Question

Q: "Windows RunDLL32.exe version : 6.0.6000.16385 - "Windows host process (RunDLL32.exe) has stopped working" This thread is locked from future replies

I am running Windows 7 Home Premium 64bit  with all fixes up to date on an Acer 1830T laptop.

I am getting the error "Windows RunDLL32.exe version : 6.0.6000.16385 - "Windows host process (RunDLL32.exe) has stopped working" immediately after the login to Windows.

I found an old question about a similar error in this forum:

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/windows-rundll32exe-version-60600016386-windows/7c28716a-be33-4b7b-bfa2-5c79abeafdb6

with some instructions how to collect some info that can help figuring out the problem and I followed them. Here it is--can anybody, please, figure out what's going on?

Thanks.


1. The Windows error message gives the following details:
=================================================
Problem signature:
  Problem Event Name:    APPCRASH
  Application Name:    rundll32.exe
  Application Version:    6.1.7600.16385
  Application Timestamp:    4a5bc637
  Fault Module Name:    VERSION.dll
  Fault Module Version:    6.1.7600.16385
  Fault Module Timestamp:    4a5bdb2b
  Exception Code:    c0000005
  Exception Offset:    000015da
  OS Version:    6.1.7601.2.1.0.768.3
  Locale ID:    1033
  Additional Information 1:    0a9e
  Additional Information 2:    0a9e372d3b4ad19135b953a78882e789
  Additional Information 3:    0a9e
  Additional Information 4:    0a9e372d3b4ad19135b953a78882e789

2. Event log
==============================
10562    Application    Error    5/24/2013 10:32:32 PM    Application Error    100    1000        1830T    0    540    Faulting application name: rundll32.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc637  Faulting module name: VERSION.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb2b  Exception code: 0xc0000005  Fault offset: 0x000015da  Faulting process id: 0xbec  Faulting application start time: 0x01ce590929bd1d7b  Faulting application path: C:\Windows\SysWOW64\rundll32.exe  Faulting module path: C:\Windows\SysWOW64\VERSION.dll  Report Id: 7f2068c9-c4fc-11e2-8d2d-206a8a3eedc5  

3.  ProcessExplorer
=====================================
 networx.exe    0.21    18,464 K    27,840 K    2860    NetWorx Application (64-bit)    SoftPerfect Research
 rundll32.exe        3,128 K    5,536 K    2676    Windows host process (Rundll32)    Microsoft Corporation
  rundll32.exe    0.01    7,988 K    12,532 K    624    Windows host process (Rundll32)    Microsoft Corporation

4. Hovering the mouse over the two rundll32.exe lines I got the following:
======================================================
Command Line:
 "C:\Windows\system32\rundll32.exe" "C:\Users\Fabian\AppData\Roaming\ntashs.dll".AsDecodedString
Path:
 c:\Windows\system32\rundll32.exe
Rundll Target:
 USB Smart Card
 Axacalto

Command Line:
 "C:\Windows\system32\rundll32.exe" "C:\Users\Fabian\AppData\Roaming\ntashs.dll".AsDecodedString
Path:
 c:\Windows\sysWOW64\rundll32.exe
Rundll Target:
 USB Smart Card
 Axacalto

5. I Googled Axacalto and found:
===========================
Axalto has been a smart card manufacturer, that during its brief independent existence, with over 4,500 employees in 60 countries, was one of the world's leading providers of microprocessor cards (Gartner, 2005) and also a major supplier of point of sale terminals.

6. The two files referred to are:
===========================
C:\Users\Fabian\AppData\Roaming\ntashs.dll"
File descr:  USB Smart Card
Type: Appl. Extension
Version: 3.0.6.0
Company: Axacalto
Language: English US
Original file name: Vins.DLL

C:\Users\Fabian\AppData\Roaming\wsder.dll"
File descr:  Compatible SupeVGA
Type: Appl. Extension
Version: 6.14.10.1140
Company: Technology Inc.
Language: Chinese Taiwan
Original file name: VGA.DLL



* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Hi,

 

Let us work together to resolve this issue.

 

Please answer these questions, so that we can diagnose the issue, correctly:

 

1.     When does the error message appear?

2.     Did you make any changes to the computer prior to this issue?

 

I would like to inform you that .dll (Dynamic Link Library) files are present in every application folder, and are used to store common pieces of application logic that can be accessed from multiple applications.

Since there’s no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality stored in shared .dll files.

 

Here’s what you can try:

 

Method 1: Perform Clean Boot and check if the error message occurs.

 

To help troubleshoot error messages and other issues, you can start Windows by using a minimal set of drivers and startup programs. This kind of startup is known as a "clean boot." A clean boot helps eliminate software conflictsHere is the link for your reference to perform clean boot.

http://support.microsoft.com/kb/929135

 

Note: Please go through the section: How to reset the computer to start as usual after troubleshooting with clean boot of the KB article to boot the computer in normal startup after fixing the issue.

 

Method 2: Run SFC /scan.

 

The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions. When the scan is complete, the System File Checker tool indicates whether integrity violations were found. If integrity violations are found, the System File Checker tool lets you fix the integrity violations.

 

Follow these steps to run SFC scan:

 

a.     Click on the Start button and type Command Prompt on the Search Field.

b.     Click/tap on Command Prompt (Admin).

c.      In the elevated command prompt, type sfc /scannow and press Enter.

