Member Avatar for EPhantom

so I"m at my friends house and her old laptop died and she had to get a new one. the old one used to not be able to open internet explorer (I found closing a suspicious process fixed that problem) but now there are two more problems (one possible extra that will be determined afterwards) that need to be solved.

When I try to open anything in the controll pannel it says that rundll32.exe cannot be found. I read online that there are supposed to be two folders that contain extras of it in them (a dllcache, and windowsbackup) neither of which I could locate. Is there any possiblility that there is an extra copy of rundll32 on the laptop, or do I have to go online/copy it from another computer to replace the rundll32 on the bad laptop? (i was able to locate it manually but I'm guessing it is corrupt and needs to be located, if you don't think it is corrupt please inform me that my diagnosis and prognosis are incorrect and why, I'd like to learn from this too =p )

Also I was going to post more information about the laptop in here, but when I tried to go into "system information", I was propt to indicate what program to open it with... is this due to rundll being corrupt or no? I am guessing that it is due to rundll being corrupt.

one other thing that I would like to know about, is... is taskmannager able to indicate weather a process is a critical system operation or not? I tried to end a process that I wasn't sure if it was a critical system process (ending it and it being a crit would cause a bsod, ending it and no bsod meaning it is probably a virus/such) but task mannager told me it was critical.

thank you in advance :)

  • 3 Contributors
  • 5 Replies
  • 256 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

A short, pragmatic diagnosis and checklist tied to the thread so far.

The symptom set described by — Control Panel applets failing with a rundll32 error while System Information and msconfig trigger an “Open with…” prompt — most commonly means two separate but related problems: a system file (rundll32.exe) is missing or tampered with, and Windows’ file-type registration for executables/MSC/CPL handlers is damaged (often malware-caused). Rundll32 is a normal Windows host program kept in the System32 folder and is used to invoke exported DLL functions; a rogue or misplaced rundll32 is a red flag. (learn.microsoft.com)

Practical checks (in order)

  • Confirm a legitimate rundll32.exe exists in the OS System32 folder and that any duplicate copies are not running from other locations; unsigned or oddly-located copies are suspicious. Use a signature/metadata tool (Sysinternals Sigcheck or Explorer’s Digital Signatures/Details) to verify publisher and version. If a replacement is needed, copy only from a matching Windows XP build (same architecture and service-pack level) or restore from known-good media — avoid random download sites. (learn.microsoft.com)

  • The “Open with…” behavior usually points to broken .exe/.msc/.cpl associations (registry entries that tell Windows how to launch executables and management consoles). Restoring the default association for executables (the HKCR keys that point .exe to the exefile open handler) will usually stop the “choose a program” prompts; if registry edits are uncomfortable, repair via Safe Mode or System Restore first. (learn.microsoft.com)

  • Task Manager’s “critical process” warnings are not a reliable malware test. A safer triage is to inspect suspect processes’ full image path, command line and signature with Process Explorer, and then run an up-to-date anti-malware/AV scan (Malwarebytes + AV). Process Explorer + Sigcheck provide the details needed to distinguish a legitimate system process from an impostor. (documentation.help)

A concise recovery plan

  1. Verify & sign-check rundll32; if corrupt, replace from a matching XP source and reboot. 2) Restore default executable associations (backup the registry first) or use System Restore if available. 3) Run an offline/full AV + Malwarebytes scan and inspect processes with Process Explorer. If registry or system-file damage is extensive and no install media exists, create recovery media or seek a repair install (matching XP media required) or professional service. (majorgeeks.com)

Notes and cautions

  • Avoid downloading individual system executables from random websites; mismatched versions cause instability.
  • Always back up the registry before edits and work from Safe Mode or recovery media when core associations are broken.
  • The suggestions from and (use of SFC/install media and checking alternate copies) are on point; they should be combined with signature checks and careful registry repair as described above.

Recommended Answers

All 5 Replies

Member Avatar for unikat

Anyway stupid question, have you tried using search for rundll32?
I found it in few locations on my pc, among which is one of those hidden folders C:\WINDOWS\$NtServicePackUninstall$ as well as
C:\WINDOWS\system32
C:\WINDOWS\ServicePackFiles\i386

Most viruses are actually hidden from task menager.
Even if they show up, sometimes they are masked as critical or can't be closed, or just start again.

Edited by unikat because: n/a
Member Avatar for gerbil

Insert her XP installation cd, go Start, Run, and enter:
sfc /scannow
That should replace it. It will not be in the caches because WIndows would have already restored it to system32 if it was there.

Member Avatar for EPhantom

Insert her XP installation cd, go Start, Run, and enter:
sfc /scannow
That should replace it. It will not be in the caches because WIndows would have already restored it to system32 if it was there.

Can't do that, she didn't recieve any OS CD's when she got her laptop.

So... that being the case... Is the only way for me to get a new rundll32 on her old laptop, to copy the one on the new laptop/download a new one, and transfer it over to her old one? or will the Win7 version of rundll32 different from XP, or does it not exist on Win7?

(she doesn't want me to do much on this laptop because her dad is still upset that the other one is dead... one reason why I want to get the old one back up and running again)

Member Avatar for EPhantom

I just tried to check the startup processes through
Start>Run>MSConfig
but when I try to, it promps me to choose what to open the file with... is this due to rundll.exe being missing?

Member Avatar for gerbil

Rule 1 - ALWAYS get the installation cds with any computer bought. ALWAYS. Often it is intended that you create a restore set as an initial step when you buy the sys; this is not the same, they are not as useful. You've paid for the OS, make sure you get the disk.
Any matching OS installation cd will do as a source for rundll32.exe. I do not know about W7. but you could copy the file from any XP cd or installation. Run this command if on an installation cd: [D:\ is the disk drive..]
expand D:\i386\_ c:\windows\system32\rundll32.exe
...else copy it from where you found it to c:\windows\system32
Rundll32.exe is not involved in the launching of msconfig.exe, likewise hlpcntr.exe [system information]. It is involved only if a dll is called by your interaction..eg by using a command or user interface. An example would be when you open the date/time interface [the clock] - timedate.cpl is called. Generally, programs handle the dlls they use themselves without using rundll32.exe.
From your last post it seems that some file associations in registry are damaged also; run this:
Such broad damaged could have been caused by malware.... where did you find the copy of rundll32.exe?
Task Manager does not tell you if a process is critical to the system or malware. It just lists running processes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.