0

A virus infected my PC - I'm pretty sure that the rundll32.exe file and its backup was replaced.

What can I expect if I'm right about it affecting rundll32.exe and how can I fix it without the backup? I have Windows Vista preinstalled on my computer so I don't have the installation disk - are there any backups to rundll32.exe other than inside the x86 folder?

The reason I suspect my rundll32.exe is that whenever I log in, the rundll32.exe process attempts to open two viruses that I was able to get rid of. Here is the sfc scan details:

2011-05-29 17:15:45, Info    CSI    0000013d [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:15:52, Info    CSI    0000013f [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:17:21, Info    CSI    0000015e [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:17:25, Info    CSI    00000160 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:21:07, Info    CSI    000001b8 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:21:07, Info    CSI    000001ba [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:21:07, Info    CSI    000001bc [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2011-05-29 17:21:07, Info    CSI    000001c2 [SR] Cannot repair member file [l:24{12}]"settings.ini" of Microsoft-Windows-Sidebar, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
5
  • There usually is a hidden restore partition. See windows.microsoft.com/en-US/windows7/…
    – GSerg
    May 29, 2011 at 10:39
  • 2
    Personally I think it is extremely unlikely that specifically-and-only rundll32 has been affected. What has let you to that conclusion? I would strongly recommend reinstalling the OS, by whatever means available.
    – bobince
    May 29, 2011 at 10:45
  • I am pretty darn sure. If you posted an MD5 hash of your rundll32.exe (& your SP level), other Vista users could compare their copies, & if they agree, then you would know that your copy was valid. If they do not agree, you'd need to investigate further.
    – therube
    May 29, 2011 at 13:15
  • rundll32.exe in /windows/system32/ & the version in C:\Windows\winsxs\... are one in the same, they are hardlinked files. Conceivable I suppose that malware could have broken the link & you have two different versions now. So check to see if they compare. If they differ that gives you a clue that something is amiss.
    – therube
    May 29, 2011 at 13:20
  • 1
    Reformat, it's not worth fixing a corrupted system. And just an FYI, you might want to use Microsoft Security Essentials as your next AV (it's free, and made by the people who made the OS). If you don't have your installation media, get some from "the usual places" and install using the serial number that should be on the side of your computer (you can legally do this). While formatting may not be completely necessary, I personally wouldn't take the chance, and you might find it gives you less headaches. May 30, 2011 at 2:18

1 Answer 1

1

Run a System File Checker, it will replace the file for you. This works for XP, Vista, Windows 7

.

Use the System File Checker tool (SFC.exe) to determine which file is causing the issue, and then replace the file. To do this, follow these steps:

Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.

Type the following command, and then press ENTER:

sfc /scannow

The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions. XP may ask for the XP installation CD to be inserted.

The following is for Vista and W7 only

To determine which files could not be repaired by the System File Checker tool, follow these steps:

Open an elevated command prompt. Type the following command, and then press ENTER:

findstr /C:"[SR] Cannot repair member file" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Note The Sfcdetails.txt file contains details from every time that the System File Checker tool has been run on the computer. The file includes information about files that were not repaired by the System File Checker tool. Verify the date and time entries to determine the problem files that were found the last time that you ran the System File Checker tool.

Type the following command, and then press ENTER:

edit sfcdetails.txt

.

Source Of Information

.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .