BleepingComputer.com: Vista Start Up Problems

HI All,

I have a VISTA Laptop with Norton and SpyWare Doctor.
Had been doing well until got affected by Spyware. although the spyware was removed by the spyware Docter but am
getting error while Windows start up . Please find the erros as under.
Error Loading c:\Users\me\AppData\Local\Temp\deyekjyj.dll specified module could not be found.
Error Loading c:\Users\me\AppData\Local\Temp\tustu.dll specified module could not be found.
Error Loading c:\Users\me\AppData\Local\Temp\qomkj.dll specified module could not be found.
Error Loading c:\Users\me\AppData\Local\Temp\xkkdtjhj.dll specified module could not be found.
Also i find the Boot time has incresed considerably....Other operations are fine.
Would be very much indebted if you could please help me out of this..

Thanking you for your help

Dhrubo

Here's a couple of things I would do to address this:

1. Make a backup of your registry. A highly recommended freeware program on these boards is ERUNT. Windows System Restore is not a good recovery solution in the event of a corrupted registry.

2. After setting up a backup, download a program like autoruns and selectively delete any entries that are related to malware. Be sure to research each file you are considering deleting to make sure they are not associated with valid programs.

If you prefer, feel free to post a hijackthis log in the appropriate forum to solicit help from the more experienced than myself.

Hope it helps a little.

Thanks for ur inputs..
But could you please see me through this.. am a newbee in this field.
I followed the steps you suggested.. but could only find the deyekjyj.dll beind associated with a program named MS Juan..
The other missing dll files didn't come up in the auto run..
can you please provide some insight as to what sud i do with this "MS Juan".
What log file should i post.. am using Spyware doctor and as of now it shows no infetion whatso ever from itz run.

Thanks a ton for ur help

Regards
Dhrubo

A google search for the file/files in your error message(s) shows very few results. This is suspicious and can be an indication that those files are related to malware.

Windows is giving (at startup) an error message that says that it can't find those files - so that's actually a good thing. I suspect that an antivirus/antispyware program has removed malware from your system - and that it hasn't removed the startup entries associated with it.

To remove the startup entries, first download and open this free program: http://www.microsoft.com/technet/sysintern...s/Autoruns.mspx

In the Everything tab, scroll down the column that says "Image Path" and look for those entries. Once you find them, remove the checkmark from the box on the left side of that line. Then close the program and reboot. The error messages should have disappeared.

If they haven't disappeared upon reboot, please post back with the details of exactly which errors messages are now popping up.

Additionally, I'd suggest that you download this free program and use it to clean your temporary files: http://www.ccleaner.com/download
Please use the default settings to clear the temporary files. The more advanced features are dangerous to use, so please avoid them.

Finally, I'd suggest that you use a couple of these free online scans to see if there are any traces of infection still on your system. Be advised that some of these scanners will pickup things in "quarantine" from other anti-virus programs - so review the results carefully:

http://safety.live.com (requires IE) If using Vista, click on the error message to use the beta scanner.
http://housecall.trendmicro.com
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://www.kaspersky.com/virusscanner
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://security.symantec.com/sscv6/default...e&venid=sym
http://us.mcafee.com/root/mfs/default.asp
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/

Hi wow spyware doc and norton are both heavy programs on start up, what i did to make vista faster was nuke alot of start up things in msconfig and use avg free, I run spywaredoctor when i need to then shut it down. try spybot S&D run that looks like something program got deleted system restore even goodluck

Hi All,
Thanks for all your inputs.
Followed all steps as suggested by Usama but as i already added that i could only find one dll file of the 4 that were giving error, on
running the autorun application...
I even found the entry of the dll that i found(associated with MS Juan application) in Registry and have deleted the same.This is done but
the rest of the dll files were still giving me RUN DLL errors as under...
Error Loading c:\Users\me\AppData\Local\Temp\tustu.dll specified module could not be found.
Error Loading c:\Users\me\AppData\Local\Temp\qomkj.dll specified module could not be found.
Error Loading c:\Users\me\AppData\Local\Temp\xkkdtjhj.dll specified module could not be found.

I found entries of these files in StartUp and as of now have Unchecked them in system configuration utility MSCONFIG.so the errors no more appear...
But what makes me still worried is if these DLL entries are not in Registry although in the start up tab they show their location as
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
then where are they coming from and in the long run is it safe enough to keep these dll's bloced in the Start UP.

Looking for your Valuable inputs and suggestions..

Cheers
Dhrubo...

The files ending in .dll were located in your Temporary files. Some antivirus program has removed them from your computer (and CCleaner has made sure of that). You should not be able to find them as they have been deleted from your system.

The errors are coming because Windows cannot find the file in order to make it run (because it was deleted). This is a good thing - although the error is irritating.

The registry entries are not where the DLL's are located - rather that's the location in the Windows startup that tries to launch the virus. When you logon to your account, Windows loads/runs the stuff in the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key of your registry. Disabling those entries (by removing the checkmark) is sufficient to remove the error message - but, if you'd like, you can right click on them and select "delete". That will eliminate any traces of these keys in the registry (just don't delete the entire HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key).