# [Resolved] windows cannot find 'rundll32.exe'



## evermrod (Jan 4, 2003)

hello guyes,
i'd like to thank you for this great site.

my problem is that whenever i try to open system,add&remove program and many other files,a window appears with this message:'windows cannot find 'c:\WINDOWS\rundll32.exe'

previuosly,i couldn't open ANY file but this was partly solved when i installed 07-102.inf file as advised by annoyance.org they diagnosed it as 'infection bt a virus'

i;m attaching a startup report


----------



## TonyKlein (Aug 26, 2001)

Hi, and welcome to the board.

For a start, you've got the W32.Yaha.K Worm

Bitdefender has issued a removal tool. 
Download and run it, preferably in Safe Mode.

Symantec has one as well

As for your rundll32.exe error, restore a fresh copy of the file to your Windows directory:

How to extract files in Windows 95/98/Me/2000/XP


----------



## evermrod (Jan 4, 2003)

hi tony,
thanks for your advice.
actually,i followed it ferom a-z unfortunately,anti yaha was unable to clean 15 infected files &still the same message popping in trying to open system icon in control panel
also icouldn't extract the error file as the very same message appeared eventually.


----------



## Rollin' Rog (Dec 9, 2000)

Has the screen saver been turned off and the love.scr file deleted?

SCRNSAVE.EXE=E:\LOVE.SCR

You should also run *system.ini* for it to open in Notepad and delete that line.

You may need to re-run the yaha removal tool if this program has been re-executing as it could be reinfecting the system.


----------



## TonyKlein (Aug 26, 2001)

Also check whether you still have the C:\WINDOWS\SYSTEM\WinServices.exe file.

If you do, start up in Safe Mode, and delete it. Next, go to Start > Run > Msconfig, and uncheck the two instances of Winservices you're likely to find there.

Also, did you try running the exefix?


----------



## evermrod (Jan 4, 2003)

hi Rollin'Rog
thanks for help
the situation now is:
1. I've already deleted love.scr few days ago.

2.Before opening love.scr in my e-mail,screen saver was turned off.Now when I tryed to check,display icon didn't open and the same message appeared.

3. I've just deleted that line in notepad.

4. Antiyaha [bitdefender] failed to delete 15 infected files . Fixyaha [Symantic] recquired disabling system restore;still i was not able to open it nither from control panel,nor from desktop computer icon; that message was there.

5. Worsestill,icouldn't run misconfig !


----------



## Rollin' Rog (Dec 9, 2000)

check your spelling there, that's *msconfig*

And have you tried running that in Safe Mode? Do you get the rundll32 error when trying to open it?

Here is how to "clean-boot" the system using msconfig:

http://www.itc.virginia.edu/desktop/pc/win-me/cleanboot.html


----------



## evermrod (Jan 4, 2003)

Hi Tony,Rollin'Rog
Thanks for help
C:\WINDOWS\SYSTEM\WinServices.exe doesn't exist.
Is"exefix" an online download? I tried running it from 'start' but it doesn't exist.
I corrected my spelling and ran"msconfig" in Safe Mode. I'm not sure which is referred to as "it" in "trying to open it".I got rundll32 error.

I tried to "clean-boot" the system using msconfig but it didn't work.


----------



## Rollin' Rog (Dec 9, 2000)

You can try the exefix08.com file from Reticulated Toys. That's a good one for WinME and lower.

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Did you check to see whether you have rundll32.exe in c:\windows ?

We need to get you a new copy if you don't have it. In WinME, there are usually cab files on the drive at either:

c:\windows\options\cabs or

c:\windows\options\install

rundll32.exe would be in win_17.cab: http://support.microsoft.com/servicedesks/fileversion/moreinfo.asp?Id=192112

You could simply use Winzip to open this cab and then copy the file to c:\windows

Otherwise I might be able to give a DOS prompt command to get it, but I'm not sure how this will go from within Windows. It would probably be this:

extract c:\windows\options\cabs\win_17.cab rundll32.exe /l c:\windows

extract^c:\windows\options\cabs\win_17.cab^rundll32.exe^/l^c:\windows

In this last, the ^ signifies where a space goes.


----------



## evermrod (Jan 4, 2003)

Hi,

Sorry for the delay;it was out of me.I couldn't dial up a new cnnection as my ISP cut the service, and as a result of the virus I couldn't dial up a new connection.

Eventually,Ihad to format my disk to get rid of the damn virus.

Now,every thing is OK.

I realy appreciate your care to help .Many Thanks


----------



## Rollin' Rog (Dec 9, 2000)

Well, glad to hear you're up and running again, one way or another. You are certainly welcome for our efforts


----------

