Jon (j_b) wrote,
Jon
j_b

  • Mood:

Don't give ACDSystems or VBOX any money.

Got two rundll32.exe processes that are keeping each other alive?

Wondering "What the heck?"

I noticed these two rundll32.exe instances and was wondering if a virus had sneaked onto my system.

Thanks to Process Exporer from SysInternals, I was able to find that vbox.dll was one of the connected files responsible.

It had come onto my system with a trial copy of ACDSee.

If your product is going to require a license key widget, fine. Unload it when I'm not using your program.

This behavior of leaving anonymous processes running on peoples' systems that resist being killed is reprehensible, and stupid.

It's bad enough that programs such as RealPlayer would shove "connect to the Internet and pop up in your face" utilities like their TKBELL.EXE ... but at least you could search your hard drive for that and be assured "Oh, it's from RealPlayer, not a virus", and disable it from starting with a registry tweak.

Hiding what program is running behind RUNDLL32.EXE is annoying. Hiding your shit under \Program Files\Common Files\ instead of \Program Files\ is further annoying.

Also, uninstalling the ACDSee software DOES NOT REMOVE VBOX.

C:\Program Files\Common Files\Vbox\Common\vboxr.dll stays stuck in memory.

Windows XP users can do: TASKKILL /F /IM RUNDLL32.EXE to slaughter the little buggers.

If anyone who reads this is helped by it, I am glad. If the authors of ACDSee / Vbox stub their toes while eating breakfast and their food lands jelly-side down on the floor, I am also glad.

Many thanks to SysInternals, the programmers on the Woodmann forum, and Google.

-j
Subscribe
  • Post a new comment

    Error

    default userpic

    Your reply will be screened

    Your IP address will be recorded 

    When you submit the form an invisible reCAPTCHA check will be performed.
    You must follow the Privacy Policy and Google Terms of use.
  • 1 comment