Jump to content


- - - - -

rundll32.exe missing


  • This topic is locked This topic is locked
45 replies to this topic

#1 Guest_arlene_*

Guest_arlene_*
  • Guests

Posted 19 November 2004 - 08:46 PM

On start up, I received an error message that a dll file was restored successfully. but all wireless connections were lost and a WEP key had to be reentered. After putting it back in, the connection was restored but now I cannot start any programs. I keep receiving the error message "rundll32.exe is missing" . I searched the internet and looked for help and tried to reinstall from the XP CD and I keep getting the error message 'EXPAND.EXE not found", when typing in START>RUN> expand\D:i386\rundll32.ex c:\windows\rundll32.exe. My only recourse is reinstalling Windows XP operating system. Do you have any suggestions on what to try next? I think I really need some help.
thanks

#2 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 19 November 2004 - 09:52 PM

Make sure you have the Windows XP in your drive

Ensure you typed it correctly and make sure D is your CD drive

expand X:\i386\rundll32.ex_ c:\windows\rundll32.exe

X being your CD drive

Or try from a command prompt
Start>>>Run>>type in cmd then hit Enter
Type the above and hit Enter

Restart your computer

But this usually happens when your hit by a virus, I suggest you try and Online Virus scan
at RAV's
http://www.ravantivirus.com/scan/
When you access that link with Internet Explorer
click on the "To Continue without subsribing click here" link
It will load the activex and dat files

Ensure that all the top entries are checked
Autoclean--Inside Archives---Unpack Executables---Smart Scan
Then click the Scan my PC button
Let it completely finish scanning
Copy and Paste the results back here

You should also post a Hijackthis log so we can see if we can Identify any changes in the registry
Important
Create a Permanent Folder for Hijackthis
Double Click "MY Computer"
Open your C: drive
Click "File" >>> "New" >>>> "Folder"
A new folder will be created, name it HJT

Now you will have C:\HJT

Download Hijackthis from HERE or HERE
Save it to that new folder

Do a SCAN----Scan will change to SAVE LOG----copy and paste the WHOLE contents of the log
here... Don't try and fix anything yet----It is all important

Could you also Set Windows to Show Hidden Files and Folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Uncheck the Hide Extensions for known file types
* Click Yes to confirm.
* Click OK.

Search for rundll32.exe in this folder
C:\WINDOWS\system32
let me know if you can find it and if you can, right click on it and click properties
Let me know file size and date created

Also, let me know if you can find rundll32.exe in this folder
C:\WINDOWS\SYSTEM32\DLLCACHE

Can you open up any programs?
Can you use your Unzipping utility for Windows XP to extract a file downloaded from the net?

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#3 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 01:00 PM

Hi
Here are the results of the RAV scan:
Scan started at 11/20/2004 12:54:09 PM

Scanning memory...
Scanning boot sectors...
Scanning files...

Scanned
============================
Objects: 42025
Directories: 2802
Archives: 7546
Size(Kb): -1324415
Infected files: 0

Found
============================
Viruses found: 0
Suspicious files: 0
Disinfected files: 0
Mail files: 327

I am running Hijack next- I will add it to the next post.


I could not complete the expand: or the start>run> cmd, because it kept telling me that cmd.exe could not be found.

#4 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 01:10 PM

I downloaded Hijackthis.exe and when I try to RUN it I receive the same message that I receive from all of my other icons when I try to run it.
Windows cannot open this file
File : Hijackthis.exe

To open this windows needs to know which program created it. Windows can go online to look it up automatically, o you can manually select from a list of programs on your computer.

What do you want to do?

a) Use the web service to find the appropriate program

B) Select the program from the list

A thought occured to me. Right before this situation happened ( night before) I did something dumb and let the battery run out . When the power cord was put it ,everything was activated and working properly. I did not shut the computer down and restart. Next day I did a shut down and then I received the .dll recovery message and the problems began. I am sorry I forgot this info , I did not think it mattered.
I cannot run Hijack this . I am going to try the last instructions that you gave me which was sending you the hidden files. I will add to the next post.

#5 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 20 November 2004 - 01:20 PM

I was curious if you can unzip files

Try download this registry fix
http://www.dougknox..../xp_exe_fix.zip

Save it and UNZIP it to your desktop
Double click on xp_exe_fix.reg and Allow it to merge to the registry

Restart your computer and try sending me a Hijackthis log

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#6 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 01:33 PM

Rundll32.exe was found.
file size = 32.5 kb
Created March 30, 2003


Rundll32.exe is not found in c"\widonds\system32\DLLCACHE

I cannot open any programs


I am not sure where the Unzipping utility for Windows XP is to extract a file download ? Can you give me some help with this?

