Edit: 5th Dec ‘08: I have dropped in a line to McAfee’s Webimmune service and submitted the symptoms and the manifestations of the virus. Expecting a reply soon.

A request: Please read the whole post carefully and the second post too..Be assured i removed this virus in my PC and you can too..I have edited this post to write this because some readers have responded that they were unable to remove the virus. I have written my experience here with the rundll32.exe virus and the steps i took to remove it. I will try to help you in case this doesnt work. Good Luck!

FOR SOFTWARE ALSO READ: How To Remove Virus Affecting rundll32.exe: Part 2

HAS THE ICON OF rundll32.exe FILE TURNED INTO A PAGE TYPE ICON? THEN READ ON..

First, The Story: I am working on my project work at ISRO,Ahmedabad. I was allotted a PC which was relatively new and the company guys who maintained the PC had installed Windows Server 2003 OS with NO anti virus software..Can you believe that?? Some trainees worked on the PC for two months before me but none of them bothered to install anti-virus software.The very next day i brought my McAfee Setup from my home PC.McAfee ROCKS! I tried to install it but i got a FEAD error..couldnt figure it out then. I tried to install Adobe Reader 8 and got the same error. Then finally i got AVAST Server Edition from a friend. But every anti-virus software is as good as its updates.

So finally i was stranded in a world full of viruses! Some days back when i booted the PC in the morning, it showed all the following signs of virus:

I tried to click the existing shortcuts and got an APPLICATION ERROR: Coudnt find C:\Windows\system32\rundll32.exe

Try creating new shortcut: same error..

My Computer> Properties> Same error

Add-Remove Programs>Same error

Help and Support>Same error ..that meant i couldnt restore it too

I was really scared.It meant i couldnt install any new anti virus or anything else..nor could remove.

The only solution in distant horizon appeared to be the one horrible word – FORMAT..I hate this.

I was just wondering since how come the virus showed up suddenly.I had not inserted any pen drive that day.Then i remembered. Its my habit to HIBERNATE. I rarely  SHUT DOWN my PC.The previous day in a hurry, i had not allowed it to hibernate properly and so it restarted next day instead of resuming windows.

SO THE SYMPTOMS:

Check this file C:\Windows\system32\rundll32.exe

It is an application so it should have the usual app symbol. But now the virus had turned its icon into a  page.  See the image

WHAT I DID TO REMOVE THE VIRUS??

1. There exists a copy of all the dlls in the following location: find a copy o f rundll32.exe here

C:\windows\system32\dllcache

I found one and its size was approx 68 kb .As seen in image, the size of  infected files is 32.5 kb.

I copied it and pasted to replace the infected files and within seconds my copied file’s icon got changed too.

SO I  figured out that some file was continuously running in the background to modify these files.

2. So i searched( thankfully search was not disabled) for files modified, created and accessed the day before.

Paying particular attention to the files  modified, created and accessed in windows folder.

I found certain files and folders satisfying the criteria. I was not sure what they did. When i right clicked them, the properties showed UNKNOWN APPLICATION. So i was pretty confident that these much be the virus related files.

I cut and pasted the following folders: (so that if something malfunctions and it doesnt turn out to be the virus..DONT REMOVE THEM>>INSTEAD CUT AND PASTE IN LOCATION OTHER THAN WINDOWS..better still in another drive altogether)

C:\Windows\system32\ NTMS DATA                 ( FOLDER)

C:\Windows\system32\DRIVERS\ETC                ( FOLDER)

C:\Windows\system32\FNTCACHE.DAT            (FILE)

3. Then i created a shortcut in system32 folder itself and gave the path to the unaffected DLL file..( creation of shortcut was disabled only on desktop)

I m not sure which of these worked. But after carrying out all these steps ..

I m not saying that the files i suspected are viruses.THey may be some files but they had been modified and so i moved them to another location.

It worked for me though..GREAT RELIEF

Like everyone i first searched up the matter but dint find any useful information except something like HIJACK which was pretty advanced stuff and i dint want to find myself trying to revive the PC instead of doing my project coding.So i tried some real BASIC STEPS .I hope this is helpful for you.

And yes do drop me a comment on whether this works or not.

EDIT: In response to confused’s comment:

Please see the following screenshot which clearly shows how rundll32.exe file should look like. An exe file should have an application icon not a page icon.

HELP ME HELP OTHERS.