windows cannot find recycier/system.exe, trying to access mapped drive on network

knightfrank
knightfrank used Ask the Experts™
on
We have numerous drives on the network i can access this drive which is drive n:\ however this user cant.
I have re-imaged unmapped and re-mapped however still cant access.
The drive is setup so this user can access it straight away through group policy.

Please see the print screen which occurs when she tries to access her n:\ drive.

I can access it so can 20 other people.
whatis-this.xls
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
the recicier/system.exe seems to point towards a malware infection. there are several known malwares that cause this.

as you've stated that you've re-imaged and the problem persists, i would start by scanning the network share in question (from a clean machine), and also the image itself. also, check for any USB flash disks connected to the computer in question, as some of the known baddies that do this like to propogate on flash disks.

Author

Commented:
Image is perfect as i have used the same image on 3 other P.C's that day after this image and they do not have this problem. We sit behind hardware firewalls and corporate end point secuirty and also have end point protection on all servers. problem is still there. Virus scanners etc come up with nothing
here's a possibliity :

check the registry on that system, and do a search for "RECYCIER". you may find a reg key that looks a bit like this one :

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f297b52e-61ea-11dd-a617-0019211cb82a}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCIER/system.exe

bear in mind that on your system, the part {f297b52e-61ea-11dd-a617-0019211cb82a} will likely be different on your system, and may in fact simply be "N".

this registry key is causing a particular mount point (a drive attached to the system, a network drive, whatever) to have a command associated with it. in this case, the command is rundll32, attempting to open recycier/system.exe

i found this on google, not as a proposed solution to your problem or indeed any problem, but simply in a bunch of registry data that somebody posted. it shows the rundll32 recycier/system.exe being attached to a mount point in the system, and logically this would cause the problem you're experiencing if said mount point were to be accessed.

so my money is on finding and deleting this registry key, as the solution to your problem.

Learn Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

Author

Commented:
OK Thankyou that stopped that error however now i get the following error. See attached print screen. I have tried to re-map etc and set by gp update but still get the new message.


reg.xls

Author

Commented:
i tried to re-map drive and now get the original error again...  
delete not just the registry key mentioned above, but also the "autorun" and "shell" parent keys. then look for the value "_autorunstatus" in the right hand pane, and delete that as well. all that should be contained within your main registry key for that mount point is the "baseclass = drive" value.

Author

Commented:
sorry i dont understand. How am i to get the parent keys? Have done full search for RECYCIER and only have the 1 key and deleted it.

Author

Commented:
Here is print screen. do u mean delete the shell folder key and the auto run key under the highlighted folder
whatis-it2.xls

Author

Commented:
Awesome that was it. the autorun and the shell and also the command. As soon as they were deleted i got access back straight away.
Thankyou

Author

Commented:
Thanks Statick001

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial