[chuikingman]

Hi,
I get below error after bootup and login XP .
Window cannot find "C:\documents and settings\chui king man.Chui-0BECB5BAFA\srr.exe" .Make sure you typed the name correctly, and then try again.To search for a file, click the Start button, then click Search.

Where is srr.exe and I cannot find it ???
What is the problem ??Please advice

[uid0]

Smells like malware... But at least it's missing malware
I'd make sure your protection is up to date.
You can clear out it's startup entry with autoruns.

This post has been edited by uid0: 10 January 2010 - 11:19 AM

[nitroshift]

Hello and welcome to msfn I second uid0's idea, or you can manually delete the entry from startup by going to Start ---> Run, type "msconfig" without the quotes then uncheck the entry under the "Startup" tab. Good luck!

[cluberti]

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

[chuikingman]

cluberti, on Jan 11 2010, 02:45 AM, said:

Srr.exe is likely from an app called "ReScene", which allows for unpacking .rar files split across multiple chunks into a resultant file, without touching the .rar files themselves. This utility tends to be used mostly in the warez scene, but I've seen a few malware packagers use it as an extracting mechanism for "updates" released over time (slowly download .rar files split into small segments so the user doesn't notice the bandwidth hit, and then unpack and run the resulting payload once all the chunks are down). Sounds like you had some malware or a virus at one point, and it's no longer on the machine but there's a startup entry for that tool. I would do what the previous poster mentioned - download autoruns and clean out the entry.

I use autorun but it is not work.
The missing srr.exe error is still existed .
Any advice if you know the answer ?????

[cluberti]

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

[chuikingman]

cluberti, on Jan 13 2010, 11:38 PM, said:

I think it might be useful to run hijackthis on this computer, and attach your log file to this thread. I'm moving it to the malware discussion alias for further assistance.

I post the hijack log in this .
Please advice whatI can do ???

Attached File(s)

•  hijackthis.log.txt (9.23K)
  Number of downloads: 7

[MrJinje]

Not sure exactly what this line is ???

Quote

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

This post has been edited by MrJinje: 13 January 2010 - 08:11 PM

[chuikingman]

MrJinje, on Jan 14 2010, 10:06 AM, said:

Not sure exactly what this line is ???

Quote

O4 - HKCU\..\Run: [PUT2VIDQLG] c:\docume~1\chuiki~4.chu\locals~1\temp\c .exe

Time to clean your temp directory.

I clean the %Temp% directory .
But the error is still find ....
I attach the latest hijack log in this .
Pleae advice hot ot fix it .....

Attached File(s)

•  hijackthis.log.txt (9.58K)
  Number of downloads: 7

[cluberti]

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

[MrJinje]

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip

This post has been edited by MrJinje: 17 January 2010 - 12:08 AM

[chuikingman]

cluberti, on Jan 17 2010, 01:45 PM, said:

It doesn't look like it's being called directly, so I would start by disabling the startup of everything non-Microsoft, and start re-enabling things a few at a time (rebooting after each change) and use trial and error to see which entry in your startup or services list is causing it.

Hi,
I disable all the item in startup by starterSetup...
I still get the error "missing srr.exe file " ....
It seem it is not related to the startup ( I use starter setup) .....

Please advice if you know the answer ????

[chuikingman]

MrJinje, on Jan 17 2010, 01:57 PM, said:

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip

I create the new account and there is no this error when I login to this new account .
So, the error is not the machine wide ....
Any other suggestion to fix it if you know the answer ???

[MrJinje]

chuikingman, on Jan 17 2010, 12:34 AM, said:

I create the new account and there is no this error when I login to this new account .

LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.co...ect/eWinCtl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.

This post has been edited by MrJinje: 17 January 2010 - 12:50 AM

[chuikingman]

MrJinje, on Jan 17 2010, 01:57 PM, said:

Cluberti is right, I don't see srr.exe being called from anywhere in your hijack list, so it is likely being called by a (different exe ??? guess). We can narrow down the search if we can determine whether the issue is machine wide or user account isolated. Here is how to find out.

Create a new account, reboot, and log in to the new account. Tell me if the error occurs or not. If it does not occur we can assume it is not a machine wide issue.

If the error does occur, re-run hijack this from the new account and it will have a shorter list. Then we just need to go through that list one by one until we find it. But only if the error occurs in the new account, if it doesn't error, we go through the list you already posted (only paying attention to user settings).

_____________________________

EDIT: Any reason why you cannot just get a copy of SRR.EXE and place it in the right spot and use something like process monitor to see what app spawns it ? I'd probably unplug my NIC before doing it, but that might be the quickest dirtiest way to find out.

Here is the srr.exe main website.

http://rescene.info/download.htm

Process Monitor and Process Explorer are in here.

http://download.sysi...ernalsSuite.zip

>>Process Monitor and Process Explorer are in here.

>>http://download.sysinternals.com/Files/SysinternalsSuite.zip

How can I install the above ???it is a bundle of exe file only ???
Any advice how to use them ???

[MrJinje]

Details here, in case your google is broken.

http://technet.microsoft.com/en-us/sysinte...s/bb795533.aspx

This post has been edited by MrJinje: 17 January 2010 - 01:28 AM

[chuikingman]

MrJinje, on Jan 17 2010, 02:50 PM, said:

chuikingman, on Jan 17 2010, 12:34 AM, said:

I create the new account and there is no this error when I login to this new account .

LOL, or you could just use the new account, whatever it is only seems to be only affecting your old account. Very easy to copy your Favorites, My Docs, and Desktop into your new account, most of your applications should not give you any issues, if they do, a quick re-install/repair will fix them.

Otherwise, maybe look at your activex controls, do you recognize these websites and trust them ??

O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.co...ect/eWinCtl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Attach a hijack this from your new account and we can compare new list against the old list and only check the things not on the new list.

I attach the log of hijack in this post ....
hijackthis.log.txt == the log with error "missing srr.exe file "
hijackthis_new.txt == the log with new user account without err "missing srr.exe file "

Pleae advice what I can fix ???

Attached File(s)

•  hijackthis.log.txt (8.1K)
  Number of downloads: 3
•  hijackthis_new.txt (7.67K)
  Number of downloads: 2

[MrJinje]

Uninstall your "Internet Accelarator. Those types of programs are usually don't help unless you are on dialup.

O4 - Startup: SpeedConnect Internet Accelerator.lnk = C:\Program Files\CBS Software\SpeedConnect Internet Accelerator\speedconnectstartup .exe

If not that, then uninstall Microspell, that is the other one it could be. Both of these are in the old list, but not in the new list.

Report back.

This post has been edited by MrJinje: 17 January 2010 - 07:22 PM