so I"m at my friends house and her old laptop died and she had to get a new one. the old one used to not be able to open internet explorer (I found closing a suspicious process fixed that problem) but now there are two more problems (one possible extra that will be determined afterwards) that need to be solved.

When I try to open anything in the controll pannel it says that rundll32.exe cannot be found. I read online that there are supposed to be two folders that contain extras of it in them (a dllcache, and windowsbackup) neither of which I could locate. Is there any possiblility that there is an extra copy of rundll32 on the laptop, or do I have to go online/copy it from another computer to replace the rundll32 on the bad laptop? (i was able to locate it manually but I'm guessing it is corrupt and needs to be located, if you don't think it is corrupt please inform me that my diagnosis and prognosis are incorrect and why, I'd like to learn from this too =p )

Also I was going to post more information about the laptop in here, but when I tried to go into "system information", I was propt to indicate what program to open it with... is this due to rundll being corrupt or no? I am guessing that it is due to rundll being corrupt.

one other thing that I would like to know about, is... is taskmannager able to indicate weather a process is a critical system operation or not? I tried to end a process that I wasn't sure if it was a critical system process (ending it and it being a crit would cause a bsod, ending it and no bsod meaning it is probably a virus/such) but task mannager told me it was critical.

thank you in advance :)

Recommended Answers

All 5 Replies

Anyway stupid question, have you tried using search for rundll32?
I found it in few locations on my pc, among which is one of those hidden folders C:\WINDOWS\$NtServicePackUninstall$ as well as
C:\WINDOWS\system32
C:\WINDOWS\ServicePackFiles\i386

Most viruses are actually hidden from task menager.
Even if they show up, sometimes they are masked as critical or can't be closed, or just start again.

Insert her XP installation cd, go Start, Run, and enter:
sfc /scannow
That should replace it. It will not be in the caches because WIndows would have already restored it to system32 if it was there.

Insert her XP installation cd, go Start, Run, and enter:
sfc /scannow
That should replace it. It will not be in the caches because WIndows would have already restored it to system32 if it was there.

Can't do that, she didn't recieve any OS CD's when she got her laptop.

So... that being the case... Is the only way for me to get a new rundll32 on her old laptop, to copy the one on the new laptop/download a new one, and transfer it over to her old one? or will the Win7 version of rundll32 different from XP, or does it not exist on Win7?

(she doesn't want me to do much on this laptop because her dad is still upset that the other one is dead... one reason why I want to get the old one back up and running again)

I just tried to check the startup processes through
Start>Run>MSConfig
but when I try to, it promps me to choose what to open the file with... is this due to rundll.exe being missing?

Rule 1 - ALWAYS get the installation cds with any computer bought. ALWAYS. Often it is intended that you create a restore set as an initial step when you buy the sys; this is not the same, they are not as useful. You've paid for the OS, make sure you get the disk.
Any matching OS installation cd will do as a source for rundll32.exe. I do not know about W7. but you could copy the file from any XP cd or installation. Run this command if on an installation cd: [D:\ is the disk drive..]
expand D:\i386\rundll32.ex_ c:\windows\system32\rundll32.exe
...else copy it from where you found it to c:\windows\system32
Rundll32.exe is not involved in the launching of msconfig.exe, likewise hlpcntr.exe [system information]. It is involved only if a dll is called by your interaction..eg by using a command or user interface. An example would be when you open the date/time interface [the clock] - timedate.cpl is called. Generally, programs handle the dlls they use themselves without using rundll32.exe.
From your last post it seems that some file associations in registry are damaged also; run this: http://www.dougknox.com/xp/file_assoc.htm
Such broad damaged could have been caused by malware.... where did you find the copy of rundll32.exe?
Task Manager does not tell you if a process is critical to the system or malware. It just lists running processes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.