How to Remove DLL Files
What is a DLL file?
DLL (Dynamically Link Library) is an executable file that permits programs to share code to perform one or more predefined functions. A DLL file can be used by several programs at the same time. The benefit of having DLL files is that they don't get loaded into random access memory (RAM) along with the main program, which saves up space in RAM. So instead of all the coding being built into the program, it uses a particular DLL file that, with a simple call, can execute the operation for it.
Why is it important to remove malicious DLLs?
Most DLL files are essential for the running of your programs but there are other malicious programs, such as browser hijackers and browser plugins, that are usually made up of DLL files that can alter your system settings to allow attackers gain access on your computer.
If you're really serious about removing unwanted DLL files, make sure you use Windows Add/Remove programs first (how to use Add/Remove programs). Most applications come with an uninstall program that will remove the unwanted DLL files. But be aware the uninstall utility will assume that certain files are shared and it will have no way of knowing which other programs use them or whether these programs are present on your machine. This results in DLLs being left behind that can recreate the malicious program on reboot.
To remove a specific DLL, you should use Regsvr32 (Regsvr32.exe) to register and unregister DLL files which is already built in your Windows operation system's package. There are plenty of other programs available that can help you identify and remove unwanted DLLs, but Regsvr32 is the most common.
Learn how to remove spyware DLL files from your computer.
Unregister Spyware DLL Files Manually
Warning: Unregistering spyware DLL files is difficult and risky. If you unregister the wrong DLL file, your computer may crash and important data may be lost. As a precautionary measure, please back up important files and set a System Restore point (click Start > All Programs > Accessories > System Tools > System Restore, and follow the on-screen instructions) or run a spyware check with a trusted anti-spyware program to automatically detect spyware.
To start unregistering DLL files, you will need to follow these steps:
- Open the Command Prompt window
Press the "Start" button on your taskbar and click on "Run" to start the "Run" tool. In the field, type "cmd" and press the "OK" button.
- Locate the DLL file
After opening the Command Prompt window, locate the exact DLL path as shown on the screenshot below. Type "cd" in order to change the current directory, press the "space" button, enter the full path to the DLL file and press the "enter" button on your keyboard. If you want to display the contents of the directory, use the "dir" command.
- Unregister the unwanted DLL
In the directory where you want to remove the DLL, type "regsvr32 /u [DLL_NAME]" and press the "Enter" button.
- Unregistering succeeded
If the DLL was unregistered successfully, a confirmation message will be displayed.
If you want to undo the removal, you can perform it by typing "regsvr32" without the /u key, just type "regsvr32 [DLL_NAME]" to undo the changes.
I followed the instructions, and the .dll is still on my system. I received an error dialogue box with the code 0x8002801c. My search goes on.
followed the instruction and received an error message in a popup:
RegSvr32
jkkjh.dll was loaded, but the DIIUnregisterServer entry point was not found.
This file can not be registered.
Okay
any help would be appreciated.
Dan,
Probably you are trying to remove the file that not exists. It is possible that you followed the file that was on our instructions but sometimes they not exist.
XP OS
Have a nnnmkkj.dll residing in /system32 which I am prohibited from performing any action as the file is always being accessed by another application. NOD32 says will delete on reboot but it can't as the dll is accessed on bootup.
I can delete Registry entries but they recreate on bootup.
Same results in safe mode.
No 3.5 so can't boot in DOS
i found jkhih.dll and iifdawv.dll in windows/system32 folder, but i still can't remove it since it said being use by some process, i check and both being use by winlogon and explorer.exe, anyone know how to remove it?
already use the spyware scanner, but everytime i restart the pc, my internet security setting back to minimum automatically, even after i changed it, so i guess the spyware/virus that make it to very low security again...anyone can help? much appreciated 🙂
thank you
jan,
If the antivirus program that you have got don't help you, try to use other programs. Because one program can miss what the other finds. You can find free tools which can help you fix this problem.
dadun,
You have a very dangerous parasite on your computer. And it's not so easy to remove it. You have to use several spyware removal tools and try to remove this file manually with their help. Or if you find this too difficult, you can use anti-spyware or anti-virus programs.
I have the same problem. I have tried to unregister with cmd prompt in normal and safe mode but i keep getting the error "jkkjh.dll was loaded, but the DIIUnregisterServer entry point was not found. This file can not be registered." I have 3 dll files that I am trying to remove - emorakvd.dll , jkkji.dll and khffdaa.dll.
I have tried deleting them also and receive the error "file in use by other application unable to delete" I have also tried hijack this function - delete a file on restart. and this does not work either.
ahhhh! I am so frustrated!
Brandon,
Please, make sure that you have typed the correct command line. It has to be without quotation marks. For example, if you want to unregister jkkjh.dll, you have to type: regsvr32 /u jkkjh.dll and press Enter. If you get any errors post them on our comments and we will try to solve your problem.
Looks like all you guys may be trying to resolve the nasty blighter that I have contract as well! Is this relating to sypsecure or virtumonde? I have 3 dlls which are being picked up both by Bitdefender and Sophos but neither can disinfect or remove so this is the route I am heading down.
Presumably the best thing to do is to run safe mode with cmd?
got a "ugbtna.dll" in my system32, tried to unreg it thru cmd prompt, delete it thru cmd prompt, and locate it manually thru directory search and delete it, but still can't. IT'S STILL THERE, keep saying that I can't delete it -- 'access is denied'. PLEASE HELP!!!!
andy Parker,
This may be spysecure or virtumonde. What are the exact names of dll files? And yes - the best thing to do is to run safe mode with cmd.
neEDHelp,
Try to use Safe Mode for “ugbtna.dll†removal. This should solve your problem.
Try renaming the file. Rebooting. Then deleting it.
I've got that fricken ldcore.dll tearing up my computer, and even after deleting it, it keeps coming back. When I tried the regsvr32 thing, it says that ldcore.dll is not an executable and won't do anything else about it.
The weirdest thing is that I can still surf the internet, but if I try to go to any google webpage, it won't let me. Any helps?
If can't remove it in safe mode. Get UBCD4win, boot it up and manually delete it.
ldcore.dll is gone! All the posts above with the random dll names and the google search interference trace back to affiliate.exe which loads ldcore.dll and a host of random gernerated .dll names.
