« previous next »
Pages: [1] 2 3

Author Topic: rundll32.exe missing  (Read 47498 times)

arlene

  • Guest
rundll32.exe missing
« on: November 19, 2004, 09:46:41 PM »
On start up, I received an error message that a dll file was restored successfully. but all wireless connections were lost and a WEP key had to be reentered.  After putting it back in,  the connection was restored but now I cannot start any programs. I keep receiving the error message "rundll32.exe is missing"  . I searched the internet and looked for help and tried to reinstall from the XP CD and I keep getting the error message  'EXPAND.EXE not found", when typing in START>RUN> expand\D:i386\rundll32.ex c:\windows\rundll32.exe.  My only recourse is reinstalling Windows XP operating system.  Do you have any suggestions on what to try next?  I think I really need some help.
thanks
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #1 on: November 19, 2004, 10:52:04 PM »
Make sure you have the Windows XP in your drive

Ensure you typed it correctly and make sure D is your CD drive

expand  X:\i386\rundll32.ex_ c:\windows\rundll32.exe

X being your CD drive

Or try from a command prompt
Start>>>Run>>type in cmd then hit Enter
Type the above and hit Enter

Restart your computer

But this usually happens when your hit by a virus, I suggest you try and Online Virus scan
at RAV's
http://www.ravantivirus.com/scan/
When you access that link with Internet Explorer
click on the "To Continue without subsribing click here" link
It will load the activex and dat files

Ensure that all the top entries are checked
Autoclean--Inside Archives---Unpack Executables---Smart Scan
Then click the Scan my PC button
Let it completely finish scanning
Copy and Paste the results back here

You should also post a Hijackthis log so we can see if we can Identify any changes in the registry
Important
Create a Permanent Folder for Hijackthis
Double Click "MY Computer"
Open your C: drive
Click "File" >>> "New" >>>> "Folder"
A new folder will be created, name it HJT

Now you will have C:\HJT

Download Hijackthis from HERE or HERE
Save it to that new folder

Do a SCAN----Scan will change to SAVE LOG----copy and paste the WHOLE contents of the log
here... Don't try and fix anything yet----It is all important

Could you also Set Windows to Show Hidden Files and Folders
* Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Uncheck the Hide Extensions for known file types
    * Click Yes to confirm.
    * Click OK.

Search for rundll32.exe in this folder
C:\WINDOWS\system32
let me know if you can find it and if you can, right click on it and click properties
Let me know file size and date created

Also, let me know if you can find rundll32.exe in this folder
C:\WINDOWS\SYSTEM32\DLLCACHE

Can you open up any programs?
Can you use your Unzipping utility for Windows XP to extract a file downloaded from the net?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #2 on: November 20, 2004, 02:00:40 PM »
Hi
Here are the results of the RAV scan:
Scan started at 11/20/2004 12:54:09 PM
 
Scanning memory...
Scanning boot sectors...
Scanning files...

Scanned
============================
   Objects: 42025
   Directories: 2802
   Archives: 7546
   Size(Kb): -1324415
   Infected files: 0

Found
============================
   Viruses found: 0
   Suspicious files: 0
   Disinfected files: 0
   Mail files: 327

I am running Hijack next- I will add it to the next post.


I could not complete the expand: or the start>run> cmd, because it kept telling me that cmd.exe could not be found.
« Last Edit: November 20, 2004, 02:02:05 PM by atomilano »
Logged

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #3 on: November 20, 2004, 02:10:01 PM »
I downloaded Hijackthis.exe and when I try to RUN it I receive the same message that I receive from all of my other icons when I try to run it.
Windows cannot open this file
File : Hijackthis.exe

To open this windows needs to know which program created it. Windows can go online to look it up automatically, o you can manually select from a list of programs on your computer.

What do you want to do?

 a) Use the web service to find the appropriate program

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/cool.gif\' class=\'bbc_emoticon\' alt=\'B)\' /> Select the program from the list

A thought occured to me. Right before this situation happened ( night before) I did something dumb and let the battery run out . When the power cord was put it ,everything was activated and working properly. I did not shut the computer down and restart. Next day I did a shut down and then I received the .dll recovery message and the problems began.  I am sorry I forgot this info , I did not think it mattered.
I cannot run Hijack this . I am going to try the last instructions that you gave me which was sending you the hidden files.  I will add to the next post.
« Last Edit: November 20, 2004, 02:16:37 PM by atomilano »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #4 on: November 20, 2004, 02:20:55 PM »
I was curious if you can unzip files

Try download this registry fix
http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip

Save it and UNZIP it to your desktop
Double click on xp_exe_fix.reg  and Allow it to merge to the registry

Restart your computer and try sending me a Hijackthis log
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #5 on: November 20, 2004, 02:33:47 PM »
Rundll32.exe was found.
file size = 32.5 kb
Created March 30, 2003


