Laptop problem.

Jockanory

My daughter has arrived home from university with a major problem on her laptop,which is a Dell inspiron 6400 with a windows xp operating system.
Although she is connected to the internet neither firefox or IE will bring up any web page,she cannot run any programmes and she keeps getting an error message "C:windows/rundll32.exe,application error".
I cannot get into her system restore and i have also tried rebooting all with no success.
I am at a loss what to do,any help advice greatly appreciated.

jaygomez

Try this fix

Download and run the EXE File Association fix.

Jockanory

Thanks for the reply,I saw that 'fix' posted elsewhere when I 'googled' the problem earlier, the problem at the moment is trying to get onto the web page to download it as although we are connected to the internet I cannot get either firefox or IE to work.

Donnie

Jockanory wrote: »

Thanks for the reply,I saw that 'fix' posted elsewhere when I 'googled' the problem earlier, the problem at the moment is trying to get onto the web page to download it as although we are connected to the internet I cannot get either firefox or IE to work.

Guessing you are using another computer..... USB drive?

imaginarynumber

Jockanory wrote: »

My daughter has arrived home from university with a major problem on her laptop,which is a Dell inspiron 6400 with a windows xp operating system.
Although she is connected to the internet neither firefox or IE will bring up any web page,she cannot run any programmes and she keeps getting an error message "C:windows/rundll32.exe,application error".
I cannot get into her system restore and i have also tried rebooting all with no success.
I am at a loss what to do,any help advice greatly appreciated.

I have seen this after deleting variants of the scummy antivirus2010.

The registry key recommended by Jay should help- particularly if when you try to open programs it brings up a dialougue box asking what program windows should use.

Then shut down and go into safe mode by pressing the f8 function key before you see the windows splash screen.

Hopefully there you will have access to restore points (via start>programs>accessories>system tools)

Then reboot and run your av program

jaygomez

Use another computer (like the one you are using to reply here) to download the file then transfer it to the laptop using a USB drive or memory card then run it from there.

Jockanory

I've got it up and running although its quite slow at present,i've managed to download MSE and currently doing a scan to see what that reveals,tomorrow i will post a hi-jack this log, for some further advice.
Thanks to everyone so far for the advice,keep it coming,as I'm sure i will need it.

Jockanory

After a lot of head scratching I've got my daughter's laptop back on-line and fingers crossed virus free.
Here is a hi-jack this log,any further advice about what else should be removed and any other advice about security,currently running MSE and also got CCleaner and Malwarebytes on the desktop for use.
Would be greatly appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:04:01, on 15/07/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Defraggler\Defraggler.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Microsoft Security Essentials\msseces .exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: profitmuse - {2dfab3bd-ae70-832b-6ce0-b33f29a92284} - C:\WINDOWS\system32\1703f4.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 5049 bytes

imaginarynumber

After a very quick look I cannot see anything bad there but if you had a rootkit running it wouldn't be listed anyway.

I would recommend downloading a trial version of Prevx and running that. It will not delete anything in free mode but it will flag things that many other AV programs are too afraid of flagging for legal reasons.

Might also be a good idea to download the sysinternals suite of progs form microsoft

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

Included will be a rootkit revealer, run that and see what it comes up with.

DO NOT delete anything yet- there are a couple of legit keys that rootkit revealer highlights as suspicious. Post results or google them.

The suite is great- includes programs such as autoruns which shows all of the programs that load at start up. A great tool for pruning the start up

dogmaryxx

Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010. If you are running Windows XP SP2 after support ends, you will not receive security updates for Windows. To keep your Windows XP computer up-to-date download Service Pack 3 through Windows update now.

Jockanory

Thanks for the replies,I will look into your advice,already downloading the SP3 pack now that she's back on-line!!! thanks