Its very possible that removing IE8 did cause the problem....Virus is other option that normally kills the rundll32 file...

try this...if you have a Xp Cd..use your cd..this is safer, than using a flash drive, if it is a virus, it could jump to your flash drive....

Stick the CD in. Open a CMD box from START/PROGRAMS/ACCESSORIES/COMMAND PROMPT
type in the following:-

expand \i386\rundll32.ex_ %Systemroot%\rundll32.exe

where the is your CD-ROM drive letter, like D: or E: (dont type in the )

That should put it back.

Then reboot, and run virus scan...
and Spyway scanner, like Spybot search and destroy ( free Program)

I'd be interested in knowing what reason this person had for removing IE. It's such an integral component of the Windows OS that removing it is similar to cutting one leg off of your chair. And doing so without a back up and no Windows cd on hand? Risky business, IMHO.

well first of all how exactly did she "remove" IE8?
you can not actually remove IE from windows, you remove IE8 from add remove programs it then rolls the pc back to the earlier version of IE that was built in. Now if she had IE7 orIE8 on the pc then got service pack 3 for xp you can not go back. It was well documented in the directions for service pack 3.
You cannot uninstall Internet Explorer 7 or Internet Explorer 8 after you install Windows XP Service Pack 3
What service pack is she on with her xp on that pc?

I think before anything can be done she would have to explain exactly what her "removal" process was and what did she actually remove?

Has she tried doing a system restore to the point prior to making any of those changes? that would be number one on the list to try. Second would be installing IE8 again, these things may need to be done in safe mode with networking. I would also highly recommend running malwarebytes on it before going much farther because many of these errors are caused by an infection.
How to download and install Malwarebytes' Anti-Malware application for Windows computers

by the way on the directions given above by katheria a portion of the directions did not appear in the post it is likely due to the brackets which this site will not post properly but here is a link with the full instructions should they be needed.
Windows can't find Rundll32.exe

I'll be at her computer soon and ask how she removed it. She only said she did it in a fit of pique and I assumed she had used uninstall until I remembered Windows wouldn't have allowed that.

Katheria, thank you for the CD suggestion.

I checked my old XP and the rubdll32.exe byte count matches hers exactly. The worm info I found indicated the file size would have increased so I guess that is not the answer.

Raven, I'll try System Restore from a safe boot if that is possible. From a regular boot she gets "can't find" on every program in the control panel. Can't follow instructions in your last link because no Windows CD came with the used machine. The place she bought it 5 years ago is out of business. She can't access the internet (has Charter cable & a router). I'll ask about service pack3.

Thanks for your help and I'll post again after I've asked more questions.

any windows xp cd will work if you have one you can use yours this is just so it can get the needed file has nothing to do with the specific cd that came with the pc. the versions should match of course so would need xp cd.

the instructions in last link were just a repeat of the ones from katheria since hers were not posted fully by the GW site the link simply was to provide the full directions.

to run malwarebytes on the pc you can put it on a flash drive and start the pc in safe mode with networking and install it and run it that way. This is one step I would definitely do.

She only remembers she was getting a warning there was a problem with IE8. She got disgusted and doesn't remember how she deleted it or if the computer was ok after doing it. She didn't remember downloading IE8. And she had some things in the Recycle Bin which were no longer there (empty).

I booted in safe mode with internet, but receive the 'choose which program...' box when trying to open Mozilla. I can find no trace of any version of IE. I was able to get to Event Viewer and saw this:
IE Log Custom Log Error Records ----

(---- in the size column)

Leg off a chair. I like that!

Thanks Raven, I'll look for my XP recovery CD. Didn't know I could use another machine's. I'm beginning to think it is strictly an IE problem. Her internet service is high(er) speed thru AT&T with Yahoo as a home page.

I'll burn malwarebytes and some other programs on a CD. And try again tomorrow with my XP CD.

then you will need to download firefox to a thumb drive or cd and install it on the pc so it can have a way to access the internet when it wants to try. You can also download IE8 and try to install it from cd too. That way there will be 2 browsers and maybe one will work with a fresh install who knows.

did you try system restore? should be able to do that from safe mode.

I would love to know how the heck she removed Ie.

If opening programs was something I was trying to fix I might register the .dll error,,,, and/or try running system file checker ... before I spent too much time looking for other causes.

Microsoft Support - System File Checker (Sfc.exe)

Here is a link that might be useful: http://www.wikihow.com/Register-a-DLL

I am on her computer now.

So I used my XP CD today and again not able to repair (possibly because it is XP Home Edition, not Media Edition as was her machine). I really couldn't make any progress.

Using Microsoft's expand x:\i386\rundll32 ............
wouldn't work. Sent me back to 'choose which program to ....'. Problem being it was still in a Windows interface where nothing would run.

If I had more experience in safe mode there may be something more I could have done. Or more experience running programs from a flash drive. Again the problem of trying of use an operating system that's not operating.

Finally I reinstalled XP completely. And that went fine! Thank you Raven for letting me know I could use my CD on another machine!!!

Downloaded AVAST immediately ran a scan. One threat found rated high.

Filename:
c:\System Volumn Information\_restore(690E10B9-345A-4113-8447-A6E37D618D7A)\RP29\A0007064.exe

Severity:
High

Status:
Threat: Win32:MalOb-AL[Cryp]

Action:
Move to Chest

She has AT&T and it is constantly online since the Yahoo changeover. The computer didn't have virus protection for a few minutes and while Avast was downloading. My goof.

Do I tell Avast to delete this or leave it in the chest?

My head's rather spinning now. I'll log on tomorrow for further instructions. Thank you very much for your help on this.

I would just leave it in the chest for now. I see that it is in restore. Do some research on the threat before you do anything that would permanently delete this file.

leave in chest that is the best thing to do in case it should ever be needed for some reason.

Now go ahead and run the malwarebytes full scan on it.

I also installed service pack 2.

I think I need to do service pack 3 also. Correct?

I also thought of putting Advanced System Care on the machine. Good idea or no??

I'm going now to the Malware place Raven. I brought my external hard drive to work for it.

On the Avast forum Win32:MalOb-AL[Cryp] is a new name (Mar 11th) for a variation or a renamed worm. I didn't see reference to what action to take so I will leave it in the chest as suggested.

She remembered after it was up and running again that she had MS updates that installed before the machine shut down and the next day was when she couldn't use any program.

When the IE8 removal happened & how is still a mystery.

Thank You All Again!!!