 

NOTE: This may take a while to finish running.

 

Please let us know the status of the issue.

Regards,

Manasa Sirahatti

Did this solve your problem?

Sorry this didn't help.


Thank you for responding.

As I explained, the error message appears after the desktop appears following login. But the system seems to function normally. But I am uncomfortable, as I dk what this can cause.

Had I made any changes I would have suspected them, but I did not.

I am familiar with clean booting and SFC/Scan -- I will perform them and get back with the results.

Thanks.
FP

Did this solve your problem?

Sorry this didn't help.


I've run some tests and here are the results.

1. I used msconfig to deactivate all the programs loaded at startup. This did not fix the error.

2. I used msconfig to deactivate all the non-Microsoft services that load at startup. This did not fix the error either.

3. I ran the SFC /scan command and saw a command window flashing with some text in it and disappear. It did not look like it executed.

In all instances the error appears after the msconfig opens after startup.

4. I noticed in Task Manager a couple of strange things:

* 4 instances of RUNDLL running: 2 *32 and 2 64.
* 2 instances of IEXPLORE.EXE running -- it should not load at startup; as long as I don't close the error, they cannot be killed.
* After I close the error I can kill the IEXPLORE instances and 2 of 4 RUNDLL also get killed with them.

I will now run several anti-virus and security programs and see if they find anything.

Did this solve your problem?

Sorry this didn't help.


I've ran several security programs and they did not discover any problem.

It looks as if something at startup is loading IExplorer and second instances of DLLRUN and when I kill the error message they unload and the system returns to normal.

What I dk what causes that.

Did this solve your problem?

Sorry this didn't help.


After some more testing and troubleshooting, including the 2 you suggested. I seem to have eliminated the error. However, I the AUTORUNS program exposed a few registry startup issues that I need advice on. Please let me know if I can safely clean clean the registry of the references to those files. See my inline comments.


1.
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
==============================================================================
rdpclip            File not found: rdpclip

2.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
===================================================           
"C:\Windows\System32\rundll32.exe" "C:\Users\Fabian\AppData\Roaming\ntashs.dll",AsDecodedString
ntashs    USB Smart Card    Axacalto

"C:\Windows\System32\rundll32.exe" "C:\Users\Fabian\AppData\Roaming\wsder.dll",SetEncodingAndErrors
wsder    Compatible Super VGA    Technology Inc.    c:\users\fabian\appdata\roaming\wsder.dll

These are application extensions--have no idea where they come from. I don't use any USB smart cards.


3.
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
=========================================================
Internet Explorer File not found: start           
C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

Internet Explorer File not found: start
C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

This file loads two IEXPLORE processes at startup even though IE is closed and they cannot be killed.


4.
Task Scheduler
===============================
\Microsoft\Windows\Media Center\mcupdate_scheduled File not found: C:\Windows\ehome\mcupdate
"%SystemRoot%\ehome\mcupdate" -crl -hms -pscn 15

\Microsoft\Windows\Media Center\StartRecording    File not found: C:\Windows\ehome\ehrec
"%SystemRoot%\ehome\ehrec" /StartRecording

I don't use Media Center.

5.
HKLM\System\CurrentControlSet\Services
=======================================       
RSUSBSTOR File not found: System32\Drivers\RtsUStor.sys
System32\Drivers\RtsUStor.sys

This seems to be an Acer Realtek Smart card driver -- I reinstalled the driver.

Did this solve your problem?

Sorry this didn't help.


Hi,

 

Thanks for the updates.

 

I request you to not delete any of the registry files.

 

Please let us know the exact and complete error message that you receive with the Autorun.

Regards,

Manasa Sirahatti

Did this solve your problem?

Sorry this didn't help.


I've done some cleaning up and the error disappeared. It might have been malware, but I cannot be sure.

BTW, do you have any idea what IE4UINIT.EXE is? That's what executed at startup that was loading several copies of IE even though it was closed. When I deleted it, this issue also went away. But now when I open IE I get about:blank as home page. So it looks as if I must choose between 2-3 IE processes or the blank home page, Yuckh.

Thanks for your help.

Did this solve your problem?

Sorry this didn't help.


Hi,

 

Thanks for the update.

 

We are glad to hear that you were able to resolve this issue.

 

I would like to inform you that IE4UINIT.EXE is a non-essential system process and should not be terminated unless suspected to be causing problems.

 

1.     In which window did you delete IE4UINIT.EXE?

2.     Are you able to change the Home Page of Internet Explorer?

3.     Which are the Internet Explorer processes that you have to choose from?

4.     What do you mean by “was loading several copies of IE”?

 

Please get back to us with more information.

Regards,

Manasa Sirahatti

Did this solve your problem?

Sorry this didn't help.


Ah, yes, so that explains why I get a blank Home page and changing it does not take.

Poor language -- I did not mean copies, but processes.

The reason I deleted it is that when I was starting Windows there were 2-3 IEXPLORE processes in Task Manager without IE open. When I deleted the file, they don't load anymore. I can live with that, I don't need a Home page, I am using IE rarely.

Did this solve your problem?

Sorry this didn't help.


Hi,

 

Thanks for the updates.

 

If you have any other questions regarding Windows operating systems, please feel free to contact us.

Regards,

Manasa Sirahatti

Did this solve your problem?

Sorry this didn't help.


* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
Question Info

Views: 9,915 Last updated: March 15, 2018 Applies to: