Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Got rid of a virus, now RunDLL is showing me errors


  • Please log in to reply
5 replies to this topic

#1 writingfix

writingfix

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:14 PM

Posted 06 July 2014 - 09:08 PM

A few days ago, I went to shut down my laptop and discovered that Internet Explorer 8 had several tabs up. They were running in the background, completely invisible to me unless I looked in Task Manager. IE would open from 5-8 tabs on its own, all spam (the most common avulu.com), and the tabs would persist until IE crashed. To solve this problem, I ran a scan with Emsisoft Anti-Malware. It detected only one malicious file and several other low-risk registry keys/files, and I deleted them all without thinking twice.

 

I believe this has solved the IE virus, as I have seen no more tabs come up in Task Manager, but now I'm having issues with RunDLL. When the tabs were coming up, sometimes an error would pop up saying RunDLL had stopped working, but now when I boot my laptop there is a message saying that a file is being removed (I wasn't fast enough to read it properly, but I believe it's in the AppData\Roaming location), and when I log into my user, two errors popped up:

"Error loading C:\Users\Editor\AppData\Roaming\shtomn.dll

The specified module could not be found."

 

 

The second message is identical, but it has "usypap.dll" at the end instead. I have two users on my laptop and this is only happening on the one, "Editor". I am running Windows Vista, version 6.0, system pack 1. I haven't noticed any other adverse effects but am concerned about what the RunDLL errors mean and if they're the product of a malicious file. Any help is appreciated!



BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,404 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:14 PM

Posted 06 July 2014 - 09:20 PM

Hello writinfix, Its not unusual to receive such an error after using specialized fix tools.

A "Cannot find...", "Could not run...", "Error loading... or "specific module could not be found" message is usually related to malware that was set to run at startup but has been deleted. Windows is trying to load this file but cannot locate it since the file was mostly likely removed during an anti-virus or anti-malware scan. However, an associated orphaned registry entry remains and is telling Windows to load the file when you boot up. Since the file no longer exists, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

To resolve this, download Autoruns, search for the related entry and then delete it.

Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if you're not sure how to do this.)
Open the folder and double-click on autoruns.exe to launch it.
Please be patient as it scans and populates the entries.
When done scanning, it will say Ready at the bottom.
Scroll through the list and look for a startup entry related to the file(s) in the error message. -->>> The 2 dll's
Right-click on the entry and choose delete.
Reboot your computer and see if the startup error returns.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 writingfix

writingfix
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:14 PM

Posted 06 July 2014 - 10:28 PM

That's fantastic--I did exactly as you said and got no startup errors whatsoever.

 

Thank you so much for the explanation and help!



#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,404 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:14 PM

Posted 07 July 2014 - 09:25 AM

You're quite welcome!

and thanks to our quietman for that writeup!


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 Twitterfollower

Twitterfollower

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:11:14 AM

Posted 09 July 2014 - 12:02 PM

I would suggest you to try Norton Power Eraser - A free tool to remove virus. Visit the following link to know more about this, https://support.norton.com/sp/en/us/threat-removal-solutions/current/info



#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,404 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:14 PM

Posted 10 July 2014 - 10:01 AM

Not for he above case. That's a very powerful tool that will do more than what we needed of just removing 2 orphaned DLL's.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users