#7 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 20 November 2004 - 01:40 PM

The zipping utility is incorporated in the right click option

If your having problems just download the reg file directly from here
xp_fix_exe.reg
Save it to your desktop
Close out all windows including this one, double click on the reg file and allow it to Merge to the registry
Restart your computer and post back

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#8 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 01:44 PM

I tried the Doughknox.com and I can download, unzip it , but I cannot run it. I keep getting the same message

Window cannot find a program to run this......

#9 Guest_Guest_*

Guest_Guest_*
  • Guests

Posted 20 November 2004 - 01:51 PM

Don't give up
Try download it from that direct link I gave you

Try restarting into
Safe Mode and merging it

#10 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 01:54 PM

I downloaded it, saved it to desktop , closed out everything and rebooted. I clicked on the file name called XP_Exp-fix.reg and I get the same message as before: "windows cannot open file ......, the same message as above.

#11 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 02:01 PM

I trying the reboot in safe mode now

#12 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 20 November 2004 - 02:02 PM

Let's try this method
Download this Zipped file xp_fileassoc.zip
UNZIP it to your desktop and Double click on the
xp_fileassoc.bat to run it
Follow the prompts

RESTART your computer afterwards

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#13 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 02:44 PM

Hi
I was successful with the .Bat file and it looks like everything is working properly.

I did not get prompted for anything, it ran quickly and I rebooted and it looks good
Thank you so much !

Can you tell me how I got into this mess? Was it the battery running out, a virus?

#14 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 20 November 2004 - 02:48 PM

Good to hear atomilano

I would of bet a virus, it's possible the registry became corrupt
I can't see it happening with a dead battery
I just plugged my Laptop back in to recharge backup :D

I would still like to see a Hijackthis log, let's make sure you are clean

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#15 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 02:51 PM

Ok I am going to try that now

#16 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 02:55 PM

ogfile of HijackThis v1.98.2
Scan saved at 4:03:21 PM, on 11/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8l.hpwis.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec....ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab

#17 guestolo

guestolo

    Site Donator

  • Admin
  • PipPipPipPipPipPipPip
  • 16,247 posts

Posted 20 November 2004 - 03:05 PM

Your log looks good, just a little bit of cleaning up

Do another scan with Hijackthis and put a tick next to these entries

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)


After you have ticked the above entries, close all open windows, including this one
Leave Hijackthis open and FIX CHECKED
Yes to the prompt and exit Hijackthis

Restart your computer

For a little added protection you may be interested in this free program
SpywareBlaster by JavaCool---will block bad ActiveX and malevolent cookies
Install---Check for Updates---Enable all protection
http://www.javacools...areblaster.html
It doesn't run in the background, just do the above and check for updates every couple of weeks

I see you have Spybot installed.
Is it version 1.3, I would think it would be
You can use Spybot Immunization feature to add a little extra protection too
Simply open Spybot
Click on Immunize>>>OK>>>Click Immunize at the top

Take care atomilano :D

Do you want to post your own logs from FRST?
Follow the instructions posted Click Here


#18 atomilano

atomilano

    Journeyman

  • Members
  • PipPip
  • 46 posts

Posted 20 November 2004 - 04:47 PM

I really don't know how to say thank you enough. You were a tremendous help to me and I did not think I would get this working at all.


Thanks again!
Have a good day and a very nice Thanksgiving! :D

#19 Guest_v3rtige_*

Guest_v3rtige_*
  • Guests

Posted 01 December 2004 - 10:02 PM

please help me, i have the exact same problem but the .bat did not help...i extracted it and double-clicked it to run it, but it did not run...it turns semi-transparent and nothing happens

#20 Guest_Guest_*

Guest_Guest_*
  • Guests

Posted 01 December 2004 - 11:12 PM

What operating system are you running?
Can you post a hijackthis log?, instructions are above in this post

You tried the .bat file
Did you try the other exe fix in this thread from Dougknox?

Have you tried an online virus scan

I recommend trying one at Housecall's---Set to Autoclean
http://housecall.trendmicro.com/

and/or at Panda's
http://www.pandasoft...n_principal.htm

Try and post a hijackthis log if you can

Need more info about operating system and such