Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

msrorqlnllx.dll was not found errors for all apps


  • Please log in to reply
11 replies to this topic

#1 slomax

slomax

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 06 January 2009 - 05:06 PM

Trying to fix a friends laptop that was pretty bad. Cleanup up various viruses\malware using avast, spybot, superantispyware & malwarebytes.

All of the above show clean now. Problem: EVERY single EXE that is run causes a pop window:
<APPLICATION.EXE> - Unable to Locate Component

This application has failed to start because msrorqlnllx.dll was not found. Re-installing the application may fix this problem.

The funny thing is after hittinh OK the many times it asks, the apps run fine. I have searched the web for this dll and I get no hits at all. Any help would be appreciated.

Stew.

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,492 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:56 AM

Posted 06 January 2009 - 05:13 PM

Hi and welcome,this ought to help you out.

Its not unusual to receive such an error after using specialized fix tools.

A "Cannot find...", "Could not run...", "Error loading... or "specific module could not be found" message is usually related to malware that was set to run at startup but has been deleted. Windows is trying to load this file but cannot locate it since the file was mostly likely removed during an anti-virus or anti-malware scan. However, an associated orphaned registry entry remains and is telling Windows to load the file when you boot up. Since the file no longer exists, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

To resolve this, download Autoruns, search for the related entry and then delete it.

Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click HERE if you're not sure how to do this.)
Open the folder and double-click on autoruns.exe to launch it.
Please be patient as it scans and populates the entries.
When done scanning, it will say Ready at the bottom.
Scroll through the list and look for a startup entry related to the file(s) in the error message.
Right-click on the entry and choose delete.
Reboot your computer and see if the startup error returns.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 06 January 2009 - 05:24 PM

Thanks for the quick reply!

Unfortunately, I do not see the msrorqlnllx.dll (or anyhting even close) when I check (& search) the "Everything" tab in Autoruns.

#4 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 06 January 2009 - 09:58 PM

Any ideas? I cant find this crazy dll!

#5 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 07 January 2009 - 07:53 AM

OK... a little more interesting. I searched every single file on my Laptop and found the following two files that have msrorqlnllx referenced in them. They are called CollectedData_6225.xml and CollectedData_6285.xml located in the C:\WINDOWS\pchealth\helpctr\DataColl directory.

Contents from the smaller file (CollectedData_6225.xml):

