[Jacqui_65]

I am unable to open up any microsoft office icon from the desktop, however can open the programmes via Documents from the Taskbar or from an attachment to an email. I also cannot access add/remove programme on the Control Panel or download any application, as when I do it comes up with the file association box or a missing rundll32.exe missing dll message. Can someone help.

Hijack log attached

Logfile of HijackThis v1.99.1
Scan saved at 10:40:36 AM, on 14/03/05
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\Program Files\Navnt\defwatch.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Navnt\rtvscan.exe
C:\WINNT\System32\rconsvc.exe
C:\WINNT\system32\RpcSs.exe
C:\WINNT\system32\tapisrv.exe
C:\WINNT\system32\rasman.exe
c:\winnt\system32\pstores.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\suSS.exe
C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe
C:\WINNT\System32\WBEM\winmgmt.exe
C:\WINNT\Explorer.exe
C:\PROGRA~1\Navnt\vptray.exe
C:\WINNT\System32\loadwc.exe
C:\Program Files\RFA\rfagent.exe
C:\PROGRA~1\Plus!\MICROS~1\iexplore.exe
C:\WINNT\System32\ddhelp.exe
C:\WINNT\Profiles\administrator.001\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.sma...t/7search/?hklm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\Navnt\vptray.exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\VCOM\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\PROGRA~1\Plus!\MICROS~1\Plugins\NPDocBox.dll
O13 - WWW. Prefix: http://
O16 - DPF: Win32 Classes -
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Navnt\defwatch.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Microsoft Find Fast Service (FindFastNT) - Unknown owner - C:\Program Files\Microsoft Office\Office\ffnt.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Navnt\rtvscan.exe
O23 - Service: Remote Console (RCONSVC) - Unknown owner - C:\WINNT\System32\rconsvc.exe
O23 - Service: SystemSuite Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe

[Advertisements]

If you're running XP, type rundll32.exe in the search field and see if it's truly missing on your hard drive. If it is, type sfc in the run command line and let it replace the file for you (provided you have the XP installation CD).

[pip22]

If you're running XP, type rundll32.exe in the search field and see if it's truly missing on your hard drive. If it is, type sfc in the run command line and let it replace the file for you (provided you have the XP installation CD).

[Jacqui_65]

rundll32.exe is on my hard drive in c:\winnt\system32

[macten]

pip22....I'm curious about rundll32.exe. What's it's purpose? What does it do?

[SofaKingSmart]

I am having a similar problem as Jacqui. I was trying to track down some Spyware on my C: and I inadvertantly deleted my Explorer.exe file - now I cant open any folders or icons on my desktop. Needless to say, I have spent many sleepless nights trying to track down a substitute on the Internet but no such luck. I am currently running Windows 2000 Professional and unfortunately I do not have the installation disk anymore, and to add to the problem I have a lot of software that is installation diskless as well. Any help would be much appreciated. Thanks!

[peterm]

All you need to do is have some one copy the explorer exe file from their own
copy of 2000 pro. and copy it to your hard drive At current I am running Server 2000 so I can't give you the file> If you really get stuck let me Know and I will
try and get the file for you. it should be in c:\winnt
cheers
peterm

[peterm]

Jaqui
Are you running windows NT 4 and which one
Nt 4 Server or workstation?
Cheers
peterm

[peterm]

Hi Jacqui
Can you make the error message come up then take a screen shot -
Press print screen & send me the file. I need to see the exact message
so I have a better change of working what is going wrong.
Cheers
peterm