Virus help :(

[shredder]

Hi Guys, I'm hoping someone might be able to help? I think my laptop has some kind of virus. Be gentle with me, I'm not particuluarly advanced with these things! I've spent ages searching google but I just can't get my head round any of it.

I've not installed anything but whilst online my Microsoft Security Essentials flashed up a warning then crashed and a random antivirus programme I've not installed started to pop up lots of strange errors. I rebooted and since then nothing but the internet works. I can't access control panel, system restore etc - All I get is a windows cannot find error rundll32.exe. All of my antivirus, malwarebytes etc aren't working, I get the same error when I try and open them. I can't download anything either. When I click run on anything I download eg Microsoft Security Essentials I get asked which programme I want to open the file with but none of the options work I don't have the windows CD either, my laptop was preinstalled with XP.

Any help would be greatly appreciated!

Many thanks

K

[Kymmy]

Sounds like rundll32.exe is corrupted.. Grab a copy from someone else and put it (I think in your windows directory (could be system32 also) but not done it for ages so can not remember)

Another option is to repair windows using the 2nd repair option.. Boot with your windows CD, ignore the first set up option then once it finds the install it should give you a 2nd option.. You will need to reinstall any updates/SP's afterwards but basically it's a full reinstall but keeps your old settings/programs/files..

Either way you'll still need to fully scan the PC afterwards (the programs should worl again with rundll32.exe back.)

you may be able to copy it over in safe mode. Do you have an xp cd?

find attached a 32 bit rundll32.exe from an integrated XP sp3. Unzip it first. if it does not allow you to copy it over we will have to find another way either booting from xp cd or something else

It may be worth backing up and recovering the laptop anyway

[Kymmy]

NOt in a place with an XP pc otherwise would have attached it myself

@ Zing

could this problem not be the av virus that's doing the rounds at the moment ,i had exactly the same problem a few months back it shuts down all the security center stops web pages opening .I was using ms essentials at the time ,now i'm using virgin media security i still get the attacks but the firewall does block it ,also the scan will remove it

[Matty_]

If Zings attached doesn`t work there should hopefully be a copy in the C:\Windows\system32\dllcache or in C:\Windows\servicepackfiles\i386 which you can drag and drop to the C:\Windows\system32 folder.

Good luck

[Dai]

See if you can boot into safe mode. If you can get there it may be possible to run malwarebytes. It does depend on the rogue software and how clever it is. If you're lucky it won't be running in safe mode and you'll regain some control.

is the malware still throwing up warnings if so what is it called?

You will either need to run rkill to stop it from running and rename the malwarebytes exe to get that to run or at the least rename malwarebytes

I missed the bit about random av program.

You may need to change some internet settings to get back online and you may need to create a new user to get rid of the rundll problem

It makes more sense now and have seen this often this year.

Originally Posted by zing

is the malware still throwing up warnings if so what is it called?

You will either need to run rkill to stop it from running and rename the malwarebytes exe to get that to run or at the least rename malwarebytes

I missed the bit about random av program.

You may need to change some internet settings to get back online and you may need to create a new user to get rid of the rundll problem

It makes more sense now and have seen this often this year.

you did help me out with my av virus problem a few months back ,in my case it stopped any instalation of a new anti virus software capable of removing it so i ended up doing a full re-install .The ops infection sounds very similar to mine ,but if he can install a more powerfull anti virus then it should be possible to remove as i noticed that vm's av will remove it

[PPPP]

You might wish to try this to get to System Restore

http://support.microsoft.com/kb/304449

How to start System Restore by using the Command prompt
Note You must be logged on to Windows with a user account that is a computer administrator to complete these steps. To verify that you are logged on to Windows with a user account that is a computer administrator, visit the following Microsoft Web site:
http://support.microsoft.com/gp/admin (http://support.microsoft.com/gp/admin)
If a new program has made your computer behave unpredictably, and uninstalling the new program did not help, you can try the Windows XP System Restore tool.

Important If you have not previously set a restore point in System Restore, you cannot restore your computer to a previous state. If you are not sure, or if you have not previously set a restore point, contact Support.

To start System Restore using the Command prompt, follow these steps:
>Restart your computer, and then press and hold F8 during the initial startup to start your computer in safe mode with a Command prompt.
>Use the arrow keys to select the Safe mode with a Command prompt option.
>If you are prompted to select an operating system, use the arrow keys to select the appropriate operating system for your computer, and then press ENTER.
>Log on as an administrator or with an account that has administrator credentials.
>At the command prompt, type %systemroot%\system32\restore\rstrui.exe, and then press ENTER.
>Follow the instructions that appear on the screen to restore your computer to a functional state.


Note To start the System Restore tool using another safe mode option, visit the Microsoft Help and Support Web site and see the article "A description of the Safe Mode Boot options in Windows XP." For additional information about the Safe mode with a command prompt, click the following article number to view the article in the Microsoft Knowledge Base:
315222 (http://support.microsoft.com/kb/315222/ ) A description of the Safe mode boot options in Windows XP