{"id":3264,"date":"2016-06-14T15:06:02","date_gmt":"2016-06-14T09:36:02","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=3264"},"modified":"2023-01-26T15:22:20","modified_gmt":"2023-01-26T09:52:20","slug":"rundll-error-startup-dll-module-not-found","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/rundll-error-startup-dll-module-not-found\/","title":{"rendered":"How to Fix Rundll32 or RunDll Errors Appearing at Startup"},"content":{"rendered":"

When you log in to your computer, an error message window with RunDll in the title may appear, mentioning a DLL file name such as the following:<\/p>\n

There was a problem starting C:\\Users\\desktop\\AppData\\Local\\Microsoft\\Protect\\protecthost.dll\r\n\r\nThe specified module could not be found.<\/pre>\n
\"rundll<\/p>\n
Cause<\/h2>\n
Though the DLL name and the folder path may appear legit in some cases, it’s not really so. Some malware seems to have dropped the DLL file there and added a startup entry so that the DLL is executed at every startup.<\/p>\n
The message “The specified module could not be found.”<\/em> usually denotes that your antivirus program has already quarantined or deleted the malware file. Now, all you need to do is remove its startup entry or scheduled task, where ever it’s loading from.<\/p>\n
Resolution<\/h2>\n
The RunDLL or RunDLL32 entry may be coming from the startup folder, “Run” registry location, or scheduled tasks. The scheduled task may be configured to run at startup or triggered to run at specific intervals. Task Manager lists startup entries only from the RunOnce\/Run keys and Startup folder, but there are several other startup launch points. It’s better to use Autoruns<\/a> to manage startup programs and scheduled tasks.<\/p>\n
    \n
  1. Download Autoruns<\/a> from Microsoft.<\/li>\n
  2. Run Autoruns as administrator.<\/li>\n
  3. Wait for the entries to populate in Autoruns.<\/li>\n
  4. In Autoruns, uncheck “Hide Microsoft Entries” and “Hide Windows Entries” from the Options menu.<\/li>\n
  5. Select the “Everything” tab.<\/li>\n
  6. In the Quick Filter box, search for the string rundll32<\/code>.
    \n\"autoruns
    \nYou may find the offending entry under the Run registry location, as in the following image:<\/p>\n
    \"rundll
    Case 1: RunDll32.exe loading as a startup item<\/figcaption><\/figure>\n
    However<\/strong>, these days, viruses use Task Scheduler (instead of the Run registry keys) to launch the rundll32.exe<\/code> command-line. Here’s an example where the offending rundll32.exe<\/code> command was listed under “Task Scheduler.”<\/p>\n
    \"autoruns
    Case 2: RunDll32.exe loading as a scheduled task.<\/figcaption><\/figure><\/li>\n
  7. Right-click on the offending item and choose Delete.<\/li>\n<\/ol>\n
    \n
    Additional Information<\/h3>\n
    Use Task Manager to disable the startup entry<\/h4>\n
    If rundll32.exe is loading from the registry Run keys or the startup folder, you can disable it using Task Manager.<\/p>\n
      \n
    1. Open Task Manager, and click the Startup tab.<\/li>\n
    2. Enable the Command line column<\/a> by right-clicking the column header and enabling “Command line” check box. This shows the full command-line<\/a> for each startup item listed.<\/li>\n
    3. To stop the RunDLL error message from appearing at startup, right-click the appropriate (rundll32) entry in the list and click Disable.