Rundll32.exe is not found in c"\widonds\system32\DLLCACHE

I cannot open any programs


I am not sure where the Unzipping utility for Windows XP is to extract a file download ?  Can you give me some help with this?
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #6 on: November 20, 2004, 02:40:49 PM »
The zipping utility is incorporated in the right click option

If your having problems just download the reg file directly from here
xp_fix_exe.reg
Save it to your desktop
Close out all windows including this one, double click on the reg file and allow it to Merge to the registry
Restart your computer and post back
« Last Edit: November 20, 2004, 03:03:54 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #7 on: November 20, 2004, 02:44:56 PM »
I tried the Doughknox.com and I can download, unzip it , but I cannot run it. I keep getting the same message

Window cannot find a program to run this......
Logged

Guest

  • Guest
rundll32.exe missing
« Reply #8 on: November 20, 2004, 02:51:48 PM »
Don't give up
Try download it from that direct link I gave you

Try restarting into  
Safe Mode and merging it
Logged

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #9 on: November 20, 2004, 02:54:57 PM »
I downloaded it, saved it to desktop , closed out everything and rebooted. I clicked on the file name called XP_Exp-fix.reg and I get the same message as before:  "windows cannot open file ......, the same message as above.
Logged

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #10 on: November 20, 2004, 03:01:31 PM »
I trying the reboot in safe mode now
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #11 on: November 20, 2004, 03:02:25 PM »
Let's try this method
Download this Zipped file xp_fileassoc.zip
UNZIP it to your desktop and Double click on the
xp_fileassoc.bat to run it
Follow the prompts

RESTART your computer afterwards
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #12 on: November 20, 2004, 03:44:53 PM »
Hi
I was successful with the .Bat file and it looks like everything is working properly.

 I did not get prompted for anything, it ran quickly and I rebooted and it looks good
Thank you so much !  

Can you tell me how I got into this mess?  Was it the battery running out,  a virus?
« Last Edit: November 20, 2004, 03:46:49 PM by atomilano »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #13 on: November 20, 2004, 03:48:08 PM »
Good to hear atomilano

I would of bet a virus, it's possible the registry became corrupt
I can't see it happening with a dead battery
I just plugged my Laptop back in to recharge backup  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />

I would still like to see a Hijackthis log, let's make sure you are clean
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #14 on: November 20, 2004, 03:51:59 PM »
Ok I am going to try that now
Logged

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #15 on: November 20, 2004, 03:55:21 PM »
ogfile of HijackThis v1.98.2
Scan saved at 4:03:21 PM, on 11/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8l.hpwis.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedat...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
rundll32.exe missing
« Reply #16 on: November 20, 2004, 04:05:35 PM »
Your log looks good, just a little bit of cleaning up

Do another scan with Hijackthis and put a tick next to these entries

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

After you have ticked the above entries, close all open windows, including this one
Leave Hijackthis open and FIX CHECKED
Yes to the prompt and exit Hijackthis

Restart your computer

For a little added protection you may be interested in this free program
SpywareBlaster by JavaCool---will block bad ActiveX and malevolent cookies
Install---Check for Updates---Enable all protection
http://www.javacoolsoftware.com/spywareblaster.html
It doesn't run in the background, just do the above and check for updates every couple of weeks

I see you have Spybot installed.
Is it version 1.3, I would think it would be
You can use Spybot Immunization feature to add a little extra protection too
Simply open Spybot
Click on Immunize>>>OK>>>Click Immunize at the top

Take care atomilano  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline atomilano

  • Newbie
  • *
  • Posts: 46
  • Karma: +0/-0
    • View Profile
rundll32.exe missing
« Reply #17 on: November 20, 2004, 05:47:28 PM »
I really don't know how to say thank you enough. You were a tremendous help to me and I did not think I would get this working at all.


Thanks again!
Have a good day and a very nice Thanksgiving! http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Logged

v3rtige

  • Guest
rundll32.exe missing
« Reply #18 on: December 01, 2004, 11:02:12 PM »
please help me, i have the exact same problem but the .bat did not help...i extracted it and double-clicked it to run it, but it did not run...it turns semi-transparent and nothing happens
Logged

Guest

  • Guest
rundll32.exe missing
« Reply #19 on: December 02, 2004, 12:12:31 AM »
What operating system are you running?
Can you post a hijackthis log?, instructions are above in this post

You tried the .bat file
Did you try the other exe fix in this thread from Dougknox?

Have you tried an online virus scan

I recommend trying one at Housecall's---Set to Autoclean
http://housecall.trendmicro.com/

and/or at Panda's
http://www.pandasoftware.com/activescan/co...n_principal.htm

Try and post a hijackthis log if you can

Need more info about operating system and such
Logged
Pages: [1] 2 3
« previous next »