Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing .dat Files


  • Please log in to reply
5 replies to this topic

#1 hifriends

hifriends

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:02 PM

Posted 19 November 2007 - 06:41 PM

Hello all,

I just finished cleaning out a bunch of malware from my cousin's computer, and since I got it running again, a problem I thought would go away did not. Still, on starting, I get a RUNDLL notification of missing .dat files called "__c003CEBC.dat, __c003F950, __c00451B1, etc." These files are missing from C:\Windows\system32. I'm pretty sure some kind of malware ate these files, but the computer seems to run fine without them. So my questions are

1. Do I need these files?
a. If not, how to stop the notification
b. If so, how do I regain them.

Thank you!

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:02 PM

Posted 19 November 2007 - 11:13 PM

Those .dat files are malware related.

RunDLL32.exe is a legit Windows file that loads .dll files which too can be legit or malware related. The Cannot find or error loading error message usually occurs when the associated .dll has been removed. The file may have been removed during an anti-virus scan, the uninstall of a program or use of a specialized fix tool. However, an associated registry entry remains and is telling Windows to load the file when you boot up.

If the file was removed but not the entry, Windows will display an error message indicating that the file was not found or there was an error loading. You need to remove this registry entry so Windows stops searching for the program when it loads.

To resolve this download and run Autoruns, search for the related entry and then delete it.
  • Create a new folder on your hard drive called AutoRuns and extract (unzip) the file there. (click here if your not sure how to do this.)
  • Open the folder and double-click on autoruns.exe to launch it.
  • Please be patient as it scans and populates the entries.
  • When done scanning, it will say Ready at the bottom.
  • Scroll through the list and look for a startup entry related to the file with the error message.
  • Right-click on the file and choose delete.
  • Reboot your computer and see if the startup error returns.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 hifriends

hifriends
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:02 PM

Posted 19 November 2007 - 11:39 PM

Thanks a lot, it got rid of that popup, now the only thing I noticed is that when I look at the startup tab of msconfig, I still see the file as an option to load on startup. Is that a problem? There's also an .exe file rooted in the temp folder, but when I search for that, there's nothing to be found. Either way, I unchecked the boxes so they won't be starting up, but is it a problem that the option is still there?


Again, thanks very much.

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:02 PM

Posted 20 November 2007 - 08:25 AM

I noticed is that when I look at the startup tab of msconfig, I still see the file as an option to load on startup

Did you use Autoruns to delete that entry? MsConfig cannot do that. It can only disable.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 hifriends

hifriends
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:02 PM

Posted 20 November 2007 - 11:44 AM

Ah, I think I've got it now. Prior to your post I disabled them in msconfig, and hadn't checked if it worked. So when I restarted and checked Autoruns again, there wasn't an option to delete them because they weren't enabled. So I enabled them, restarted, ran Autorubs, and then deleted them. Worked like a charm. Thank you very much for all your help.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:02 PM

Posted 20 November 2007 - 11:49 AM

Your welcome.

I suggest you perform a couple Online Virus Scans to ensure nothing else is on your system. These files are being seen with other types of malware that may not have been found by your current scans.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users