chuikingman Posted January 10, 2010 Share Posted January 10, 2010 Hi, I get below error after bootup and login XP .Window cannot find "C:\documents and settings\chui king man.Chui-0BECB5BAFA\srr.exe" .Make sure you typed the name correctly, and then try again.To search for a file, click the Start button, then click Search.Where is srr.exe and I cannot find it ???What is the problem ??Please advice Link to comment Share on other sites More sharing options...
uid0 Posted January 10, 2010 Share Posted January 10, 2010 (edited) Smells like malware... But at least it's missing malware I'd make sure your protection is up to date.You can clear out it's startup entry with autoruns. Edited January 10, 2010 by uid0 Link to comment Share on other sites More sharing options...
nitroshift Posted January 10, 2010 Share Posted January 10, 2010 Hello and welcome to msfn I second uid0's idea, or you can manually delete the entry from startup by going to Start ---> Run, type "msconfig" without the quotes then uncheck the entry under the "Startup" tab. Good luck! Link to comment Share on other sites More sharing options...
cluberti Posted January 10, 2010 Share Posted January 10, 2010 Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry. Link to comment Share on other sites More sharing options...
chuikingman Posted January 13, 2010 Author Share Posted January 13, 2010 Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.I use autorun but it is not work.The missing srr.exe error is still existed .Any advice if you know the answer ????? Link to comment Share on other sites More sharing options...
cluberti Posted January 13, 2010 Share Posted January 13, 2010 I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance. Link to comment Share on other sites More sharing options...
chuikingman Posted January 14, 2010 Author Share Posted January 14, 2010 I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.I post the hijack log in this .Please advice whatI can do ???hijackthis.log.txt Link to comment Share on other sites More sharing options...
MrJinje Posted January 14, 2010 Share Posted January 14, 2010 (edited) Not sure exactly what this line is ???O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exeTime to clean your temp directory. Edited January 14, 2010 by MrJinje Link to comment Share on other sites More sharing options...
chuikingman Posted January 17, 2010 Author Share Posted January 17, 2010 Not sure exactly what this line is ???O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exeTime to clean your temp directory.I clean the %Temp% directory .But the error is still find ....I attach the latest hijack log in this .Pleae advice hot ot fix it .....hijackthis.log.txt Link to comment Share on other sites More sharing options...
cluberti Posted January 17, 2010 Share Posted January 17, 2010 It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it. Link to comment Share on other sites More sharing options...
MrJinje Posted January 17, 2010 Share Posted January 17, 2010 (edited) Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue. If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings)._____________________________EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.Here is the srr.exe main website.http://rescene.info/download.htmProcess Monitor and Process Explorer are in here.http://download.sysinternals.com/Files/SysinternalsSuite.zip Edited January 17, 2010 by MrJinje Link to comment Share on other sites More sharing options...
chuikingman Posted January 17, 2010 Author Share Posted January 17, 2010 It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.Hi, I disable all the item in startup by starterSetup...I still get the error "missing srr.exe file " ....It seem it is not related to the startup ( I use starter setup) .....Please advice if you know the answer ???? Link to comment Share on other sites More sharing options...
chuikingman Posted January 17, 2010 Author Share Posted January 17, 2010 Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue. If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings)._____________________________EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.Here is the srr.exe main website.http://rescene.info/download.htmProcess Monitor and Process Explorer are in here.http://download.sysinternals.com/Files/SysinternalsSuite.zipI create the new account and there is no this error when I login to this new account .So, the error is not the machine wide ....Any other suggestion to fix it if you know the answer ??? Link to comment Share on other sites More sharing options...
MrJinje Posted January 17, 2010 Share Posted January 17, 2010 (edited) I create the new account and there is no this error when I login to this new account .LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them. Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ?? O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cabO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabAttach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list. Edited January 17, 2010 by MrJinje Link to comment Share on other sites More sharing options...
chuikingman Posted January 17, 2010 Author Share Posted January 17, 2010 Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue. If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings)._____________________________EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.Here is the srr.exe main website.http://rescene.info/download.htmProcess Monitor and Process Explorer are in here.http://download.sysinternals.com/Files/SysinternalsSuite.zip>>Process Monitor and Process Explorer are in here.>>http://download.sysinternals.com/Files/SysinternalsSuite.zip How can I install the above ???it is a bundle of exe file only ???Any advice how to use them ??? Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now