<?xml version="1.0" encoding="unicode" ?>
- <CIM CIMVERSION="2.0" DTDVERSION="2.0">
- <DECLARATION>
- <DECLGROUP.WITHPATH>
- <VALUE.OBJECTWITHPATH>
- <INSTANCEPATH>
- <NAMESPACEPATH>
<HOST>DB54C6F1</HOST>
- <LOCALNAMESPACEPATH>
<NAMESPACE NAME="root" />
<NAMESPACE NAME="cimv2" />
</LOCALNAMESPACEPATH>
</NAMESPACEPATH>
- <INSTANCENAME CLASSNAME="Win32_StartupCommand">
- <KEYBINDING NAME="Command">
<KEYVALUE VALUETYPE="string">msrorqlnllx.dll</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="Location">
<KEYVALUE VALUETYPE="string">Startup</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="Name">
<KEYVALUE VALUETYPE="string">msrorqlnllx</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="User">
<KEYVALUE VALUETYPE="string">.DEFAULT</KEYVALUE>
</KEYBINDING>
</INSTANCENAME>
</INSTANCEPATH>
- <INSTANCE CLASSNAME="Win32_StartupCommand">
- <PROPERTY NAME="Command" TYPE="string">
<VALUE>msrorqlnllx.dll</VALUE>
</PROPERTY>
- <PROPERTY NAME="Location" TYPE="string">
<VALUE>Startup</VALUE>
</PROPERTY>
- <PROPERTY NAME="Name" TYPE="string">
<VALUE>msrorqlnllx</VALUE>
</PROPERTY>
- <PROPERTY NAME="User" TYPE="string">
<VALUE>.DEFAULT</VALUE>
</PROPERTY>
- <PROPERTY NAME="Change" TYPE="string">
<VALUE>New</VALUE>
</PROPERTY>
</INSTANCE>
</VALUE.OBJECTWITHPATH>
- <VALUE.OBJECTWITHPATH>
- <INSTANCEPATH>
- <NAMESPACEPATH>
<HOST>DB54C6F1</HOST>
- <LOCALNAMESPACEPATH>
<NAMESPACE NAME="root" />
<NAMESPACE NAME="cimv2" />
</LOCALNAMESPACEPATH>
</NAMESPACEPATH>
- <INSTANCENAME CLASSNAME="Win32_StartupCommand">
- <KEYBINDING NAME="Command">
<KEYVALUE VALUETYPE="string">msrorqlnllx.dll</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="Location">
<KEYVALUE VALUETYPE="string">Startup</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="Name">
<KEYVALUE VALUETYPE="string">msrorqlnllx</KEYVALUE>
</KEYBINDING>
- <KEYBINDING NAME="User">
<KEYVALUE VALUETYPE="string">NT AUTHORITY\SYSTEM</KEYVALUE>
</KEYBINDING>
</INSTANCENAME>
</INSTANCEPATH>
- <INSTANCE CLASSNAME="Win32_StartupCommand">
- <PROPERTY NAME="Command" TYPE="string">
<VALUE>msrorqlnllx.dll</VALUE>
</PROPERTY>
- <PROPERTY NAME="Location" TYPE="string">
<VALUE>Startup</VALUE>
</PROPERTY>
- <PROPERTY NAME="Name" TYPE="string">
<VALUE>msrorqlnllx</VALUE>
</PROPERTY>
- <PROPERTY NAME="User" TYPE="string">
<VALUE>NT AUTHORITY\SYSTEM</VALUE>
</PROPERTY>
- <PROPERTY NAME="Change" TYPE="string">
<VALUE>New</VALUE>
</PROPERTY>
</INSTANCE>
</VALUE.OBJECTWITHPATH>
</DECLGROUP.WITHPATH>
</DECLARATION>
</CIM>

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,492 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:56 AM

Posted 07 January 2009 - 06:17 PM

Better yet let;s do 2 things. Run a scan on the PC and submit those files for tests.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.


Please submit those files to Virustotal . Then post their reply to you here also,thanks.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 07 January 2009 - 08:05 PM

THis update found some stuff.... but not what I think is the issue. But here is the report. Thanks again!

Malwarebytes' Anti-Malware 1.32
Database version: 1629
Windows 5.1.2600 Service Pack 3

1/7/2009 8:04:16 PM
mbam-log-2009-01-07 (20-04-16).txt

Scan type: Quick Scan
Objects scanned: 56743
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 6
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\nick\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
C:\Documents and Settings\nick\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

#8 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 07 January 2009 - 08:10 PM

Virus Total results:

