dslreports logo
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1010
share rss forum feed


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
reply to THZNDUP

Re: Normal ?

Click for full size
Thanks THZNDUP - not sure why its running on LU but not admin. I am messing around with this tonight and found a link. When I end the rundll32 process then end the 2 ghost ie's they do not restart. Ending them with rundll running causes them to restart with in 30 seconds. This racore file seems to be tide to real player which I have never installed. Thoughts?


THZNDUP
Deorum Offensa Diis Curae
Premium
join:2003-09-18
Lard
kudos:2
It's kinda odd that the file isn't in it's own directory of some sort and is just dumped into the 'Roaming' root. That's pretty rude nowadays but still happens. It could also have been used by something other than RA(bloatware, free trial, etc).

You could try 'renaming' it (racore.dll) to see what breaks until a reason is figured out why it's there and running. You will have to find out where/what is calling that rundll with racore.dll being passed to it.

Notice a pattern?
--
one should not increase, beyond what is necessary, the number of entities required to explain anything

redwolfe_98
Premium
join:2001-06-11
kudos:1
Reviews:
·Time Warner Cable
reply to FoMoCo
FoMoCo, for what it is worth, i did a google-search for "racore.dll" and the only program that i saw that had a "racore.dll" file associated with it was a program called "RetroActive":

»www.acquasys.com/retroactive/Def ··· ult.aspx

it is possible that you could use some of the "sysinternals" programs to see what is causing "racore.dll" to be run:

»technet.microsoft.com/en-us/sysi ··· bb896645

»technet.microsoft.com/en-us/sysi ··· bb896653


FoMoCo
466 C.I.D.

join:2001-01-10
Grand Rapids, MI
Process explorer shows it leading to WinDJViewer which I did not install. I will rename it and see what happens. If I figure it out I will follow up. Thanks all.