Problem with rundll32.exe when starting games

[Verrucosus]

I recently switched computers. The new one has a Windows 7, 64 bit system. Getting the older games to work was a bit of a challenge, but most of them are running now. I still have a weird problem starting quite a number of games, including vanilla Civ4.

The problem is that the game does not start when I click the shortcut (or doubleclick the executable itself) for the first time. There's a sandclock next to the mouse pointer for a second or two, then nothing happens. When I click the same shortcut for a second time, the game starts without a problem.

Watching the task manager indicates that the problem might be related to a process called rundll32.exe:
1) There are two processes named like that after booting up the computer.
2) When I try to start vanilla Civ4, its executable appears as "Civilization4.exe *32" as a process called "rundll32.exe *32" appear on the process list.
3) As long as that process is on the list, the game can be started normally. This places a second game executable on the list which is removed properly when the game is closed. The first executable remains.
4) When the first executable is on the list and I connect to the internet, after a while the game just starts.

The last bit worries me quite a bit, but my anti-virus software cannot find anything.

Vanilla Civ4 is not the only game with the problem I tried to describe. So far, I've noticed the same behaviour with Alpha Centauri, Imperialism II, Europa Universalis II, Gettysburg and RollerCoaster Tycoon. Some very old games (Imperialism as well as all of those I need to run through DosBox) and more recent games (for example Civ4 BtS) are not affected.

Incidentally, the problem does not exist when I create and use a different user account.

Any help in solving this riddle will be appreciated.

 

[Souron]

Could be malware.

Windows 7 should have Windows Defender on it. Run a scan with that. You can also get other software like Lavasoft's AdAware, and Spybot Search and Destroy.

To attack the problem more directly, run msconfig. Look for that exe in the Startup tab.

If that doesn't work, get hijackthis. It looks at more places than msconfig for things that happen on startup.

You can also add the "rundll32.exe *32" process to startup yourself.

 

[Verrucosus]

Thank you for replying so quickly.

Neither Windows Defender nor Norton 360 found any malware.

The troublesome process "rundll32.exe *32" is not shown in msconfig.exe (at least not as such). In the task manager's process list, it only shows up after I try to start a game.

I have found a couple of articles that point to Windows 7's game explorer as the villain.

http://www.networksteve.com/windows/topic.php?TopicId=7043

The obvious solution (telling the game explorer not to search for and update any information about the games) has failed in my case.

Other workarounds have been suggested here:

http://www.neowin.net/forum/topic/887850-removing-games-explorer/
http://www.ms-windows.info/Help/old-games-dx9-dx8-not-run-offline-3063.aspx

These threads go well over my head and I'd like to have some idea of what I'm doing before I follow these suggestions.

Again, any opinion and advice will be appreciated.

 

[aimeeandbeatles]

RunDLL32 is basically allows you to run DLLs as programs. If its in System32 it should be ok, elsewhere Id be suspicious.

 

[Verrucosus]

Thank you, system32 is where it sits. I was suspicious because it blocks the game from starting unless I'm connected to the internet, but the idea that the games explorer tries to look for online information is a plausible and relatively harmless explanation.

As a temporary workaround, I have made a copy of the game executable (e. g. terran - copy.exe for Alpha Centauri), redirected the desktop shortcut to that copy and now use it to start the game. With Alpha Centauri and Europa Universalis II that trick seems to work; I'll have to wait till the weekend to test it with other games (need the CD to launch vanilla Civ4).

Anyway, thanks for the help so far. If anyone comes up with a more elegant solution, I'll be thrilled.