Windows 10: Interesting Items in Autoruns

I hide the Microsoft entries and only fiddle with third party stuff in Autoruns for safety.

 

I ran across two Rundll32 items in Autoruns in multiple computers which I don't recall existing there before.





Any idea what they might be?

JohnD

:)

 

Getting OccidentAcrident.dll startup error on Windows 10

Chris



Extract from your Autoruns file:

+ "\chris coleCementerFrizzlierV2" ""
"" "File not found: OccidentAcrider.dll"
"" ""



Please use Autoruns to delete 8 entries where the words “File not found” appear. With Autoruns you can uncheck an item, which disables it from starting, or you can right click an item and then delete it. Click the
Everything tab and look for the rows highlighted in yellow. To delete a disabled item you need to recheck it before you can delete it.

 

error message at startup

To identify what loads when you boot use Autoruns (freeware from Microsoft).

Autoruns for Windows - Windows Sysinternals



With Autoruns you can uncheck an item, which disables it from starting, or you can right click an item and then delete it. If you uncheck you can recheck to re-enable the item. It is a
much safer approach than editing the Registry and better than using msconfig.



Right click Autoruns selecting Run as Administrator and select the
Everything tab. Click File, Save and, using the scroll to the right, change the “Save as type” option from Autoruns Data (*.arn) to
Text (*txt). The file name changes to AutoRuns.txt. Click the
Save button and upload the file to your OneDrive as a shared file and post as a link here.



A useful feature of the programme is that you can right click an item and select Search Online to get information about the item selected.

Please use Autoruns to delete ?? entries where the words “File not found” appear. With Autoruns you can uncheck an item, which disables it from starting, or you can right click an item and then delete it. Click the
Everything tab and look for the rows highlighted in yellow. To delete a disabled item you need to recheck it before you can delete it.

 

I have got these too. It seems something system related.

 

I looked in the Registry but cannot find any such entries.

JohnD

 

Here's an excellent discussion of rundll32.exe from the HowToGeek, including some interesting forensic techniques for digging in deeper and learning more about what it's up to: What Is rundll32.exe and Why Is It Running. Here's an old TenForums thread that also sheds some potentially useful light on this subject: Why is Windows Host Process (Rundll32) in my Startup?
HTH,
--Ed--