missing srr.exe file in win XP home edition

[chuikingman]

Hi,

I get below error after bootup and login XP .

Window cannot find "C:\documents and settings\chui king man.Chui-0BECB5BAFA\srr.exe" .Make sure you typed the name correctly, and then try again.To search for a file, click the Start button, then click Search.

Where is srr.exe and I cannot find it ???

What is the problem ??Please advice

[uid0]

Smells like malware... But at least it's missing malware

I'd make sure your protection is up to date.

You can clear out it's startup entry with autoruns.

Edited January 10, 2010 by uid0

[nitroshift]

Hello and welcome to msfn I second uid0's idea, or you can manually delete the entry from startup by going to Start ---> Run, type "msconfig" without the quotes then uncheck the entry under the "Startup" tab. Good luck!

[cluberti]

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

[chuikingman]

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

I use autorun but it is not work.

The missing srr.exe error is still existed .

Any advice if you know the answer ?????

[cluberti]

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

[chuikingman]

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

I post the hijack log in this .

Please advice whatI can do ???

hijackthis.log.txt

[MrJinje]

Not sure exactly what this line is ???

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

Edited January 14, 2010 by MrJinje

[chuikingman]

Not sure exactly what this line is ???

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

I clean the %Temp% directory .

But the error is still find ....

I attach the latest hijack log in this .

Pleae advice hot ot fix it .....

hijackthis.log.txt

[cluberti]

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

[MrJinje]

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

Edited January 17, 2010 by MrJinje

[chuikingman]

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

Hi,

I disable all the item in startup by starterSetup...

I still get the error "missing srr.exe file " ....

It seem it is not related to the startup ( I use starter setup) .....

Please advice if you know the answer ????

[chuikingman]

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

I create the new account and there is no this error when I login to this new account .

So, the error is not the machine wide ....

Any other suggestion to fix it if you know the answer ???

[MrJinje]

I create the new account and there is no this error when I login to this new account .

LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.

Edited January 17, 2010 by MrJinje

[chuikingman]

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

>>Process Monitor and Process Explorer are in here.

>>http://download.sysinternals.com/Files/SysinternalsSuite.zip

How can I install the above ???it is a bundle of exe file only ???

Any advice how to use them ???