Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

missing srr.exe file in win XP home edition

- - - - -

  • Please log in to reply
17 replies to this topic

#1
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10
Hi,
I get below error after bootup and login XP .
Window cannot find "C:\documents and settings\chui king man.Chui-0BECB5BAFA\srr.exe" .Make sure you typed the name correctly, and then try again.To search for a file, click the Start button, then click Search.

Where is srr.exe and I cannot find it ???
What is the problem ??Please advice


How to remove advertisement from MSFN

#2
uid0

uid0

    Advanced Member

  • Member
  • PipPipPip
  • 358 posts
  • Joined 12-June 06
Smells like malware... But at least it's missing malware :rolleyes:
I'd make sure your protection is up to date.
You can clear out it's startup entry with autoruns.

Edited by uid0, 10 January 2010 - 11:19 AM.


#3
nitroshift

nitroshift

    Beware of programmers with screwdrivers!

  • Super Moderator
  • 2,912 posts
  • Joined 29-November 05
  • OS:Windows 8.1 x64
  • Country: Country Flag
Hello and welcome to msfn :hello: I second uid0's idea, or you can manually delete the entry from startup by going to Start ---> Run, type "msconfig" without the quotes then uncheck the entry under the "Startup" tab. Good luck!

Please read the rules, folks!


#4
cluberti

cluberti

    Gustatus similis pullus

  • Supervisor
  • 11,254 posts
  • Joined 09-September 01
  • OS:Windows 8.1 x64
  • Country: Country Flag
Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.
MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8
--------------------
Please read the rules before posting!
Please consider donating to MSFN to keep it up and running!

#5
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.


I use autorun but it is not work.
The missing srr.exe error is still existed .
Any advice if you know the answer ?????

#6
cluberti

cluberti

    Gustatus similis pullus

  • Supervisor
  • 11,254 posts
  • Joined 09-September 01
  • OS:Windows 8.1 x64
  • Country: Country Flag
I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.
MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8
--------------------
Please read the rules before posting!
Please consider donating to MSFN to keep it up and running!

#7
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

I post the hijack log in this .
Please advice whatI can do ???

Attached Files



#8
MrJinje

MrJinje

    Tool™ Developer

  • Developer
  • 1,067 posts
  • Joined 14-October 09
  • OS:Server 2012R2
  • Country: Country Flag
Not sure exactly what this line is ???

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

Edited by MrJinje, 13 January 2010 - 08:11 PM.


#9
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

Not sure exactly what this line is ???

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

I clean the %Temp% directory .
But the error is still find ....
I attach the latest hijack log in this .
Pleae advice hot ot fix it .....

Attached Files



#10
cluberti

cluberti

    Gustatus similis pullus

  • Supervisor
  • 11,254 posts
  • Joined 09-September 01
  • OS:Windows 8.1 x64
  • Country: Country Flag
It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.
MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8
--------------------
Please read the rules before posting!
Please consider donating to MSFN to keep it up and running!

#11
MrJinje

MrJinje

    Tool™ Developer

  • Developer
  • 1,067 posts
  • Joined 14-October 09
  • OS:Server 2012R2
  • Country: Country Flag
Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip

Edited by MrJinje, 17 January 2010 - 12:08 AM.


#12
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.


Hi,
I disable all the item in startup by starterSetup...
I still get the error "missing srr.exe file " ....
It seem it is not related to the startup ( I use starter setup) .....

Please advice if you know the answer ????

#13
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip


I create the new account and there is no this error when I login to this new account .
So, the error is not the machine wide ....
Any other suggestion to fix it if you know the answer ???

#14
MrJinje

MrJinje

    Tool™ Developer

  • Developer
  • 1,067 posts
  • Joined 14-October 09
  • OS:Server 2012R2
  • Country: Country Flag

I create the new account and there is no this error when I login to this new account .

LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.co...ect/eWinCtl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.

Edited by MrJinje, 17 January 2010 - 12:50 AM.


#15
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip



>>Process Monitor and Process Explorer are in here.

>>http://download.sysi...ernalsSuite.zip

How can I install the above ???it is a bundle of exe file only ???
Any advice how to use them ???

#16
MrJinje

MrJinje

    Tool™ Developer

  • Developer
  • 1,067 posts
  • Joined 14-October 09
  • OS:Server 2012R2
  • Country: Country Flag
Details here, in case your google is broken.

http://technet.micro...s/bb795533.aspx

Edited by MrJinje, 17 January 2010 - 01:28 AM.


#17
chuikingman

chuikingman

    Newbie

  • Member
  • 23 posts
  • Joined 10-January 10

I create the new account and there is no this error when I login to this new account .

LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.co...ect/eWinCtl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.


I attach the log of hijack in this post ....
hijackthis.log.txt == the log with error "missing srr.exe file "
hijackthis_new.txt == the log with new user account without err "missing srr.exe file "

Pleae advice what I can fix ???

Attached Files



#18
MrJinje

MrJinje

    Tool™ Developer

  • Developer
  • 1,067 posts
  • Joined 14-October 09
  • OS:Server 2012R2
  • Country: Country Flag
Uninstall your "Internet Accelarator. Those types of programs are usually don't help unless you are on dialup.

O4 - Startup: SpeedConnect Internet Accelerator.lnk = C:\Program Files\CBS Software\SpeedConnect Internet Accelerator\speedconnectstartup .exe

If not that, then uninstall Microspell, that is the other one it could be. Both of these are in the old list, but not in the new list.

Report back.

Edited by MrJinje, 17 January 2010 - 07:22 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users