What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

"Rundll32.exe CPU Hog" MB_DummyWindow?

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have a brand new Dell E1705 notebook, it is the model right below XPS series, as soon as I got it removed a lot of the extras that Dell shipped with it. I then proceeded to install a few apps that I use on a regular basis. i.e. "Adobe CS2 and Macromedia Studio" There is one stange thing that happens when I turn off the computer when this happens, I get a "End Now" window that pops up for "MB_DummyWindow". I have no clue what this is and when I google it all that I get is four results that are in German. I have no clue what the problem is, please help.

Logfile of HijackThis v1.99.1
Scan saved at 10:50:52 PM, on 7/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\DOCUME~1\RyJo\LOCALS~1\Temp\clclean.0001
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Documents and Settings\RyJo\Desktop\HijackThis.exe
c:\dell\E-center\gtb2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ECenter] "c:\dell\E-Center\gtb.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
Post #2
Trenton, I recently purchased a Dell Inspiron 9400 laptop and did exactly what you did and I am getting the same "MB_DummyWindow" message on shutdown. I uninstalled unneeded trial softwares and installed my stuff. But I don't think that's when it started. I can't be sure when it started, but I am certain it wasn't in the fist week or so when I was setting things up. In any case, I'm looking for an answer too. I'm running the McAfee Security that came with the computer. It found one low-rated Trojan in my Temp directory from an unscanned email, but that one was removed and never got a chance to do it's thing. Noting else found so far. Anybody, help is appreciated. :( Thank you. Slider16
Post #3
Hey, I removed pretty much all the the trail software and other dell junk on the first day. I did leave all of the dell services for keyboard controls and dell help. I am using zone alarm instead of mcafee. I have not had any kind of infections found by ZA or Ad-Aware. I still can not fin anything about the MB_DummyWindow. I wilsh that I could find somebody that know what it is. Trenton
Post #4
TROJAN VIRUS THAT ALLOWS SOMEONE TO GAIN FULL STEALTH ACCESS TO YOUR COMPUTER!!!

I too recently bought a new dell laptop and am having the same problem. It started a few days after I went looking for a serial for a game on a serial site. I think this might be some kind of virus trojan where someone opens a window and can access your computer. I think this dummywindow thing is the window they can use to tinker on your computer. I have this same ms_dummywindow thing popping up at shutdown and the same rundll32.exe process problem hogging 50% of my memory. I have tried every single adaware removal, am very familiar with them, searched all through the registries all over the place, and have found nothing. I have no viruses showing on updated most recent everything, no adware showing up either.

I did a google search for Rundll32.exe and I found that this file is associated with viruses basically in that it can be infected somehow. I found 4 sites with different instructions where to look in the registry for keys that will indicate its a virus and how to remove it, but those registries were not there at all anywhere. I have not found the "suspect" files they talk of that would indicate it has been infected. I have not found a virus removal tool anywhere for this one either. Im not sure if your computer can run without it, but when you shut down the process in the task manager, it will restart itself just like a virus/malware does in a few minutes, all by itself. Also if you have anything open, it will freeze the taskbar when you shut down the process and all your open programs will be frozen and non accesible. If you have nothing open, sometimes it will leave you with an un-useable desktop.

This really seems like a new strain of trojan virus to me that has so far been undetectable by everythign out there. I have not asked dell about it but I will call them tomorrow and repost on here what they say.

here is a link I found which talks about this being a trojan desktop hijacker but it does not give you easy instructions so it is basically hopeless, but gives you some insight to what is going on.
http://windowsxp.mvps.org/rundll32.htm

Also, I can find plenty of anti-malware companies selling their BS carp** trapping you into buying their shitty software, scamming you with so called "free downloads" which are nothing more than useless scam programs to download their non-working software that will "scan" but not do any cleaning whatsoever. I think this should be against the law, but the point is, there are plenty out there saying this is a TROJAN VIRUS THAT ALLOWS SOMEONE TO GAIN FULL STEALTH ACCESS TO YOUR COMPUTER!!!

Uniblue registry scanner is a scam trial that will only remove 15 errors unless you buy the full version. I come up with 163 registry errors but when i look at them one by one on the list I dont see anything that looks related to rundll32.exe


here are a couple more links talking about the possibility of this total computer stealer.
http://www.hardavenue.com/a/rundll32.exe.php

URGENT READ!!!!! This one shows how they overwrite your proper rundll32.exe file with a malicious one so nothing looks out of place!!
http://securityresponse.symantec.com/avcen…r.lastdoor.html
this is not the only virus I have found that does this, I have found maybe 10 so far just in a simple rundll32.exe google search. However I am not finding any of the registries they say are there, but I just KNOW that this MUST be a trojan total control virus.

