chuikingman

missing srr.exe file in win XP home edition

18 posts in this topic

Hi,

I get below error after bootup and login XP .

Window cannot find "C:\documents and settings\chui king man.Chui-0BECB5BAFA\srr.exe" .Make sure you typed the name correctly, and then try again.To search for a file, click the Start button, then click Search.

Where is srr.exe and I cannot find it ???

What is the problem ??Please advice

0

Share this post


Link to post
Share on other sites

Smells like malware... But at least it's missing malware :rolleyes:

I'd make sure your protection is up to date.

You can clear out it's startup entry with autoruns.

Edited by uid0
0

Share this post


Link to post
Share on other sites

Hello and welcome to msfn :hello: I second uid0's idea, or you can manually delete the entry from startup by going to Start ---> Run, type "msconfig" without the quotes then uncheck the entry under the "Startup" tab. Good luck!

0

Share this post


Link to post
Share on other sites

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

0

Share this post


Link to post
Share on other sites
Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

I use autorun but it is not work.

The missing srr.exe error is still existed .

Any advice if you know the answer ?????

0

Share this post


Link to post
Share on other sites

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

0

Share this post


Link to post
Share on other sites
I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

I post the hijack log in this .

Please advice whatI can do ???

hijackthis.log.txt

0

Share this post


Link to post
Share on other sites

Not sure exactly what this line is ???

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

Edited by MrJinje
0

Share this post


Link to post
Share on other sites
Not sure exactly what this line is ???
O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

I clean the %Temp% directory .

But the error is still find ....

I attach the latest hijack log in this .

Pleae advice hot ot fix it .....

hijackthis.log.txt

0

Share this post


Link to post
Share on other sites

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

0

Share this post


Link to post
Share on other sites

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

Edited by MrJinje
0

Share this post


Link to post
Share on other sites
It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

Hi,

I disable all the item in startup by starterSetup...

I still get the error "missing srr.exe file " ....

It seem it is not related to the startup ( I use starter setup) .....

Please advice if you know the answer ????

0

Share this post


Link to post
Share on other sites
Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

I create the new account and there is no this error when I login to this new account .

So, the error is not the machine wide ....

Any other suggestion to fix it if you know the answer ???

0

Share this post


Link to post
Share on other sites
I create the new account and there is no this error when I login to this new account .
LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.

Edited by MrJinje
0

Share this post


Link to post
Share on other sites
Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysinternals.com/Files/SysinternalsSuite.zip

>>Process Monitor and Process Explorer are in here.

>>http://download.sysinternals.com/Files/SysinternalsSuite.zip

How can I install the above ???it is a bundle of exe file only ???

Any advice how to use them ???

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.