rundll32.exe 1

[smash81]

Hello,
Recently, i had a worm on my computer.I managed to remove it but after having removed it i came to realize that i could not do certain things on the comp as there was a message that said that the rundll32.exe file or one of its components was missing.Could anyone tell me how i could overcome this problem.I tried running windows setup but that did not solve my problem.Any help please?

Cheers

 

[Eguy]

Hi;

Use regedit to examine the file association key for unknown file types:

HKEY_CLASSES_ROOT\Unknown\shell\openas\command

The default value for this key should read:
C:\%windir%\rundll32.exe shell32.dll,OpenAs_RunDLL %1

If necessary, modify the value to match the value shown here.

===> READ & HEED <===
Backup your registry before changing anything!
Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system.

Ed Please let me know if the sugestion(s) I provide are helpful to you.
Sometimes your the windshield... Sometimes your the bug.

 

[smash81]

Thank you for the help but this did not solve the problem.The thing is that the rundll32 file has been deleted by the virus.How can i put it back into the computer?
Cheers.

 

[Guest_imported]

Had the same problem (sirc32.exe-worm). Have you found a solution yet? If so would appreciate your sharing it.

Thanks,

gcejr

 

[JoaoTL]

Hi, i think that Rundll32 is renamed to 'run32.exe', try to restore it.
-------------------------
Regards
JoaoTL
NOSPAM_mail@jtl.co.pt

http://www.jtl.co.pt/Access

-------------------------

 

[saji]

your pc is infected by virus w32.sircam.worm@mm virus.
this virus renamed rundll32.exe to run32.exe.
visit

http://www.norton.com

or

http://www.sarc.com/avcenter/fixsirc.com

down load the file fixsirc.com in a floopy
run this from windows run command
it will clear all and restore all files original
this tool will do the following thigs
1. It scans and deletes files infected with the W32.Sircam.Worm@mm worm.

2. The tool removes the following registry key:

HKEY_LOCAL_MACHINE\Software\SirCam

3. In the registry key

HKEY_LOCAL_MACHINE\Software\MicrosoftWindows\CurrentVersion\RunServices

it deletes the following value:

Driver32

4. In the registry key

HKEY_CLASSES_ROOTexefile\shell\open\command

the tool modifies the [Default] value by setting it to:

&quot;%1&quot; %*

5. The tool removes the line &quot;@win \recycled\sirc32.exe&quot; from the C:\Autoexec.bat file.
6. The tool restores Rundll32.exe file, renamed by the worm.

I think this will work fine

 

[smash81]

Hello guys,
Thank you for the helpful responses.I managed to solve the problem by simply copying the rundll32.exe file from a 'clean' machine into the original location of the infected machine and it worked.
This is the solution to the problem.Thank you all.
Cheers

 

[sbalun]

I had this same problem with the sircam virus/worm. I went thorough all the same troubles over several days and ended up with the same solution, copying the rundll32.exe from a clean machine. A couple of more pieces of advice. If you &quot;share&quot; your hard drive over a network with anyone else be sure that their machine isn't also infected. If it is you will get the virus again. Also, you need to make sure your machine isn't still running the autoexec.bat startup sequence, &quot;@win \recycled\sirc32.exe&quot; from the C:\Autoexec.bat file. Last but not least, empty out your recycle bin and if your using the NORTON producted recycle bin be sure that you also delete all of those files out of the correct folder in the Norton System works folder.

Happy computing--

 

[Guest_imported]

well... i tried to do what u guys r saying and i still have this &quot;invalid shortcut&quot; and i tried to copy the good file into and computer and still no luck, i also heard that the 18th of october the virus will put more stuff on your hardrive and send out e-mail with the virus. i just hope i get rid of the virus before the day.

Spencer yanaga

 

[swimming]

Dear 14 year old kid

Sounds like you might have tried to drag and drop an executable - you usually end up creating a short cut instead of moving or copying a file - youre better off using RH click and choosing copy.
By the way - it is possible to install one file from the windows CD in win 98 (Possibly also ME - haven't had a prolonged &quot;fiddle&quot; by step 1 - choose &quot;system information&quot;from the system tools subfolder under accessories from START -> Programs When this program is running step2 - choose tools menu and select the system file checker option - choose the extract one file optionand follow instructions. - cheers

 

[RFBaker]

If its Windows 98 there's a built in utility which checks and restores system files, sfc.exe is the prog u want, do a seach for it and run it, if a system file is missing or has been changed it will prompt for the install files and restore it.

Richard Baker
RFBaker@BTInternet.com

 

[Guest_imported]

Thnx but the real problem im having is that is always say &quot;invalid path&quot; on almost everything that is an exe.


spencer yanaga

 

[edfair]

Because a registry entry got changed to eliminate the .exe extensions from running. You can change the .exe you want to run to .com and it will run.
Why don't you surf to Symantec's site and read through the manual removal instructions. There is a link in the FAQ section of this forum. Ed Fair
efair@atlnet.com

Any advice I give is my best judgement based on my interpretation of the facts you supply.

Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[Guest_imported]

well...i can't fix it so i think i will start off with a new harddrive but thnx for the help.

Spencer yanaga

 

[Joelee]

I used the norton tool to remove the virus sircam, however it didn't restore the rundll32.exe. The machine I was working on is running Win95. Can I use the clean copy of rundll from my win98 machine and install it on the 95 machine?
Thanks,
Joelee

 

[Neo81]

Hey Dudes,


There is a utility in Windows 98 called System File checker... to run this program goto ya start bar then hit the run button.... type &quot;sfc&quot; (without the brackets of course) this program will check all your system files and restore the ones that are lost... otherwise you can use the dos extract utility located in the c:\windows\command\ dir.... the command line is something like this &quot;extract /a [first cab file] [file.name] [path of file]&quot;

eg. c:\windows\command> extract /a win98_22.cab rundll32.exe c:\windows\system

hope this help

later

 

[taylr]

THIS FIX WORKS!!!

http://www.zdnet.com/products/stories/reviews/0,4161,2662431,00.html

 

[Thongdude]

But what if you don't HAVE a windows CD? My computer came with these stupid recovery discs, and my computer can't seem to find any cab files anywhere on there.

 

[Kjonnnn]

The removal tool on the Symantec site should make your links functional again

http://www.sarc.com/avcenter/venc/data/w32.sircam.worm@mm.html

 

[pocahontas]

Hi

I am not sure whether I have a worm or something ... I am using the current version of Norton Antivirus with current virus definitions. I also have Zone Alarm on my computer. Recently, I notice that Rundll32.exe or Run DLL as an application is trying to access the internet. Is that normal? Or am I infected by a worm. For a long time, the Antivirus did not detect a Kak worm - a recent virus definition found 3 worms in 3 old emails found in the archieves of Eudora although I do regular weekly virus scan of all files on the computer. Can you advise? Thanks