1. Update your virus scan and anti-spyware programs of choice.
2. Download Regrun Reanimater ( http://www.greatis.com/reanimator.zip).
3. Take your computer off the Internet. This is important as it's integral to ldcore.dll regenerating itself.
4. Run virus and spyware scans. Obviously delete everything.
5. Now for Reanimater. Yeah, it's a really hokey program. No, I don't work for them. It's in broken English, but it works. Here's why: When it finds something, it uses the pre-OS enviornment after a reboot (think checkdsk /f) to actually do the deleting so there's no access denial. I did like however, that it continues to rerun itself on boot until all infections are gone. You'll have to let this run 2 or 3 times rebooting in between (it guides you through it).
6. Re-run spyware scan to remove anything potentially still left from the ad programs ldcore.dll loads.
That did it for me. ldcore.dll, oppnt.dll, and rsp????.dll are all finally gone. Enjoy!
-Steve 😉
PS - I promptly deleted Reanimater when I was done. I dunno. I've never heard of them before and the interface was pretty child-like... but it worked for this.
hey i got the winantiviruspro 2007 virus. now many .dll files werent found and the vtr441.dll is entered as data in a registry key which also contains other files of this virus and other important files.
the prob is that this file is not on any drive but is in My Computer, and i am not being able to unregister it.
Please HELP !
my comps in for a disaster !!!
i got a windows XP.
TAZ,
Please be more specific, it's impossible that there could be any files in My Computer. The location of the infected files should be different.
taz,
I read somewhere in my quest to remove an annoying DLL file (like most of us here) that "WINANTIVIRUS PRO" is actually a virus or a spyware. (Is there, actually a difference?) And yes, I think you are in deep trouble.
I had pop ups showing the ads of several anti- spyware software including "_____doctor" or something which Mcafee also claims as a virus/ spyware but since pop- ups annoy me like a fly to a wound, I close the window before it downloads completely.
I suggest that you do more research as I still am.
Good luck!
Jen
Okay, I was just trying desperately to get rid of ldcore.dll and opnkllm.dll, both of which were reported by Norton Antivirus to be viruses. I attempted unregistering the files, but it said "Access is Denied" when I tried in normal mode, and "Unable to register" or something when it was in safe mode. However, when I rebooted in normal mode, I tried to find the files in the C:\WINDOWS\system32 folder where they were, and I could not find them. I am hopeful that somehow my attempts at destroying them worked, or more likely, they were deleted with a bunch of viruses that Norton Antivirus did delete upon the last reboot. What do you think?
Anthony,
Most likely your antivirus program deleted those infected files. If the program finds viruses, usually it can delete them. My advice for you is to update your antivirus program frequently, because the virus makers create viruses everyday and they renew very often.
I am trying to remove the dll's jkhhg.dll and cbxxutt.dll because I found they were trojan viruses with sophos anti-virus. Sophos clasifies it as Troj/Virtum-Gen.
Unfortunately I've tried 3 times to delete the virus with Sophos, and it keeps reapearing after Sophos tries to delete it, which requires a full system scan and a restart of the system.
With both of them I entered command prompt and tried to delete them, but both return the message :
xxxxx.dll was loaded but the DllUnregister Server entry point was not found.
This file can not be registered.
Does anyone have a course of action for me to take??
Has anyone that had the jkhhg.dll problem found a solution yet??
Any help is appreciated, Mark.
mark,
Did you try to boot your computer in Safe Mode? Your anti-virus program should remove these parasites if it finds them. If this won't help you, you can try to remove these files manually.
can some one help me in removing downloader.gen.a trojan. it is infected in c:\windows\system32\ldcore.dll file.
i ran mcafee fullscan, paretologic xspywarexe, regcure, vundofix. they are detecting this trojan, but cannot remove it. PLEASE HELP
My laptop got infected by Trojan Vundo and I couldn't rid it completely with the Symantec removal tools at first. It reported no Vundo found but I have the notify popup kept coming. I tried to edit the registry listed in the Symantec page but couldn't find the infected entries. Now I seem to have finally got rid of it. I am not sure which of the actions was needed but just share with you all.
I ran the removal tools again in Safe Mode (F8 when booting up). Then I go to the registry (Windows Start > Run > regedit) and Search for the trojan program names (click My Computer, menu Edit > Find / Ctrl-F, then repeat with Find Next / F3). I got the winlogon/notify, CLSID/control sets, etc infected. I removed or edited the entries. At first after I removed the entries, they were added back automatically. I also tried renaming so of the infected values. I re-ran the removal programs several time till the trojan program in system32 folder was deleted and all registry entries are cleaned.
Hope this help someone on the same boat.
sai,
It's not so easy to remove this trojan. I suggest you to try to boot your computer in Safe Mode and delete the file. If this won't help you, you have to contact the support of the program you are using to remove downloader.gen.a trojan.
This idea does not work.
NSri,
As I mentioned above to Brandon, please, make sure that you have typed the correct command line. It has to be without quotation marks. For example, if you want to unregister jkkjh.dll, you have to type: regsvr32 /u jkkjh.dll and press Enter. If you get any errors post them on our comments and we will try to solve your problem.
I have at least two dll's in \system32\, both of which popped in there today after I was dumb and ran an exe.
I tried the regedit idea, was told they can't be removed.
I tried the cmd/shutting off explorer.exe...was still told the files can't be removed.
I tried going to the files and deleting them, was told they can't be removed.
I searched my task manager/process list, found nothing out of the ordinary.
I rebooted with a boot disk and tried deleting them using cmd prompt, was told they can't be deleted.
I tried using 5 different programs made for the sole purpose of removing these files upon reboot...they never got removed.
I tried regsvr /u, was told "c:\windows\system32\filename.dll was loaded, but the DllUnregisterServer entry point was not found....This file can not be registered."
I tried using several legit spyware/adware programs, neither of which found the files...or they found the files and claimed to fix them but didn't really do so.
I tried searching add/remove programs...no out-of-the-ordinary programs running in there.
I did everything correctly, all file names and file paths were typed correctly. I must have tried all these steps at least 20 times each...just to be 100% sure, and nothing will get rid of these dll's.
I'm currently trying to track down any other exe's and dll's are now on my system...to compile a list of all the files that need to be removed.
So far there's xxyxwwu.dll, awtst.exe, awtst.dll.
If anyone has any advice at all, it would be greatly appreciated. This is the best PC I've ever built...and I hate knowing there's spyware/adware running rampant on it.
Johnny Richter,
Most likely you are having VirtuMonde or Trojan.Vundo on your computer. These parasites are widely known and it's very difficult to remove them. Your system may be infected not only with the files you have mentioned, but there can be some other infected files too. On the Internet try to search for programs which are specific for Vundo/Virtumonde removal and there are several of them. Otherwise, you can contact the support team of your anti-spyware program.