File mbam-log-2009-01-07__20-04-16_.tx received on 01.08.2009 02:06:08 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/39 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.07 -
AhnLab-V3 2009.1.8.0 2009.01.07 -
AntiVir 7.9.0.45 2009.01.07 -
Authentium 5.1.0.4 2009.01.07 -
Avast 4.8.1281.0 2009.01.07 -
AVG 8.0.0.199 2009.01.07 -
BitDefender 7.2 2009.01.08 -
CAT-QuickHeal 10.00 2009.01.06 -
ClamAV 0.94.1 2009.01.07 -
Comodo 891 2009.01.07 -
DrWeb 4.44.0.09170 2009.01.08 -
eSafe 7.0.17.0 2009.01.06 -
eTrust-Vet 31.6.6296 2009.01.07 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.07 -
F-Secure 8.0.14470.0 2009.01.08 -
Fortinet 3.117.0.0 2009.01.08 -
GData 19 2009.01.07 -
Ikarus T3.1.1.45.0 2009.01.07 -
K7AntiVirus 7.10.581 2009.01.07 -
Kaspersky 7.0.0.125 2009.01.08 -
McAfee 5488 2009.01.07 -
McAfee+Artemis 5488 2009.01.07 -
Microsoft 1.4205 2009.01.07 -
NOD32 3749 2009.01.07 -
Norman 5.99.02 2009.01.07 -
Panda 9.0.0.4 2009.01.08 -
PCTools 4.4.2.0 2009.01.07 -
Prevx1 V2 2009.01.08 -
Rising 21.11.22.00 2009.01.07 -
SecureWeb-Gateway 6.7.6 2009.01.07 -
Sophos 4.37.0 2009.01.08 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.08 -
TheHacker 6.3.1.4.212 2009.01.08 -
TrendMicro 8.700.0.1004 2009.01.07 -
VBA32 3.12.8.10 2009.01.07 -
ViRobot 2009.1.7.1548 2009.01.07 -
VirusBuster 4.5.11.0 2009.01.07 -
Additional information
File size: 2641 bytes
MD5...: 3743129a49b06bd272b2dcc4b9e95662
SHA1..: 9eb82d5c5d984085d3151a9fe38fde9ad286501d
SHA256: d36c90255e89f9bd4e64756b6017dc5cc8f8aa17ca0fc72e6be59b7d7a52bc6b
SHA512: cbe6dad027c2012d7b5f73f4f4782cad5bb6b2e1a62279129a30b87502ba1c2e
f8005fc5e34481aed95fd09fdb5443aeec4a0852015e1b093086cda92ad1da61

ssdeep: 48:yHh89SRBerzt+nSDfpxk31N5umXS2Heu4eu6D:yHhvAztHDfpxk3b5uSS2+un
u6D

PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -

#9 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:56 AM

Posted 07 January 2009 - 08:23 PM

Hello.

Contents from the smaller file (CollectedData_6225.xml):

This file, though I don't know the language, adds the file msrorqlnllx.dll to startup.

I think your .exes problem may be caused by a file association change. Let's get a rootkit scan off first.

Download and Run Avira AntiRootkit
Please navigate to the download page of Avira AntiRootkit and click on Download to save it to your Destop.
  • You should now find a file called: antivir_rootkit.zip on your Desktop. Right click it and select Extract All. Delete the .zip file after extraction.
  • You should now have a folder with Setup.exe and some other files within it on your Desktop.
  • Double-click Setup.exe, then Next.
  • Highlight the radio button to accept the license agreement and then click Next.
  • Then click Next and Install to finalise the installation process.
  • Click Finish You may now also delete the folder with the extracted files from the zip archive).
You successfully installed Avira AntiRootkit
  • Please now navigate to Start > All Programs > Avira RootKit Detection. Then select Avira RootKit Detection
  • Click OK when a message window pops up
  • Click Start scan and let it run. Be patient and the scan finishes.
  • Click View report and copy the entire contents into your next reply.
Do not choose to rename any items found yet. There may be false positives.

Download and Run DAFT
This tool will find and fix problems with your file extension associations.
  • Download daft.exe by Deckard to your desktop. Save it as daft.com
  • Double click daft.exe to run it.
  • Click Scan.
  • Put a check mark beside the all the boxes.
  • Click Fix.
  • Clost out of daft.
With Regards,
The Panda

Edited by PropagandaPanda, 07 January 2009 - 08:23 PM.


