Rundll32 ?'s

[adams]

my friend managed to get a trojan (started with an n) and i think it infected his rundll32 file. since when you go to msconfig > startup tab > it shows a file that starts with an N then in the next column it says rundll32 then in the next column it has the reg entry i guess.

now his av caught it and supposedly removed it, then he ran x-cleaner and it found a few more bad files and he let it remove them too.

Now he can't get on the internet, it just comes up with a page cannot be displayed also can't check his email. His SBC/yahoo connection manager shows it as being connected.

He is running xp pro
800MHz cpu
at least 256MB ram
(its an hp computer)


Can anyone help me with the information here?

i think he is going to reformat and put ME on it for the time being, but I though if I could fix it I'd save him the trouble of formatting. thanks.

[unicorn]

If no specific help is oit there, why not just reinstall from within the OS he is running now? He will have to tweak and adjust a few things but it must be easier than start from scratch.

[wase4711]

have him try and run Trojan Remover, to see if that helps..
having a corrupted rundll32 is usually the kiss of death though....

[MonkeyMagic]

Hi There,

You should run http://us.mcafee.com/root/mfs/default.asp?cid=9059 to see if there are any potential risks lying about.

Also try reinstalling your TCP/IP-NIC-Modem drivers, as they may have been corrupted by the Trojan Virus.

Another thing to try is reinstall your Internet Explorer from http://download.microsoft.com/downlo...S/ie6setup.exe.

Also try searching for the Trojan in http://vil.nai.com/vil/default.asp

I hope it helps.

Kind Regards,

The Magic Monkey