0

Notepad gets started (but fails to run) a few times in a row. Then this stops. This is a fresh install of windows 7 x64. It might (just a thought) be related to a pending restart after a Windows update.

I ran Process Explorer, which is the natural choice to find out what's starting a process. It's rundll32.exe. I scanned both rundll32.exe and notepad.exe with MalwareBytes AM and MS Security Essentials, nothing came up.

Here's the full dump to rundll32.exe.

Is it really rundll32.exe starting notepad, and why would this be happening?

3
  • notepad.exe is an executable. you should NEVER use rundll32 to run an executable. something is seriously wrong. how are you attempting to start it? is your shortcut malicious? what happens when you double click the exe in c:\windows ? Dec 23, 2013 at 19:42
  • Have you tried SysInterals' (Microsoft) Autoruns? Dec 23, 2013 at 19:42
  • What was the command line used to start Notepad? (See in Process Explorer, double click on the process, on the "Image" tab)
    – heavyd
    Dec 23, 2013 at 20:16

1 Answer 1

1

It appears (unless I'm mistaken) that the command used to invoke rundll32 is

rundll32.exe shell32.dll,Control_RunDLL

This command should normally start the control panel. You could begin by trying to run that command manually and see if that works, or fails and replicates the behavior that you're seeing currently.

Notepad seems to be started by the following command:

notepad.exe C:\Users\master\AppData\Local\Temp\6868.tmp

I can't immediately connect the dots and say why it' being started, and what 6868.tmp is supposed to contain. It might be the case that this somehow stems from an installation that wants to display a readme file.

I would look in that temp directory and see if I found a 6868.tmp file which might have permissions such that notepad can't display it. If so, look at the file and figure out where it comes from.

I would search for Control_RunDLL and 6868.tmp in the registry to see if you find any clues.

If this happens again, I would do a new dump and see if still tried to open 6868.tmp with Notepad, or a new, different file. If there's a new file, something must be generating it. If so, you might have luck running Process Monitor (note Process Explorer this time) and filter for events where Path begins with C:\Users\master\AppData\Local\Temp\. (And if needed, enable boot logging in the options menu.) This will hopefully give you a clue what, if anything, is creating the file.

And according to you environment variables, (availabl i the log) this is no longer a completely clean install. You have installed some applications.

No clear answeer, but some things you can try to hopefully track down what is happening.

2
  • That's great, thanks. It should be enough to find out exactly what's going on, next time it happens. The recommended command does start the CP and there is no 6868.tmp in the temp folder.
    – Gaia
    Dec 24, 2013 at 14:36
  • I forgot this: Maybe you have checked the command line for the rundll32 process in Process Explorer (in particular the argument, which specifies which DLL is executed). Maybe the rundll32.exe shell32.dll,Control_RunDLL string just happened to exist in the loaded DLL and wasn't actually the command used to invoke the rundll32 process.
    – nitro2k01
    Dec 24, 2013 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.