So far I have come across;
tuvojjfd.exe, awtst.dll, awtst.exe, xxyxwwu.dll, and 2 or 3 other .dll's. I've researched the different bad files, tried some more programs, contacted the companies of my two most-used anti spyware programs...still with no luck.
I just went into regedit, and did a ctrl+f search for all those file names...and deleted any key associated with them. There were many keys that were directly connected to xxyxwwu.dll and awtst.dll. Hopefully this has worked...need to reboot, then try to delete those .dlls.
Also, the I.E. popup "work offline/online" keeps showing, when nothing is running. This leads me to believe one of those files listed above is trying to access the internet.
I can not figure out what windows process these files rely on to run, but it's not explorer.exe. I went into safe mode, and ended explorer.exe...which put me at the BARE minimum of processes needed for computer to idle in safe mode. I then clicked "run" on the task manager, and entered cmd prompt, changed to system32 folder and proceeded to try and delete those bad files...still no luck...says they're being used.
Does anyone know of any sure-fire ways to rid myself of these files? Does anyone know of any anti-spyware programs that have the ability to rid of them for me? So far "delete dll after reboot" programs fail to actually delete these files, because of a certain main system file they 'leech' off of that is running constantly.
After my reboot...windows logged in all slow and choppy, then when explorer finally loaded...it didn't load my start bar. I can not sign online, sound car does not work. All I can do is view folders, and load certain windows programs.
All I did before reboot was delete ALL regedit keys that had "awtst" or "xxyxwwu" in them. I don't know if this new problem is because of those keys being deleted...or because of the virus doing something.
Either way...this is a huge problem, my pc is now a paperweight. I'm currently on my laptop, none of those keys show up in regedit.
Laptop has Win XP media center edition...PC has Win XP Pro...can I export my whole registry from my laptop to a burnable disc, then import from disc onto pc? Or is the XP M.C.E. not compatible with XP PRO? My pc has years and years worth of files that I can not lose...and it won't let me burn cd's or sign online...so if someone could help me fix this issue, it'd be much appreciated.
Nevermind, don't need the help anymore. Windows decided, after importing the complete registry from my laptop, that it didn't want to boot anymore.
Turn computer on, reaches windows logo/load screen, instantly reboots, puts me at safe mode selection screen. Any option I pick...instantly reboots and I end up at safe mode selection screen again. I can safely say there is no way to fix this issue...other than to format the hard drive and start from scratch. On the bright side, I haven't formatted since winxp pro became public...so this might do some good. Luckily my most important files were always kept on my secondary HD...my main HD only held stuff I installed which can be replaced, and a few files that were irreplaceable but not terribly important.
After these past few days I've come to the conclusion that there are some spyware dll's and exe's that rely on a system process other than explorer, that runs in normal AND safe mode. None of the above actions, nor any of the top 20 most-used actions...will work on these files. They were created for these purposes...multiply, annoy you, and permanently attach itself within your registry(try to delete the keys, and watch them pop right back up and bring their other dll/exe friends along).
Long story short...if you have the same problems...just format, and be a little safer with what you download/open/run next time around. Invest in some good anti-spyware programs, anti-virus, firewall, and definitely a process/registry blacklister(i prefer teatimer, comes with spybot s&d). Better safe than sorry, no one likes to lose everything on their hard drive over something as simple/stupid as a naughty file you opened.
I agree with JohnnyRichter, it's better to use a reliable anti-spyware program, than try to solve your problem by yourself, if you are not a computer expert. But formatting should be something you do when your computer is beyond repair. The support of your anti-spyware program should help you to remove the infection from your computer if the program can't do this.
I tried to maually unregister the toj/virtum-gen it says it loaded the foxvncvs.dll but could not unregister the path.
I've been through the same thing as JohnnyRichter and I am a programmer but not a Windows expert. My duaghter's friend visited and gave us the virus for a nice Holiday present on Dec. 30th. Some of my virus programs are called jkhfd.dll & exe.
The exe I can remove, the dll I can't.
Johnny, if you would have checked your registry after removing a bad entry, you will find like others, they come right back instantly!
I wrote my own .exe and called it jkhfd.exe and placed it in the system32 folder. My virus registry says to load this program on boot up. So, my fake-virus program has code to delete the jkhfd.dll.
I was so proud of myself for being so clever and I rebooted. Guess what? The virus laughed at me. It replaced my dummy exe with the original and the dll was not erased.
Since I've tried all anti-virus/spyware stuff with no luck, I'm hoping to get a bootable disk and try to delete it that way. I'll post back if I can figure this nasty virus out. Good luck to all.
Ok so I just got done trying your method from above. I got an error message saying LoadLibrary("jkhhg.dll")failed-Access Denied. I've tried going in through safe mode to delete it, but after like 5-10 sec it goes back to the yes go to safemode no go to restore screen. So I can't even get to where the file is to delete it. I've traced it to lsass.exe program which runs through the system rather than user. Any idea of I can try. I'm trying autorun right now with now success.
Todd,
Try to boot your computer in Safe Mode and delete foxvncvs.dll manually. There may be some other infected files instead of this one on your computer. So I advise you to scan your computer with our free scanner, which will show you the locations and names of all the infected files. And then you can delete them manually.
Virus removed!
Here's a bit of info, but it didn't do me much good:
The virus manifests itself as an Internet Explorer add-on.
Open Internet Explorer then goto Tools, Manage AddOns, Enable or Disable add-ons.
You will most likely see the virus file there, maybe on top. If you disable it, it comes right back upon reboot.
I have Symantec Anti-Virus on my PC and had tried multiple times to have it remove the virus. I updated the virus file online everyday. Last night 01-05-08, Symantec sent me an update so I immediatly ran full scan.
I could hardly believe it when it located jkhfd.dll in my windows/system32 folder.
It completed a full scan in about 2 hours. It needed a reboot (said so) to ditch this file.
I rebooted as directed and it was gone!
I checked it again today and all is clean!
Thanks Symantec for the update. I did not get a chance to try a bootable CD prior to the virus being removed.
Good luck everyone and get those UPDATES installed asap and re-run every day.
No other technique listed above worked for me and I tried them all.
I've had the same problem as Brandon, NSri and Jim. I type in my dll file and it says that the entry point was not found and the file cannot be registered. I have made sure I have typed the instructions perfectly several times. This is soo annoying, I really want to know how I can delete this zlob sh!t!!!
Wil,
Zlob files are changing very often. Are you sure, that you want to unregister the exact file, that you have to unregister? If you are not sure, first of all I suggest you to use our free scanner which will show you the names of files you have to unregister. If you are sure, that you want to unregister the exact file and you can't do this, try to boot your computer in Safe Mode and remove it manually.
i have performed the action instructed by you but it doesn't work. why don't u suggest any other way to delete such dll file?
