Corrupt rundll32.exe

[LA_MERC_goose]

Windows XP SP2

Had an issue with the Windows Pro AntiVirus crap and finally got it installed. Now I can't get sh!t to run without getting;

Application not found

C:\Windows\system32\rundll32.exe


I've run expand from the XP install CD and copied the file from my computer to his, rebooted, and still get the same message. I've tried to run expand from his computer but since the rundll32.exe is hosed it doesn't recognize expand or any of the programs installed. Hell, I can't even get to the properties from my computer ...

Guys, I need some help on this one.

[LA_MERC_M@lACHi]

Is the file there? Will the computer run syscheck?

[LA_MERC_goose]

The file exists.

Nope, won't run syscheck, regedit, expand ... all command line commands produce the above error.

[LA_MERC_Onji]

can you run any program at all that ends in .exe ?

[LA_MERC_goose]

When I do it asks me what program do I want to open it with. I got Adobe to open but IE won't

[LA_MERC_Onji]

When I do it asks me what program do I want to open it with. I got Adobe to open but IE won't

ok i had this exact same issue way back when. do this. You have to change a registry value back to what it was before, basically a virus changed it on you.

To do this, you have to run regedit, but you cant because its an exe file. You need to browse out to where regedit is. Its in the root of c:\windows\

find regedit.exe and right click and rename it to regedit.com (be sure you have extensions turned on so you can see them.)

Now double-click regedit.com and the registry thingy will start.

Browse to this key directory:
HKEY_LOCAL_MACHINE\Software\Classes\Exefile\Shell\ Open\Command

Now on the right hand side for XP you should only have one key in there 'Default' If you have any more DELETE them.

Make sure the value(data) for Default is: "%1" %* exactly like that, no space before or after it.

IF THERE IS ANYTHING ELSE FOR THE VALUE, CHANGE IT TO THE ABOVE

Here is how it should look when you're done.
http://www.lamerc.com/uploads/exefix.jpg

After you fix it, exit the registry, rename the regedit.com back to regedit.exe
and reboot.

[LA_MERC_goose]

WINNER, WINNER, CHICKEN DINNER!

Thanks Onji. That was the trick. It had a value infront of the "%1"%* of C:\Windows\system32\desot.exe and there was a space between the second " and the second %. Rebooted and it seems to be working correctly.

I'll have to send you some goodies in the mail.

[LA_MERC_th33_r00k]

You are not done. You might want to scan that thing 6-ways to Sunday.

[LA_MERC_goose]

I done did dat.

[LA_MERC_Onji]

WINNER, WINNER, CHICKEN DINNER!

Thanks Onji. That was the trick. It had a value infront of the "%1"%* of C:\Windows\system32\desot.exe and there was a space between the second " and the second %. Rebooted and it seems to be working correctly.

I'll have to send you some goodies in the mail.

awesome! glad it worked out for you. i pulled my hair out when it first happened to me, but i'll be damned if i was gonna format lol

[LA_MERC_goose]

I really didn't want to format his drive ... he's got a lot of siht on that computer, work related. Thanx again, D.

[LA_MERC_M@lACHi]

Very good find Onji! I will have to put that in my cheat sheets.