Replacing rundll32.exe file

[The Seabat]

Howdy: OK, I screwed up and deleted a file called rundll32.exe. I
thought it was a DVLDR trojan and wacked that puppy right off the hard
drive. Now when my neighbor shuts down her computer she get a warning
message that says, "END PROGRAM - RUNDLL32 ending program, please
wait". And then it says, "The program is not responding. To return to
Windows and check the status of the program click Cancel. If you
choose to end the program immediately, you will lose any unsaved data.
To end the program now, click End Now". She clicks End Now and Windows
shuts itself down.

How do I stop this warning box from popping up at shut down and do I
need to replace the rundll32.exe file and how do I do that? And where
do I get it. Oh, yeah, I had to turn off System Restore before I got
rid of the aledged trojan, so there are no restore points att. We also
don't have a WinXP cd.

Quite a little pickle I got myself into, huh? Any ideas, help, please?
Thank you.

 

[David H. Lipman]

From: "The Seabat" <[email protected]>

| Howdy: OK, I screwed up and deleted a file called rundll32.exe. I
| thought it was a DVLDR trojan and wacked that puppy right off the hard
| drive. Now when my neighbor shuts down her computer she get a warning
| message that says, "END PROGRAM - RUNDLL32 ending program, please
| wait". And then it says, "The program is not responding. To return to
| Windows and check the status of the program click Cancel. If you
| choose to end the program immediately, you will lose any unsaved data.
| To end the program now, click End Now". She clicks End Now and Windows
| shuts itself down.
|
| How do I stop this warning box from popping up at shut down and do I
| need to replace the rundll32.exe file and how do I do that? And where
| do I get it. Oh, yeah, I had to turn off System Restore before I got
| rid of the aledged trojan, so there are no restore points att. We also
| don't have a WinXP cd.
|
| Quite a little pickle I got myself into, huh? Any ideas, help, please?
| Thank you.
|

RUNDLL32.EXE is used to lauch Trojans that come to you as a DLL file and will be loaded such
as...

rundll32 TrojanName.DLL

RUNDLL32.EXE can be found on the WinXP CDROM either as RUNDLL32.EXE or as RUNDLL32.EX_

If the latter you can restore the file by the following...
{ Assuming the WinXP CDROM is in drive "D:" }

Open a command prompt and execute...

expand d:\i386\RUNDLL32.EX_ %windir%\RUNDLL32.EXE

To make sure you don't have Trojans...


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.htm#Step_3_%96_Getting_Help


* * * Please report back your results * * *

 

[David Candy]

Rundll32 merely starts programs. It is nothing to do with your problem. It is the program that it started. Deleting it should have replaced it 2 or 3 seconds after you deleted it.