ASHISH TANK,
These instructions should work. But if you are having any problems, you can try to remove the .dll file manually. Just boot your computer in Safe Mode and delete the .dll file. You can also use our free scanner to make sure, that you don't have any other infected files on your computer.
I ran into a similar virtumonde variant:
apparently the resident portion re-writes registry entries after you delete them; apparently changes the entry if you rename the dll to match.
I chased this dragon with spybot s&d, but that did no good on its own...
this virus puts it's hooks into IE as a BHO and explorer as an extention - hence the dll is always open for one or the other - even in safe mode, and even in command mode.
I finally got rid of this by using Windows Recovery Console - booted that, and with it's command line deleted the offending dll's. WRC is so light, it doesn't bring up the actual windows image, hence the dll's are never opened.
after deleting these I rebooted XP and ran spybot to get rid of the residual registry entries.
I highly recommend trying this; you may need an XP installation disk to install this on your computer - damn shame it doesn't come as a bootable CD.
Ok...im trying to manually delete Files Secure..I did all the steps smootly until this step.
When i typed in "DIR"...i never got the .dll
what should i do? >
Hi i kinda need some help!
I did all the steps in removing Files Secure manually until i reached thsi step.
I found the directory for the file but this is what all it had... secure .exe and uninstall .exe
i cant find the .dll
Similar problems with trying to remove unknown trojan..but this time, I cant find the location of the file
pls help!
PLEASE!!!!!!!
raprap,
You shouldn't follow the main instructions allways, because in some cases they don't fit. Scan your computer with our free SpyHunter scanner. Our scanner will find the infected files and show their locations. Afterwards boot your computer in Safe Mode and remove the infected files manually. Otherwise, get a reliable anti-spyware program, which will help you to remove the infection.
Sorry, guys, I have to dissapoint you all. As an IT specialist with 12 years of experience, and several years in field of trojan horse removal:
Regsvr32 won't work on majority of trojan DLL's for the simple reason: some of these dll don't require registration in the first place so you can unregister all of them until you blue in the face, with no effect.
When you have trojan DLL that cannot be removed by deletion in Standard or Safe mode, there are three basic ways to get rid of them:
1. Connect your hard drive to another PC as secondary drive and remove it from there. This way, you don't load your infested Windows and all its dll's are sleeping.
2. Use third party utility software like ERD Commander that boots off CD and let's you explore and remove files from your hard drive.
3. Use Windows Recovery Console from Microsoft and erase files from recovery console command prompt. You need your installation Windows disk for it.
thanks
i got a message saying "DllUnregisterServer in dntpkwomwx.dll failed. Return code was: 0x8002801c. What do u suggest i should try....
thanks in advance.
Rishi,
Just boot your computer in Safe Mode and delete this file.
JohnnyRichter's suggestion worked for me. I used Windows Recovery Console by booting from system CD, used DOS command to delete the virus file: yabbyxv.dll and it worked great. I have the Corporate version of Symantec Anti Virus with Live Update. This means I should more often than not have the latest and greatest definitions. While the software found the virus it could not do anything about it. In fact Symantec after a 1.5 online chat wanted to then hook me up with a technician who for $100.00 was sure to fix my problem. I am thankful for the suggestion and I hope others have the same fortune.
MattJ,
I have the same virus you do right now. I currently have Norton 2005 anti-virus, I don't know if that makes a difference but I'm feeling it might. I have updated over and over, used the tools it gives so forth and so on, but I have yet to get rid of it. It has said removed just reboot but then it comes back up. So if anyone has any ideas, I really don't wan to reformat.
HellMaker,
I suggest you to boot your computer in Safe Mode and scan with your anti-virus program. Maybe it will find something that couldn't find in Normal Mode. Otherwise you can use our free scanner. Scan your computer and it will show the locations of the infected files. Afterwards boot your computer in Safe Mode and delete the infected files.
cd.dll was loaded, but the DLLUnregisterServer Entry point was not found.
This File can not be registered.
All I want to do is delete this BHO, and I can not. Much like the 40 other people who replied.
I too tried the obvious: safe mode, did not use "quotes", etc, etc.
Maybe I should open up my hard drive and scratch it where the cd.dll file is ?
very good it helped me a lot
Mike,
There may be other infected files, which don't let you to remove this .dll file. I suggest you to scan your computer with our free SpyHunter scanner and see the locations of the infected files. Afterwards, boot your computer in Safe Mode and delete all the infected files with Shift+Del. The other way is to connect your hard drive to other PC and remove the .dll. Otherwise, use a reliable anti-spyware program.
I have a problem. Can not open http://www.yahoo.com and http://www.yahoomail.com. Seems to be due to virus. During virus scan found starware.dll as adware found threat. How to remove it?
Umesh,
Try to scan your computer with our free SpyHunter scanner, because it may be, that you are having some more infected files on your computer. Our scanner will find the infected files and show their locations. Afterwards, boot your computer in Safe Mode and detele the infected files.
i've tired it,but cant remove the file RXToolbar.dll and ND2FNBAR.dll..
it seems like the regsvr32 had a problem..the error occur "regsvr32 is not recognized as an internal or external command,operable program or batch file"
pls help me..to resolve this problem
thank you
I have an xxyyaxx.dll in my system 32 folder. I cannot unregister it because of the same problem that brandon and dadun have, an error message comes up. In safe mode, the file still will not delete. All antivirus programs I have tried fail to delete it, which include: Norton Antivirus, VundoFix, Symantic Vundo Remover, and HouseCall. Whenever i try to delete it it says that it cannot because the file is currently being used. I can delete all other vundo except this particular file. I removed the internet connection because each time i connect, xxyyaxx creates random .dll's and that cause annoying pop ups. Also, these pos.tmp files randomly fill up the C: drive, and any user that accesses the internet's My documents folder. if anyone could help find a program or way to delete this file, please help me.
Me,
Try to scan your computer with our Free SpyHunter scanner, to make sure that you're not having some more infected files on your computer. Our scanner will detect the infected files and show their locations, so all you'll have to do is to delete them from Safe Mode. Otherwise, use a reliable anti-spyware program.
Steve,
You should search for anti-spyware Company, which is doing a remote assistance. Because this is one of the most difficult infections and only a computer savvy can delete this infection. It is very hard to explain how to remove this infection.
Thanks ghostrider01. I put my hard drive in another computer as a primary slave and deleted the the virus. Thanks for your advice.
