?
Solved

C:WINDOWS\System32\rundll.exe  appears

Posted on 2007-08-04
6
Medium Priority
?
1,737 Views
Last Modified: 2013-11-05
when I try to open or change accounts etc this windows appears.
I tried to restore and it asked for adminstrator pass word,when I put my password in it failed and only get three goes . how can I search regedit to reset password as the only option is to reformat  
0
Comment
Question by:breretonms
6 Comments
 
LVL 59

Assisted Solution

by:LeeTutor
LeeTutor earned 180 total points
ID: 19630589
This site allows you to download files needed to create a bootable floppy disk or CD-ROM which contains a program that can be used to reset passwords on a Windows NT-based OS (such as WinXP and Vista):

http://home.eunet.no/~pnordahl/ntpasswd/
Offline NT Password & Registry Editor

0
 
LVL 39

Assisted Solution

by:BillDL
BillDL earned 240 total points
ID: 19631056
Just for your info, breretonms, many of the Windows XP Control Panel applets use Web Page format to display the "dialogs".  Where in earlier Windows 9x versions such control panel applets (*.cpl files) are proper dialogs, Windows XP makes use of Internet Explorer components to display them.

In this case, the file C:\Windows\System32\nusrmgr.cpl is the control panel applet called to display the main user manager window where you would select a user account and then the option to modify it.

You say that a window appears showing C:\Windows\System32\Rundll.exe

This is strange, because Rundll32.exe should be calling it and not Rundll.exe.  The command to open any *.cpl file is (using nusrmgr.cpl as an example):

rundll32.exe shell32,Control_RunDLL nusrmgr.cpl

Another (and better) command to open user accounts in Windows XP is:
control.exe userpasswords
You can also open the User Groups Management Console with the command:
lusrmgr.msc

Try these once you get your administrator password reset and see if you can access the user accounts page.  There may be something else going on with your computer that needs to be addressed.
0
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 330 total points
ID: 19631141
Are you able to do anything else in that pc? delete files, run a scan etc.

C:WINDOWS\System32\rundll.exe <-- this is Mytob worm,

when able to,
Look in your registry on these keys,
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

and delete this values:
Windows RunDLL32
rundll.exe

C:WINDOWS\System32\rundll.exe <-- delete this file, and scan your pc when you are able to.

It can also modify your hosts file, so check and make sure that security sites aren't blocked there.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:breretonms
ID: 19633745
thank you all for your replys, when I try to open a program such as run, it opens a window asking to chose what  program to select to open it with.I can browse but I don't know where to look for the file to open regedit,  When I tried to run digital patrol, the program could not open the drives.
0
 

Author Comment

by:breretonms
ID: 19633756
thank you all for your replys, when I try to open a program such as run, it opens a window asking to chose what  program to select to open it with.I can browse but I don't know where to look for the file to open regedit,  When I tried to run digital patrol, the program could not open the drives.
0
 
LVL 39

Expert Comment

by:BillDL
ID: 19635118
Thank you breretonms

From what you have said, some malware has definitely been messing around with your file associations.  A file association is the program set in the registry to open files of a certain type.

To fix these associations, you need to be able to open Regedit.  You will find a good tip at the top of this page:
http://www.dougknox.com/xp/file_assoc.htm
which tells you how to open Regedit.

Below that, on the same page, you will find links for a lot of Windows XP File association fixes.  I recommend that you download and unzip them to separate folders.  Once you have regedit open, you can use the File > Import menu and then browse to the *.reg files.

I suggest you go first for the *.exe and *.reg association fixes:
http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip
http://www.dougknox.com/xp/fileassoc/xp_regfile.zip

After that, you should be able to Right-Click on a *.reg file and choose "Merge" to write it to the registry.

You will then be able to get some idea what other file type associations have been messed up, and you should follow the advice by rpggamergirl who believes as I do that you have a virus.

Often malicious software like a virus can disable your installed anti-virus program, so I suggest that you uninstall it, reboot, re-install and update it over the internet, and then perform a full system scan.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Create your own, high-performance VM backup appliance by installing NAKIVO Backup & Replication directly onto a Synology NAS!
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question