by Hayton

    RunDLL Window/Message

      Recently McAfee stopped some software from infecting my computer.  However since then whenever I turn on my computer, windows title "RunDLL" open up stating "There was a problem starting....." .  Apparently the computer is looking for the virus which McAfee blocked.  How do I stop these windows form appearing.

        • 1. Re: RunDLL Window/Message
          JaiPrakash

          Hi alan789,

           

          To have a clear picture of your issue, kindly take a Screen shot at the stage when the RUNDLL error appears.

           

          (To take a screen shot:  Push the “Prt Scr” (Print screen) button once on the top right of your key board > open Ms Paint > go to edit on the top and select paste > save the file and attach to the post)

          • 2. Re: RunDLL Window/Message

            I've inserted images of all three windows:

            RunDLL B.jpg

            RunDLL A.jpgRunDLL C.jpg

            • 3. Re: RunDLL Window/Message
              Hayton

              The file in the first of those screenshots sounds familiar but I can't find where I saw it before. No matter : the second one gives the game away. "er_00_0_l.exe" is a file associated with the current round of "Police Trojan" ransomware attacks. So McAfee has blocked the Trojan, but missed whatever is trying to start the malware running.

               

              Someone else had exactly this problem and asked about it on the Microsoft Windows 7 forums. If you haven't got Windows 7 some of the directory paths might be a bit different but you'll find how to remove these pop-ups in the answers to the question there.

               

              See the thread at Microsoft Answers HERE

               

              The file was also noted on SystemExplorer.net -

              http://systemexplorer.net/file-database/file/er_00_0_l-exe

               

              Message was edited by: Hayton on 06/09/12 02:04:32 IST
              • 4. Re: RunDLL Window/Message
                JaiPrakash

                Hi alan789,

                 

                From your screen shots I can see those files were not present on your PC. These files are getting loaded only during the windows startup.

                So, kindly use the MSCONFIG Startup Utility as shown and disable these files (tuiapi.dll, er_00_0_l.exe, pcetmi.dll) by deselecting them and select OK.

                (MSCONFIG Startup Utility it allows you to quickly disable and prevent an application from starting when Windows starts. This is the tab that used to isolate potentially problematic startup programs, or to quickly streamline a system by removing unneeded applications from running.)

                 

                Windows ORB.bmp

                MSCONFIG.bmp

                 

                Message was edited by: JaiPrakash on 6/9/12 3:05:12 AM CDT
                • 5. Re: RunDLL Window/Message

                  Using MSCONFIG I was able to get rid of the two of the RUNDLL windows.  However the window for er_00_0_I.exe still appears.  The files for the other two windows were listed, but er_00_I.exe was not.

                  Alan

                  • 6. Re: RunDLL Window/Message
                    Hayton

                    Autoruns will help you. See the discussion on Microsoft Answers (link is in my previous reply).