I have Avast! as my anti-virus, and everytime i log on the computer, this message appears:
---------------------------------------------
A TROJAN HORSE WAS FOUND!
There is no reason to panic, though. Try to follow the given advice and links.
File name: C:\WINDOWS\system32\dxtran.dll\[UPX]
Malware name: Win32:BHO-KD [Trj]
Malware type: Trojan Horse
VPS version: 080224-0, 02/24/2008
Available Actions:
[Move/ Rename...] [Delete...] [Move to Chest]
Recommended action: Move to chest
------------------------------------------------------------
I tried all three actions, but this message appears:
--------------------------------------------------------
Cannot Delete dxtran: Access is denied
--------------------------------------------------------
I downloaded REGSVR32.EXE, and followed the steps, tried "C:\WINDOWS\system32>regsvr32 /u dxtran.ddl" but this message appears:
----------------------------------------------------------------------------------------
LoadLibrary("dxtran.ddl") failed - The specific module could not be found.
---------------------------------------------------------------------------------------
NEED HELP!!!!
Alex,
Contact Avast to see why it can't do "move to chest" for the file and if they can't fix the problem get another program.
i just did a serch on my computer for system32 and it came back with alot of different things but i serched for things that were created today and i found to...
WinDmy.dll and WinNB58.dll
they were bother created 3/15/08 @ 345 pm, modified 3/15/08 @ 345pm, but winnb58.dll was accassed @ 449pm 3/15/08
do these things hav anything to do with the mirar tolbar???? can sumone please help me befor i system reboot my laptop and loose all my data
Hi I have a etlrlws tool bar i have no idea how to get rid of this can anyone help
bob was correct. To get rid of a Vundo-type Explorer Addon .dll, you have to use the Windows Recovery Console. Here's how (at least for WindowsXP SP2):
1. Insert your WindowsXP disc (my computer is a Dell laptop; I had to request an OS disc from Dell Support)
2. Press any key to boot from CD (if you don't see this message, you may have to change your boot order; Press F2 at the beginning of boot to bring up the menu)
3. After the necessary drivers load, press r to load the Windows Recovery Console
4. Type (w/out quotes) "cd C:\WINDOWS\System32"
5. Type (w/out quotes) "DELETE " (whatever your bug's name is; IMHO HijackThis is the best utility for locating it/them).
6. Type EXIT
7. Reboot in Normal mode and verify that the file is gone.
8. Be more careful next time about what websites you visit.
Tried Bob's suggestion of using the Windows Recovery Console and it was a great suggestion. Was able to delete the dll's that I could not delete before. Problem solved.
The .dll files cannot be deleted when windows is running
if its the vundo trojan heres how I got rid of it
1. download process explorer
2. open up anti-virus software but don't start the scan (I use mcafee)
3 open process explorer and suspend (right click and hit suspend) winlogon.exe rundll.exe and explorer.exe processes.
4. scan system with anti-virus it should find the little swine(s) but due to the nature of the infection it probably won't clean or delete it.
5. when the scan is finished shut down the pc (you will have to do a hard reset, hold the power button down until pc stops.
6. re-strart computer and hey presto. It worked for me
I got the same as Birdman7. Error "LoadLibrary ("awtqn.dll")failed- Access Denied". What should i do?
What I needed todo, to unload some nasty .dll's was this:
Get Unlocker and "Unlock ALL files that the particular .dll file is loading with, in my case it was winlogon.exe, after the dll is unlocked or unloaded, you can open up a cmd prompt real quick and regsvr32 /u filename.dll then del filename.dll right after, this should remove pretty much all loaded or in use .dll's.
Hope this helps...
noneck
geBsttqq.dll .....what kinda adware is this?how to get rid of it?
noneck's solution worked for me, but it was ugly. In safe mode, using unlocker caused the locking processes to crash, but I WAS able to delete the troublesome DLL before Windows restarted.
Noneck,
would you please explain how to do that?.. I have a virus called rqRKdDvV.dll and cannot delete it... Thanks!
I have vcmgcd.dll in my PC in "D:\WINDOWS\system32\" and i too performed the same instructions but I have the same Problem as Dan - "jkkjh.dll was loaded, but the DIIUnregisterServer entry point was not found.
This file can not be registered."
BUT instead of the "jkkjh.dll", I had "vcmgcd32.dll" in the message.
PLSSSSSS HELP ME!!!!!!!!!!!
ANY HELP WILL BE GREATLY APPRECIATED.
OK, I got this one too.....bugs crawing on the screen, repeated tries at accessing the intenet, fake alert to sign-up for "Advanced xp defender" or "Advanced xp fixer"....same as JohnnyRichter. I tried the safe mode regsvr32 unregister and tried to delete the programs from the dos prompt also, but to no avail. I am going to try bob's method (post jan.15) of using the "Window Recovery Console" tonite; Also, you can find the whole recap on this trojan on the McAfee website under malware threats...look for "FakeAlert-AG" discovered 2/2008. I'll let you know what happens....thanks
i've had the same problem n was able to remove it with a windows boot disk (floppy). assuming u have a floppy drive -- insert floppy, open my computer, right-click the floppy, go to Format, check the box "create an MS-DOS startup disk". when it's done restart the PC with floppy in. if your BIOS is setup to boot from floppy first it will take you into a dos environment where i was able to delete the files. good luck
I’ve been doing everything possible trying to remove virtumonde dll-file from c:\windows\system32 directory. It did not work with delete function, Killbox caused multiplication of virtumonde-files, it did not work with command prompt (cmd, regedit), spysweeper, vundofix and ad-aware didn’t detect it, spybot, bitdefender and onecare.live couldn’t delete it.
I managed to destroy it with F-Vmonde from F-Secure in safe mode. Hope it works for you also. Good luck!
this works! Be sure of what you are deleting first......
I had this same problem as a result of Vundo, BestOffers, and WebBuying. I used Trend Miicro Housecall, but it would not completely remove, then I used FixVundo, but still had some files not removed. I knew approx when the problem originated by the performance of the computer so I did a search for all files created in that time window. I found the remaining dll's, in this case it was 2 files in the System32 folder named urqPiIbA.dll and fccdbCVo.dll. Unable to delete these files I tried in Safe mode to no avail. I then tried to unregister them by using the Command Prompt. That did not work either. I tried again in Safe Mode, still did not work.
