Re: 2 missing .dll files (?) AFTER removal of spyware

PattiNS wrote:

I worked with the folks at Microsoft security past 2 days, which enabled
me to get the nasty Vundo and firewall-bypass (among others) spyware and
malware removed from my HP laptop.
Now, after I (happily) no longer get those yucky popups on my PC since all
the malware has been removed, I keep getting the following two (2)
SIMULTANEOUS Microsoft Windows XP (home edition) popups AFTER I start OR
reboot my PC:

Error loading C:\WINDOWS\system32\kiramega.dll
The specified module could not be found

Error loading C:\WINDOWS\system32\falolofu.dll
The specified module could not be found

My question is: *how* can I get these two "error message" to *not* appear
any more, going forward? Very annoying when I boot up my HP laptop! If
this helps any, I recall these two .dll files came up as "could not
remove" after
the Microsoft tech assistant helped me remove them from my laptop.
HELP!!!

There is always the possibility that your computer is not really clean, even
though you aren't getting the popups. Vundo infections are extremely
difficult to remove. It would be wise to register at one of the following
specialty forums and post a HijackThis log to get an expert opinion as to
whether your computer is really malware-free. If the machine is in fact
clean, then you can stop the error messages by managing your Startup, since
references to the malware were still left in Startup.

A. Specialty forums:

PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS.

http://aumha.org/downloads/hijackthis.zip
http://aumha.net/ - Click on the HijackThis forum. Read the announcement and
the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/
http://www.thespykiller.co.uk/index.php?board=3.0
http://forums.subratam.org/index.php?showforum=7

B. Manage your Startup:

Start>Run>msconfig [enter]

This brings up the System Configuration Utility. Look on the Startup tab and
find the probable culprit. Uncheck the box next to its name, Apply and OK
out. You don't need to restart immediately, but the next time you do you'll
get a dialog saying you've used the Utility. Just tick the box that says in
effect, "don't bother me about this again".

Important - Do not use the System Configuration Utility to stop processes.
Instead, use Start>Run>services.msc [enter] and do not stop any services
unless you really, really know what you're doing.

How to Troubleshoot By Using the Msconfig Utility in Windows XP -
http://support.microsoft.com/?id=310560
The free Autoruns program is very useful for managing your Startup -
http://www.microsoft.com/technet/sysinternals/default.mspx - Autoruns

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

.

Relevant Pages

  • Re: rundll error Error loading system32arlmhpf.dll
    ... I have encountered a rundll error on my laptop "Error loading ... This occurs on startup and it seems to affect IE. ... There is a strong probability that the file referenced is malware. ... Important - Do not use the System Configuration Utility to stop processes. ...
    (microsoft.public.windowsxp.general)
  • Re: cdyrqb.exe
    ... It would have been more helpful if you had posted the exact text of the error message. ... So either your antivirus/antispyware software removed the malware and left a reference to it in Startup or your computer is still infected but this malware file isn't being found. ... If you were that thorough and are 100% sure the machine is clean, remove the startup call by running the System Configuration Utility: ...
    (microsoft.public.windowsxp.general)
  • Re: JJUVFEEL.DLL error
    ... It is common for malware to have randomly named files like ... See below for how to manage your Startup. ... Important - Do not use the System Configuration Utility to stop processes. ... The free Autoruns program is very useful for managing your Startup - ...
    (microsoft.public.windowsxp.general)
  • Re: RUNDLL
    ... That file is associated with the MyWebSearch malware. ... antimalware program or you uninstalled it but left a reference to the ... You can remove the call at Startup, ... Important - Do not use the System Configuration Utility to stop processes. ...
    (microsoft.public.windowsxp.general)
  • Re: windows xp help
    ... Your antivirus/antispyware programs could have removed the malware and left a reference to it in Startup OR if you didn't do any malware removal you need to. ... Important - Do not use the System Configuration Utility to stop processes. ... How to Troubleshoot By Using the Msconfig Utility in Windows XP - ...
    (microsoft.public.windowsxp.general)