On startup, there is a small window on my desktop saying RUNDLL Error loading C\Windows\arelasiwitafabiz.dll.It goes away if I click OK, but always returns on start up. I've downloaded a couple of registry cleaners; that was on advice from other forums, one being registry patrol, but I later read this was a suspect program, so I removed it. In fact there seem to be a lot of suspect programs offering help, so now don't know what to do. Finally what effect does a RUNDLL error have on a computer. Any help please1 person got this answerI do too

Consider scanning your system with e.g. MalwareBytes AntiMalware (the free version).Consider using e.g. Systinternals Autoruns to find all autostarts that reference arelasiwitafabiz, and disable them. Also consider searching your system for the file arelasiwitafabiz.dll, and if found upload it to e.g. virustotal.com to have it checked by a number of antivirus products.

"CorkieMike" wrote in message news:6c3582e4-bdd9-4b0b-a6c5-03c87d2594bd...On startup, there is a small window on my desktop saying RUNDLL Error loading C\Windows\arelasiwitafabiz.dll.It goes away if I click OK, but always returns on start up. I've downloaded a couple of registry cleaners; that was on advice from other forums, one being registry patrol, but I later read this was a suspect program, so I removed it. In fact there seem to be a lot of suspect programs offering help, so now don't know what to do. Finally what effect does a RUNDLL error have on a computer. Any help pleaseDo NOT use Registry Cleaners! - they cause as many problems as they 'solve', and many times the problems caused are such that they are unrecoverable without reinstalling the software involved (and sometimes Windows itself!) Your 'hook' is probably in the Startup Menu - Look in Start>All Programs>Startup, and see if it's there.-- Noel Paton | Nil Carborundum Illegitemi | CrashFixPC

Thanks for your reply. I have downloaded Autoruns, and surprised at the huge list I got back after running the program. It took a long time but finally found the file under the LOGON tab in the following order,HKLM\SOFTWARE\WINDOWS\Current Version\Under AUTORUN entry, there was a program called XkikijokNo description and No publisher. Then Image Path file not found.There was a tick in the box next to the name, and I unticked it. Switched off the computer, switched back on after making a phone call. First thing I saw was a small window asking about screen resolution, I selected option one and it went away, the computer continued to boot up, it got as far as desktop then it automatically rebooted, it did that 3 times. After third time desktop loaded OK, without the RUNDLL error window being there, but there was a box saying System has recovered from a serious error. Was the RUNDLL error the serious error, or could the removal triggered another problem?Whatever the case, I must say I have been very pleased with the quick response the my question. So once again, thankyou.

Thank you for the quick reply. I take note what you say about registry cleaners, I won't do that again. I couldn't find the file in the startup, but I did disable 4 or 5 programs I didn't need in startup. I'm now moving on to the next reply that I've received. Thanks again. from Mike

It sounds like you were and may still be infected with malware. Have you done the MBAM scan? Or have you uploaded the arelasiwitafabiz.dll file to e.g. VirusTotal.com? Can you post the link to the report?Check the event logs (Event Viewer in Administrative Tools folder in Control Panel) for more details about the "serious errors" referenced.

"CorkieMike" wrote in message news:34048393-9459-4ce7-aeaf-db09b9880766...Thank you for the quick reply. I take note what you say about registry cleaners, I won't do that again. I couldn't find the file in the startup, but I did disable 4 or 5 programs I didn't need in startup. I'm now moving on to the next reply that I've received. Thanks again. from MikeNo.Compromise is the man to follow on this - he's doing exactly what I would have done given the result you got.Good Luck - I'll keep an eye on the thread just in case :)-- Noel Paton | Nil Carborundum Illegitemi | CrashFixPC

Once again, thanks for reply. I have now done the MBAM scan, here are the results. 2 trojan files found in c\windows\tasks and 2 Rogue fix tools registry keys in HKEY.CLASSES.ROOT\.pox and one in HKEY.CLASSES.ROOT\pofile. All now quarantined & deleted.I have checked the event logs (something I never knew existed) the results are:Application error records size 512, source crypt 32System error records, size 512, sources Service control manager & Dhip & W32 Time & BITSCustom log error records, no size given, and I couldn't find any details of those.I did all that about an hour ago, switched off, watched some TV, and then when I started computer it again rebooted, twice this time, but no RUNDLL error window, but it again said "system has recovered from a serious error"You must excuse me, but my computer knowledge is quite limited, I'm finding this all interesting, but can't understand what the computer is telling me, except for the word "error". My next task will be to contact virustotal.com Thanks again from Mike

OK, so the initial problem is gone, and you're getting notified that Windows is recovering from a serious error. Can you check the c:\windows\minidump folder for files with a .dmp extension, and upload them to your SkyDrive (usethese instructions for a guide), and provide a link here? If there are no files in that folder, please indicate so.

http://cid-605e4452bed4f0e3.skydrive.live.com/redir.aspx?resid=605E4452BED4F0E3!120&Bpub=SDX.Docs&Bsrc=GetSharingLinkHelloIt's taken awhile, but I think I've done everything properly. There were 10 .dmp files, and I've sent them to Skydrive, I've never done that before, so another learning curve for me.The link is at the top, and I hope it's the correct link. Thanks from Mike

Of the 10 dumps, three were from 2009 so I didn't check those out. Four were from June 8, two were from May 14, and one was from May 17.The bugchecks were IRQL_NOT_LESS_OR_EQUAL (4) or INVALID_WORK_QUEUE_ITEM (3). The INVALID_WORK_QUEUE_ITEM bugchecks were all attributable to sunkfilt.sys from Dec. 8 2004 - the "USB driver for the 6in1 Multimedia Card Reader" (your system is an HP?). The suggestion would be to update this driver, or disabled the device if you don't use it. The IRQL_NOT_LESS_OR_EQUAL bugchecks were all the same and were all inconclusive - no smoking gun.I'd suggest running chkdsk, and if you have an XP disc,SFC /SCANNOW [also, this], to start with.

HelloThanks, I’ve just seen your reply. First I must tell you the computer booted up without any automatic reboots, or any error message windows, direct to desktop without any problem.My computer isn’t HP, but a custom build from a fairly local independent computer store. I occasionally use the multimedia card reader for an SD card, but I could also connect camera by USB if needed. I’ve had a couple of problems with other driver upgrades, so maybe I’ll just disable.I couldn’t understand what the IRLQ dump file was, but I presume you are saying things should now be OK. I will run the chkdsk tomorrow.I was impressed by the MBAM program, is it OK to use that along side my AVG antvirus?Thanks so much for your help. From Mike

You can use the MBAM program for spot scans, and have a separate AV program for real-time protection and the like. I know of others that do that and don't have problems.The problems you were reporting with "the system has recovered from a serious error" were present since at least mid-May, so they are not related to the removal of the malware, it seems. Some of the bugchecks were shown to have been caused by the driver for the MMC reader, and the other bugchecks didn't have a clear cause, unfortunately. Further investigation can be done if they prove to be problematic.

HelloI'm happy for everything you have done, so a final thank you for helping with my first question (problem) at Microsoft Answers.from MikePS. I haven't run chkdsk yet, I did look at the web page, but it looked a touch complicated on first view, so maybe another time.

Sure - only do what you're comfortable with. Glad to have helped!Cheers!--nc