Finally this is what worked, I made a MS-DOS start up disk, put a floppy in the "A" drive, go to "format" select "create an MS-DOS start up disk. When finished, Leave the disk in the drive and restart. Windows wil not be started, instead MS-DOS starts up with the "A" directory listed then the command prompt. Type in "cd" space, then the name of the directory where the files are located. Then at the command prompt type "del" space, then the file name with extention exactly as windows shows it, such as "urqOiIbA.dll" then hit "enter".
Repeat this for each file you wish to delete. Then remove the disk and reboot, the files will be gone.
Hi i have an issue with an IE Addon
the file is humouprr.dll
i tried using the command as posted at the begining but it says
humouprr.dll was loaded, but the DIIUnregisterServer entry point was not found.
This file can not be registered
I try deleting it in safe-mode but no success
I scanned it with AVG Anti-Virus 8.0, McAfee, Avast Pro, etc....
nothing helps and everytime i open IE7 websites keep popping up
I know this file has something to do with pop-ups
also, there were a few other .dll files wich i cannot delete either but was able to disable it
through the enable or disable addons from the tools menu
these are the files
1- tuvWnnMe.dll
2- ssqRLCro.dll
I was also able to delete these files
1- robgovxe.dll
2- beeqlkmj.dll
3- kcntnkdm.exe
4- arpb.exe
5- jmwnw64p.exe
6- 13283.exe
those six files were completely removed in safe-mode
if anyone can help me delete the 3 files i would really appreciate it because i tried
everything i can and really im about to crack
these are trhe three files again just in case
1- tuvWnnMe.dll
2- ssqRLCro.dll
3- uhmouprr.dll
i have searched online and found nothing on these three files
SOMEBODY PLEASE HELP ME
sorry misspelled one of them
its uhmouprr.dll
thats the one i cant disable and delete
ah
my laptop i believe had a file like this and when i removed it with spybot it wouldnt work along with other virus's. when i restarted my laptop it didnt start again. my laptop is hp nc6000. when i try start it it shows a blue led light from my wireless and a red led light from my charging thigy makes some noise showing that the computer is starting and then stops completely again what happened????
before this happened my start menu and desktop wasnt working and i started programs through task manager.
Hi.
I have a very serious trojan/virus in my computer. I even just did a reformat last night and still have it. I'm wondering if it's coming from my slave drive? Or just got unlucky by getting again from installing PowerIso again because when I scanned my drive it found spyware in that folder.
These are the locations and names of the files.
C:\Windows\system32
iifeeBQh.dll
rqRIaYsr.dll
rsYaIRqr.ini
Now whenever I boot up i sometimes see multiple processes of rundll32.exe.
Also when I load up internet explorer I notice lag ticks before the page loads. This obviously isn't normal because I have 4gb of ram and a dual-core processor.
If anyone can recommend some really solid virus scanner / spyware removal programs, please post them here.
help!!,
This has become an issue with the hp nc6000. Your laptop's motherboard is broken, it seems to be a problem around the cpu socket area. The hp nc6000 version of board generate this issue over time.
Dear friends:
In my case I had a problem with this file: “wvUmmjkh.dll†so I had to do these things to delete it at all.
1-Download the software “Unlocker†in this link:
h{t}{t}p://download.com/Unlocker/3000-2248_4-10493998.html?tag=lst-1&cdlPid=10838644
2-Restart the computer in Safe Mode (when restart press F8).
3-Once the computer is ready again I went to the directory:
C:\windows\system32\wvUmmjkh.dll and “put the trash can very close†from the file to be deleted, I did it like this because the infected file was linked with the winlogon.exe and the explorer.exe and I had no option as fast as this.
4-Use the “Unlocker†software with the infected file and unlock all the files linked to the virus or spyware. In this moment you have to be very fast and throw the file into the trash basket, if you don’t make it fast, the computer is going to restart (in my case, because I was killing to important processes: winlogon.exe and explorer.exe) and you’ll miss the chance to make it in one simple try, I think that you have 2 or 3 seconds to do this action.
5-Once you finished deleting the file I had to download another program called “HijackThisâ€:
h{t}{t}p://download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html?tag=lst-1&cdlPid=10781312
and began to make a “Do a system scan only†of the disk. When it finished you can see a list of all processes running in your machine, in my case the file “wvUmmjkh.dll†was with an indication of “missing file†so the only thing that I had to do to end all this was to delete the registry who belonged to it, very simply, just check the box and press “fix checked†and the registry will be inmediatly erased.
Just in case, with “HijackThis†you have an option of “Delete on Rebootâ€, in some cases it works and sometimes not.
My best regards, Milton Martorella.
I don't have a Trojan/virus, I'm just trying to remove an annoying plug-in. I downloaded ReplayMusic3.0 and there's a plug-in named "RM PlugIn.dll" that pops a box up everytime I play a song on my computer. I'm trying to delete the DLL file, but I get this:
---------------------------------------------------------------------------------
RegSvr32
LoadLibrary("RM") failed - The specified module could not be found.
---------------------------------------------------------------------------------
This is the file name: RM PlugIn.dll
Any help??
Hi All,
I was just given a mates computer that was infected with spyware, found the offending dll`s, then booted from a linux live CD.
Navigated to the dll`s in question and deleted them.
Rebooted back into windows and all`s good.
I got AcXtrnel.dll as REN file and its not being removed from my system.There is mess as "LOCALS~1\Temp\wmsetup.dll" file but i am not able to locate it in any of my TEMP folder.How to remove this Trojan Virus?Is this atrojan Virus or something else.Plzz anyone help me out in getting rid of this problem.
I am having similar issues as all of the above people with the file urqpmlda.dll.
Does anyone have any idea or know of some spyware/virus software that will remove it. I run and update automatically Trend everyday. Looking for suggestions before I format the drive. Fortunately, I have all important files backed up on an external drive which I have now removed. Running XP home sp2
HOW TO REMOVE BAD DLL's.....
Firstly, you need to see if you've got some, so download and run process explorer from sysinternals.
Run process explorer. it looks a bit complicated, but dont worry, i'll talk you through it.
*You will need an XP install disk to contnue, unless you have windows recovery console loaded as a boot option*
Examine the Processes column in process explorer. You are looking for processes called rundll32.exe.
There are likely to be a few occurences of this process, but the dead giveaway between a good one and a bad one is that the bad [virus generated] ones have totally randomly generated names, like mkwvnax.dll or bipdquex.dll.
You will see that many people have posted the "names" of their particular bad dll's up, but this will not help, because, as like I am explaining, they tend to have unique and randomly generated names.
The good dll's [ones used by your legitimate programs] may seem to have random-ish names, but experienced users will spot good ones straight away. For this reason, and to prevent deletion of needed files, ALWAYS run the name through google, simply as mkjwvnax.dll for example. If no results come up, then it's definitely a bad one and should be removed.