      \n\"rundll<\/li>\n<\/ol>\n
      However, the Autoruns method is recommended<\/strong> as it can delete the entry instead of just disabling it, as Autoruns covers many other startup launch points.<\/p>\n
      \n
      What is Rundll32.exe?<\/h4>\n
      Rundll32.exe is a legitimate Windows file<\/a> that can load a DLL and run a specified entry-point function inside the DLL file. The problem is not rundll32.exe but the rogue DLL file, which was dropped by Malware. You can look it up on the web to learn more about a module. In some cases, the module names and folder locations contain random characters and numbers, as is the case of most startup entries and scheduled tasks added by Malware.<\/p>\n
      After removing the entries, follow up with a thorough scan using your anti-virus program and Malwarebytes Antimalware.<\/p>\n","protected":false},"excerpt":{"rendered":"
      When you log in to your computer, an error message window with RunDll in the title may appear, mentioning a DLL file name such as the following:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,7],"tags":[56,191],"class_list":["post-3264","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows","tag-autoruns","tag-error-messages"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":25816,"url":"https:\/\/www.winhelponline.com\/blog\/startupchecklibrary-winscomrssrv-dll-missing-error-startup\/","url_meta":{"origin":3264,"position":0},"title":"[Fix] StartupCheckLibrary.dll and Winscomrssrv.dll Error at Startup","author":"Ramesh","date":"January 20, 2022","format":false,"excerpt":"When you log in to your Windows computer, the following error message windows may pop up: RunDLL There was a problem starting StartupCheckLibrary.dll The specified module could not be found. RunDLL There was a problem starting winscomrssrv.dll The specified module could not be found. Additionally, you may see the following\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"startupchecklibrary.dll malware startup error","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":8852,"url":"https:\/\/www.winhelponline.com\/blog\/what-is-rundll32-exe-is-it-malware\/","url_meta":{"origin":3264,"position":1},"title":"What is Rundll32.exe process? Is it a Malware?","author":"Ramesh","date":"April 25, 2019","format":false,"excerpt":"When you open Task Manager, you may see Rundll32.exe entry in the Processes tab. Or, you may also encounter a rundll32.exe error at every startup or during shutdown. Many users are wondering if rundll32.exe is a virus. If not, what exactly does rundll32.exe do in the system? What is rundll32.exe?\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"rundll32 modules list tasklist","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/rundll32-modules.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/rundll32-modules.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/rundll32-modules.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":10136,"url":"https:\/\/www.winhelponline.com\/blog\/fix-logilda-dll-error-at-startup-in-windows-10\/","url_meta":{"origin":3264,"position":2},"title":"Fix: LogiLDA.dll Error at Startup","author":"Ramesh","date":"July 3, 2019","format":false,"excerpt":"After upgrading to Windows 10, you may see one of the following errors when logging in to your user account: There was a problem starting C:\\Windows\\System32\\LogiLDA.dll The specified module could not be found Error in C:\\WINDOWS\\SYSTEM32\\LOGILDA.DLL - Missing entry: LOGIFETCH There was a problem starting C:\\Windows\\System32\\LogiLDA.dll. C:\\Windows\\System32\\LogiLDA.dll is not a\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"logitech download assistant LogiLDA.dll error at startup - autoruns","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/logitech-download-assistant-autoruns.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/logitech-download-assistant-autoruns.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/logitech-download-assistant-autoruns.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/logitech-download-assistant-autoruns.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3465,"url":"https:\/\/www.winhelponline.com\/blog\/error-cannot-find-script-file-programdata-folder\/","url_meta":{"origin":3264,"position":3},"title":"[Fix] Error “Cannot find Script file” in C:\\ProgramData Folder","author":"Ramesh","date":"July 10, 2016","format":false,"excerpt":"When you log in to your computer, the following error or a similar one may appear every time. Can not find script file C:\\ProgramData\\{793391F4-29B5-4072-9833-30F048B1E37E}\\1.9.3.1\\rolo.txt This entry was added by malware, where the {GUID} string and the script file names are random and vary for each system. In the aftermath of\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1284,"url":"https:\/\/www.winhelponline.com\/blog\/explorer-exe-error-yellow-exclamation-startup-windows-8\/","url_meta":{"origin":3264,"position":4},"title":"Fix Explorer.exe Error with Yellow Exclamation at Startup","author":"Ramesh","date":"December 4, 2013","format":false,"excerpt":"When you log on to your user account in Windows 8 or 10, Explorer.exe error message with yellow exclamation may appear, containing no message text. This may occur mainly in the aftermath of removing malware from the system. Fix: Explorer.exe Error with Yellow Exclamation To fix the Explorer.exe error at\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived2\/w8-explorer-excl-2.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":10607,"url":"https:\/\/www.winhelponline.com\/blog\/find-out-if-a-program-exe-file-is-32-bit-or-64-bit\/","url_meta":{"origin":3264,"position":5},"title":"How to Check if a Program (.EXE or .DLL) is 32-bit or 64-bit","author":"Ramesh","date":"August 4, 2019","format":false,"excerpt":"Software developers compile separate executable files (.EXE or .DLL) for 32-bit (x86) and 64-bit (x64) systems.\u00a0The 64-bit version of the program is usually denoted by suffixing 64 or x64 with the filename -- e.g., sigcheck.exe vs. sigcheck64.exe. In some cases, the bitness notation may be missing, and you may be\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"exe or dll - compatibility tab - bitness check","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/08\/find-32-bit-or-64-bit-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/3264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=3264"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/3264\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=3264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=3264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=3264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}