#10 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 07 January 2009 - 08:40 PM

Avira says it found NO hidden items, and DAFT says all associations are ok. HEre is the Avira output:

Avira AntiRootkit Tool - Beta (1.0.1.17)

========================================================================================================
- Scan started Wednesday, January 07, 2009 - 20:31:26 PM
========================================================================================================

--------------------------------------------------------------------------------------------------------
Configuration:
--------------------------------------------------------------------------------------------------------
- [X] Scan files
- [X] Scan registry
- [X] Scan processes
- [ ] Fast scan
- Working disk total size : 111.70 GB
- Working disk free size : 95.02 GB (85 %)
--------------------------------------------------------------------------------------------------------

Scan task finished. No hidden objects detected!

--------------------------------------------------------------------------------------------------------
Files: 0/51344
Registry items: 0/251567
Processes: 0/50
Scan time: 00:02:57
--------------------------------------------------------------------------------------------------------
Active processes:
- pgeocvxi.exe (PID 3680) (Avira AntiRootkit Tool - Beta)
- wmiprvse.exe (PID 2704)
- System (PID 4)
- smss.exe (PID 444)
- csrss.exe (PID 492)
- winlogon.exe (PID 788)
- services.exe (PID 832)
- lsass.exe (PID 844)
- ati2evxx.exe (PID 1012)
- svchost.exe (PID 1032)
- svchost.exe (PID 1100)
- svchost.exe (PID 1148)
- svchost.exe (PID 1188)
- svchost.exe (PID 1244)
- svchost.exe (PID 1336)
- WLTRYSVC.EXE (PID 1456)
- BCMWLTRY.EXE (PID 1480)
- aswUpdSv.exe (PID 1500)
- ati2evxx.exe (PID 1532)
- ashServ.exe (PID 1612)
- spoolsv.exe (PID 1896)
- hnm_svc.exe (PID 2020)
- snmp.exe (PID 264)
- svchost.exe (PID 608)
- ViewpointService.exe (PID 692)
- ashMaiSv.exe (PID 1320)
- ashWebSv.exe (PID 1372)
- alg.exe (PID 2112)
- explorer.exe (PID 2212)
- SynTPEnh.exe (PID 2452)
- WLTRAY.EXE (PID 2476)
- stsystra.exe (PID 2592)
- PDVDDXSrv.exe (PID 2600)
- GrooveMonitor.exe (PID 2616)
- iTunesHelper.exe (PID 2632)
- ashDisp.exe (PID 2648)
- DSAgnt.exe (PID 2656)
- ctfmon.exe (PID 2664)
- TransferAgent.exe (PID 2672)
- ezi_hnm2.exe (PID 2688)
- DLG.exe (PID 2696)
- CLI.exe (PID 2984)
- iPodService.exe (PID 3380)
- CLI.exe (PID 192)
- jqs.exe (PID 1384)
- iexplore.exe (PID 2220)
- msntask.exe (PID 3616)
- iexplore.exe (PID 3032)
- msiexec.exe (PID 2544)
- avirarkd.exe (PID 4036)
========================================================================================================
- Scan finished Wednesday, January 07, 2009 - 20:34:23 PM
========================================================================================================

#11 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:56 AM

Posted 09 January 2009 - 07:27 PM

Sorry for the delay.

Let's see if we can find what is causing those issues.

Create and Run Batch Script
  • Copy the following into a notepad (Start>Run>"notepad"). Do not copy the word "code".
    @ECHO OFF
    regedit /e "Image File Execution Options.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
    start notepad "Image File Execution Options"
    del %0
  • Click File, then Save As... .
  • Click Desktop on the left.
  • Under the Save as type dropdown, select All Files.
  • In the box File Name, input look.bat
  • Hit OK.
When done properly, the icon should look like Posted Image.

Double click look.bat. If you are using Windows Vista, right click the icon and select "Run as Administrator".

You will see a black Command Prompt window flash open, followed by a notepad. Post back with the contents of the notepad.

You may have to attach it.

With Regards,
The Panda

#12 slomax

slomax
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:09:56 AM

Posted 11 January 2009 - 09:45 PM

I actually reinstall SP3 for XP and it fixed the problem. Thanks for the help from all though!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users