Cannot find the file 'rundll.exe'?

[bsrinivas]

My system is giving the following error message on startup.
"Cannot find the file 'rundll.exe'? (or one of its components). Make sure the path and filename are correct and that all required." I have Windows XP Service pack 2. Can I have any solution for this problem.
-bsrinivas

 

[blueshift]

Some program or trojan virus must have caused the registry change...though not sure about this.

Search for that file in your Windows installation folder. But AFAIK there is only rundll32.exe file in System32 folder...no rundll.exe

To remove that popup windows on startup, goto Run and type regedit
Browse to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
In the right pane check these keys:
Userinit= V:\WINDOWS\system32\userinit.exe
System= explorer.exe

If its other than that like:
Userinit= V:\WINDOWS\system32\userinit.exe; "V:\WINDOWS\system32\rundll.exe somefile.exe"
then remove the extra part after userinit.exe

I dont see any need to have running rundll.exe in startup.
Also check your startup entries in MSConfig.

 

[anandk]

rundll.exe used to be there in 95, 98 and ME.

you are using XP/SP2; in all probabaility its a backdoor vulnerability.

scan with anti virus and anti spy and then run ccleaner.

 

[bsrinivas]

thanks for your response MR. BLUESHIFT and ANANDK.
i edited the registry. the key USERINIT is fine but the SYSTEM key is showing winhelp.exe . i replaced this with exlorer.exe as MR. BLUESHIFT mentioned and restarted the system. but the problem still persists.
i cleaned the registry also. but to no help.

 

[blueshift]

You need to first scan your system with a good antivirus and antispyware as anandk suggested.
Its possible that some other trojan file is running in background and making registry changes after you reboot. Did you check the registry again after restarting? Is that winhelp.exe key still there?
winhelp.exe is in Windows folder having a size of 250 KB (256,192 bytes). Search it. If it's found elsewhere then it might be a trojan.

Post you Hijack this log.