CAREFULLY write down the offending dll's name [there may be more than one!].
Restart your machine, and run Windows Recovery Console [Google is your friend here! it can take a little while to set up]
When the console has loaded you will need to enter the administrator password. Do so.
To remove the bad dll's simply type:
del C:\windows\system32\mkjwvnax.dll hit enter.
If no error messages pop up, then BINGO! You just killed yourself a bad dll! Haxorz 0 - Good guys 1.
Happy hunting!
I should have mentioned that to see the "name" of the dll in process explorer, all you need to do is hover the mouse pointer over the rundll.32 process in the left hand column and it wil appear as a tool tip.
Further information can be gained by going to the VIEW MENU > SHOW LOWER PANE > LOWER PANE VIEW > DLL's.
Look for the dll in the lower pane as indicated by the tool tip. If the lower pane shows no further info, like manufacturer name, or a description, it is probably a bad one. Hackers don't lke to leave a calling card!
Hi, I have got a file in my windows system32 which basically doesn't let my browser go on google or on some websites. It also has an impact on my msn as I am no longer able to log-in. I have virgin broadband which is on live update so file definitions are at its best. I am far from a computer expert but I know that I want to get these stupid dll files which sad little geeks create to satisfy themselves as their parent's neglect them from any social interaction. As you can see I am very fustrated because it is so pointless for them to make these stupid files which muck up your computer. I have tried the old.. windows explorer... delete but obviously says it is being used by one or more programs.. unable to delete. I am sick of using free scanners because the end result is ! we have found 5000 errors on ur computer but to delete them u must register. Click register .... $50... So basically is there a quick, painless way I can remove these files. From the above Windows Recovery Console seems the best, but I don't think I will be able to do it and probably do more harm myself than the files. Any suggestions or could someone please explain the Windows Recovery Console as if you was explaining it to a 10 year old please ! : ) Much appreciated thanks for your time !!
Hi..
Try this out, it will works !!
1st method ( which is the most simply and easy way to remove those bad .dll files )
- use floopy or cd room to boot up ur pc ( do this to prevent ur pc load the winlogon.exe, and explorer.exe , coz all those dll is injected to both of processes i mentioned above ).
- and if u do it right, u will on command prompt, navigate to where's the .dll files u want to delete, for example : C:\Windows\system32 >
- after that, just simply delete the dll files for example : C:\windows\system32\del 'files_name'.dll ( without quote )
- and finally, booting up normally and clean up your registry ( u can clean manually or use a registry cleaner software ) , my reccomendation : hijackthis.
- after that, restart your pc and enjoy.
2nd method ( more hard -> for someone who doesnt have a floppy disk or a cdrom drive )
- 1st u need to kill explorer.exe and winlogon.exe ( both process that makes ur dll can't be deleted while still running ), ps: u can use various system tools to kill that process, but be careful becoz u r going to kill and importance process for windows (winlogon.exe)
- so u have kind of 60 seconds to delete all those bad .dll files, do it quickly !!
- and after u deleted all, clean up ur registry , and then restart
- enjoy
-noki
what do you know about this dll file. It is killing my kids pc. jkkhbtmg.dll. My virus program could not remove it. Said I should delete it. Each time I do, it says it is being used by another application. I think this was part of the trojan vundo.cum.
Got a lead on how to wipe this bad boy out.
ConHook?
Does anyone know about this Trojan?
I have found a lot of different information about it, so I am a bit confused.
But I can tell that I have tried "every singel one" antivirusprogram. Some of them registrate it, and if they do, they won't get rid of it. The rest of antivirusprograms can't registrate it at all.
Windows defence says it is "Trojan:Win32/ConHook.I",
My Spybot - Search and Destroy is poping up and giving me a message where I can choose what to do and what it does, and other "Greece" stuff.
the World Wide Web says it is a kind of downloader...
- Can anyone help me? Anyone with experience about ConHook.I?
Thanks,
Snorre, Norway
If you want to delete stubborn files from your computer easily, I recommend the following method. A bit of fair warning, this method is for people with at least a working knowledge of computers ONLY. Those attempting to perform this method, and who are computer illiterate, could potentially delete vital system components and cause a violent system shutdown. You have been warned...
1. Locate the files/folders that require deletion and write down the complete file name as well as the folder name on a piece of paper. Make sure you are aware of where the file/folder is located i.e. Program Files, Documents and Settings, etc.
2. Go to Start -> Run -> Type "cmd" and press Ok. A black box with white text should appear.
3.Press alt+ctrl+delete and when a box appears click Task Manager. Make sure all programs EXCEPT for "cmd" are closed. While in Task Manager, click on the processes tab. Scroll down until you see a process called "explorer.exe". Right click "explorer.exe" and then click "End Process". You should notice your Start Menu as well as your desktop background and icons disappear. Minimize Task Manager.
4. In the "cmd" box locate your files or folders manually. If you need to change folders or subfolders, use the "cd" command and press Enter, example:
C:\Documents and Settings\Owner> cd C:\Program Files
C:\Program Files>
If your file is in a subfolder of Program Files, Documents and Settings, etc., use the "cd" command again followed by the Enter key, example:
C:\Program Files> cd SPYWARE
C:\Program Files\SPYWARE>
Type the COMPLETE filename into the box, prefixed by the phrase "del", and press Enter, example:
C:\Program Files\SPYWARE> del BADFILE.exe
If the file was successfully deleted, no confirmation message should appear. If you attempt to delete an entire folder a prompt will appear asking you if you are sure. If Windows could not delete the file, an error message will appear. If the message states that Windows could not locate the file or that no file by that name could be found, go back to the beginning of Step 4 and make sure you are looking in the correct folder and sub-folder.
5. Press alt+tab. Task Manager should reappear. If it doesn't, press alt+ctrl+del and select Task Manager. Right below the top of the Task Manager box you should see a row of dropdown menus; File, Options, View, Help. Click on File -> New Task (Run...). A box should appear. Type "explorer.exe" into the box and click Ok. Everything should return to normal.
If this method did not work for you or you have any questions or concerns, feel free to email me. I have an extensive knowledge of computers and can assist in deleting spyware, adware, or viruses easily.
Hi, i am not the computer genious, but i have the shoppingreport.dll spyware on my computer and i need to get rid of it. I followed the info above exactly buuut, when i finally puch enter to remoce the dll file it says "loadlibrary(shoppingreport.dll)failed-cannot find the assigned module... i am very sad 🙁 plz help me
I also found out that i have trojan.popuper and trojan.virtumonde.. i think i will reboot my computer, coz i have no experience of manually spyware removal.. but if someone hav a very good guide plz tell me
And zlob.trojan
how can i delete the credu.dll file in system32 ? it is infected with a trojan and I tried everything but it just won't get deleted?
