It appears (unless I'm mistaken) that the command used to invoke rundll32
is
rundll32.exe shell32.dll,Control_RunDLL
This command should normally start the control panel. You could begin by trying to run that command manually and see if that works, or fails and replicates the behavior that you're seeing currently.
Notepad seems to be started by the following command:
notepad.exe C:\Users\master\AppData\Local\Temp\6868.tmp
I can't immediately connect the dots and say why it' being started, and what 6868.tmp is supposed to contain. It might be the case that this somehow stems from an installation that wants to display a readme file.
I would look in that temp directory and see if I found a 6868.tmp
file which might have permissions such that notepad can't display it. If so, look at the file and figure out where it comes from.
I would search for Control_RunDLL
and 6868.tmp
in the registry to see if you find any clues.
If this happens again, I would do a new dump and see if still tried to open 6868.tmp with Notepad, or a new, different file. If there's a new file, something must be generating it. If so, you might have luck running Process Monitor (note Process Explorer this time) and filter for events where Path
begins with C:\Users\master\AppData\Local\Temp\
. (And if needed, enable boot logging in the options menu.) This will hopefully give you a clue what, if anything, is creating the file.
And according to you environment variables, (availabl i the log) this is no longer a completely clean install. You have installed some applications.
No clear answeer, but some things you can try to hopefully track down what is happening.