This might be a version of the smitfraud virus.

I have just looked in my HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
in the registry and found a couple suspect files.
1. = MBmon (I can not find info for this one anywhere, but several malware prevention sites come up with it, although dont talk directly about it)
http://www.247fixes.com/forums/index.php?showtopic=665

2. = nwiz.exe
http://www.auditmypc.com/process/nwiz.asp
This one shows as a virus as well possibly, but is also a legitimate file that can be overwritten

3. = Nvcpldaemon
http://startup.networktechs.com/srch-NvCplDaemon.html
This one shows as a virus as well possibly, but is also a legitimate file that can be overwritten

I just deleted MBmon out of my run registry and I will see how it goes and report back as well. I opened task manager and rundll32.exe is not running right now so maybe thats the ticket. Hopefully it is.
Post #5
Hi there, I'm having the same problem with a brand new XPS m1210, XP pro. For me it seems to kick in after the screensaver has been on for sometime, so perhaps after it tries to go into some sort of power save mode. I did try and chase down some of the processes the other day and it looked like it might have something to do with the optical drive software - I didn't write down what I found though so I'll have to chase again when the problem re-occurs. If anyone succeeds in fixing this please post. Has anyone tried calling Dell yet? Andy.
Post #6
Spyware bot on the middle of this page is just another scamware that says free download. IT IS NOT FREE. they scam you into downloading their memory wasting carp** and then say "register it" well registering is REALLY BUYING their carp** for 20 bucks. What a SCAM!! if a company can not be straight up and honest, they dont deserve to be linked here. I hope to god tomcoyote dumps this kind of lying bullcrap from this site. Its amazing he lets a scamware company advertise here. I wonder if he knows. This garbage scans my computer and lists cookies as infections (laughable) and says other serious infections are casino on net (a legit program I have used for years without issue) and 2 others which are both fine as well. What a joke. Make sure you dont waste 20 bucks on this SCAMWARE.
Post #7
As far as I'm aware, there are many/various malicious programs that can hijack a rundll32 process and because of this it is a pretty useless search term. Lots of different legitimate programs launch the rundll32.exe file and at anyone time you often have several rundll32 processes running in the background, so this doesn't help us to identify the problem.
Post #8
I havent tried calling dell yet as I dont speak hindu too well. It seems the dell technicians english skills get worse and worse. I have nothing against hindus and outsourcing but when I have to ask for 3 different people per call out of frustration not being able to understand what they are saying, even though I lived in a 40% hindu majority area (surrey, BC canada) and had plenty of hindu friends, I am reluctant to call, but I will (sigh) try again. dialing now..
Post #10
I had EXACTLY the same problem. I turned OFF almost everything in msconfig / startup. I updated my nVidia driver and then in msconfig turned off the nVidia startup carp**. I also disabled the sound card stuff and I've been running for a full 24 hours now without any sign of the rundll32 CPU hog. Also, each time I reboot, I no longer get the MB_DummyWindow error.

Thanks for the advice.

I've got the E1705 Duo 2.16ghz, XP Media Center, 2gb 667RAM, 100gb 7200hdd, SB Soundcard (Supposedly), nVidia 256MB 7900, and the rest is pretty standard. I basically uninstalled all the carp** Dell puts on the computer when I got it in and experienced the rundll32 error. My wife, on the other hand, has the E1705 Duo 1.83, XP Pro, 1gb RAM, 60gb 7200hdd, Standard Soundcard, ATI 256MB Video. She wiped her system as soon as she got it from Dell and never saw the Rundll32 problem. Maybe that's what I should've done too. : )

I found this pretty cool utility today….I haven't used it yet, but there are a lot of good reviews about it.
PC De-crapify

Brian
Post #11
I have had my Dell XPS M1710 for a few months and just started having the MB_DummyWindow End Program message when I shutdown. After reading through the entries above I turned off Rundll32 CTMBHA, MidiDef, CtsysVol, and AndreaVC. Did this in the msconfig startup tab. All of these are related to Creative Audigy. Problem is gone now. Not sure which one of those was the problem, but do not think this is spyware related at this point. Probably some kind of conflict in the Dell HD and the Audigy drivers, since this seems to be unique or at least common to Dell systems at this point. I also wasn't seeing the resource drain some of you saw but that could be because I have a dual CPU machine w/2GB RAM.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI