Registry entry containg TCPRUN.DLL

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Drago Jurcan - 08 Sep 2005 04:31 GMT

I have a PC running Windows ME. The video driver gets corrupted on re-boot
resulting in the blue screen. Occasionally I get past the blue screen and the
PC actually boots but runs extremely slow. I have noticed a registry entry
containing TCPRUN.DLL

Is that a legitimate windows component or a virus or other malware ?
It appears that the registry key cannot be removed.

HKLM........\Run Once\*TCPRUN
"rundll32.exe C\Windows\Apppatch\TCPRUN.DLL, CreateProtectProc rerun"

Can anybody help out ?

Signature

dj244

Reply to this Message

Alan Edwards - 08 Sep 2005 05:19 GMT

It is not legitimate.
Why do you say the Registry key cannot be removed?

...Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

>I have a PC running Windows ME. The video driver gets corrupted on re-boot
>resulting in the blue screen. Occasionally I get past the blue screen and the
[quoted text clipped - 8 lines]
>
>Can anybody help out ?

Reply to this Message

Drago Jurcan - 08 Sep 2005 13:09 GMT

Thank you for your response Alan

The registry entry appears to be deleted by using regedit. However when you
come back to check it is reinstated in its original form. It is either that
or I am doing something silly.

The follow up question is this likely to be causing the CPU to be buisy in
the background hence slowing everything up and/or corrupting the video driver.

Signature

dj244

> It is not legitimate.
> Why do you say the Registry key cannot be removed?
[quoted text clipped - 16 lines]
> >
> >Can anybody help out ?

Reply to this Message

Alan Edwards - 08 Sep 2005 22:21 GMT

If you delete it and it is recreated, then the virus (or whatever it
is) is doing it. There must be a process running that should be
deleted before removing the Registry entry.
I don't like the mention of "CreateProtectProc" so you may find a
problem removing it except perhaps in safe mode.

It is not clear what sort of nasty this is, so I cannot answer your
follow up but I suspect it is the cause.

...Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

>Thank you for your response Alan
>
[quoted text clipped - 25 lines]
>> >
>> >Can anybody help out ?

Reply to this Message

Drago Jurcan - 09 Sep 2005 23:52 GMT

Thank you Alan
The conformation that it needs to be removed is helpfull. The effort to
remove it is therefore not wasted. I will examine each of the items in tha
task list one by one and try to identify the offender.

Thanks again for your help.

Signature

dj244

> If you delete it and it is recreated, then the virus (or whatever it
> is) is doing it. There must be a process running that should be
[quoted text clipped - 39 lines]
> >> >
> >> >Can anybody help out ?

Reply to this Message