Off topic but who the hell actually benefits from infecting other people's computers with their VirtuMonde or whatever-the-hell-it's-called crap? I would *really* love to know that. Someone needs to beat the sh*t out of those morons. Sorry for the language but it looks like i'll be better off reinstalling Windows and that p**ses me off big time. I've always been enormously careful, ran and updated my antivirus, ran Spybot, Windows Updates and so on. And now this. The Internet is getting ever nastier. I'd run Solaris or BSD on my laptop if it weren't for that X11 piece of cr*p they include, and the fact that I need Windows for several purposes and due to hardware issues. Oh well. Anyways, thanks for all this info on your website, guys. Great job, keep it up.
I have the same problem as Jim (November 2007)
I managed to delete .dll files and the anti virus and anti spyware does not detects anything, but any i search on google leads to the wrong link. Some secure webpages will not load e.g mcafee.com and support.microsoft.com. Can you help?
I have the same problem as "Jim November 4th, 2007 at 1:21 am", I had dll that I couldn't delete (not even safe mode would delete it), it would be detected deleted at startup but was still there. I solved the this problem by rebooting to the recovery console and deleting. this worked. no more pop ups but the google search links still redirect to a different link. Can you help about the google link problem.
All you have to do is right click on the .dll file.
click share and remove your sharing rights.
delete the .dll file and it will just leave you alond
My laptop was infected by virtumonde so a couple of dlls were created in my system32 folder they appear when i use the manage add-ons tool but can't be disabled. Spybot can't get rid of them and when i try to delete them manually i get that in use can't delete message. Using this method gives me that 'was loaded, but the DIIUnregisterServer entry point was not found' message so i guess that means the same thing as you can't delete them when they are being used.
I was going to use the method suggested by matt but they are loaded as modules of winlogon and lsass not explorer so i doubt it will work.
Looks like i'm back to square one.
ok i am sorry to waste your time i am unexperienced with computers , it appears all i had to do was restart , then i could drag the folder str8 to the rcycle , i guess this is what unregistering allows , sorry for wasting spac e on this board , as i said i am new to this stuff but learning fast thanks o this board , keep up the good work you have helped me mroe than i can say and owe you many thanks
All,
I had the same problems that several of you reported...couldn't remove a dll because it was in use and everytime I removed the registry entries they came back. Here are the steps I completed to successfully remove it:
reboot in safe mode
try to delete the file (mine wouldn't allow me to)
rename the file (mine allowed me to do this)
reboot again in safe mode
try to delete the file (mine worked this time!)
remove the registry entries, and they were gone for good this time
I hope this helps everyone.
upon start up my computer tells me that this is not a windows application and can't be ran. How do I get rid of this? This has slowed my laptop down to the point where if I want to open any application it takes 3 to 5 minutes if I don't have to try and open it several times. DLLC:1PROGRA~1\MYWEBS~1\bar\2.bin1M3PLUGIN.DLL
This worked for me:
Boot in safe mode with command prompt.
Delete the dll file from the command window
Hey,
I have the virus agcutils.dll, I have tried to remove it manually but I dont know which files to remove.
Tool>Manage Add-ons>Enable or Disable Add-ons.
But the problem is I dont know which ones to remove. Also, Im not very computer litterate so that might be part of the problem. Is there any way I can know which add ons to delete?
(This is my second time trying to write this because the virus crashes my internet explorer)
Sorry wrong post. This is the one
http://s70.photobucket.com/albums/i118/Missionoftri/?action=view¤t=viruscopy.jpg
Hi I have a dll file which nothing seems able to remove from my system and it is driving me insane. It is opdjrv.dll and nothing upon nothing will remove it. has anyone got any suggestions how I can get rid of it.
Thanks
Hi this Jimmy from India, here i want to thank Mr. Milton who gave an ultimate solution to this dangerous problem. Thank you very much once again Mr. Milton and I suggest and recommend everybody to follow the steps given by Mr. Milton. Believe me its a sure shot solution to disgusting .dll files. Every other solutions did not work for me. Thanx to Mr. Milton and http://www.spywareremove.com... you rockkkkk...
arghhh! my pc automatically shuts off after the window command prompt opens.. how can i remove these dll files then???
For those that cannot delete files that they *know* they want gone due to malware evilness and all previously mentioned attempts fail, visit knoppix.net to download an .iso of Knoppix Linux. Download, burn to CD (not the iso, make sure to write the iso) boot from CD. It is linux that runs from a bootable CD and will allow you to browse a windows partition and delete the files in most cases. Good luck!
If anyone know how to find and remove trojan from
C:/windows/system32/netprp.dll - a variant od win32/spy.goldun.NDW trojan
please let me know at mail:
grad[at]cg.yu
thanx
"Loadlibrary 'sqlserver.dll' failed. Access denied."
i got this error message as my pop up. help me plsss
Persistent random .dll trojan removal SOLVED
For some very persistent trojans, the "Reboot in Safe mode/unregister/delete DLLs" doesn't work. This was true for a random .dll/ini generating trojan that showed itself as an IE (6) add-on as a random .dll. The only way I've been able to remove this from my machine is
1. Boot into a recovery console
2. cd \windows\system32
3. dir *.dll
4. Copy every dll with today's date into a "bad" folder, and then delete them ("move" not supported by recovery console).
I know this is not convenient, as a Windows restore CD is required, but no matter how many times I unregistered these .dlls in Safe Mode, deleted them, or took them out of the IE add-ons menu or registry start-up, they kept coming back. Now I'm clean.
My millions thanks go to Jimmy from India, and Milton, and of cause, this Website. Because of you, I finally remove the evil jkkkCRKB.dll file.
1. Downloading the unlocker program.
2. Reboot to the safe mode
3. Run cmd (Comman Prompt) from the Start button. Try to delete the dll file - del jkkkCRKB.dll, and you can.t, since ...
4. Then right-click the evil dll file, select unlocker. Then you know which processes linked to the evil dll file.
5. Kill the associated processes. In my case, two processes: explore.exe and winlogon.exe.
6. In Comman Prompt, delete the dll file again. It works THIS TIME.
Happy New Year to you ALL. John
i have windows xp and i dont know what i downloaded but in C:\windows\system32 there is something called WlanGINA.dll and it causes me to not be able to use the advanced log in welcome screen and user switching which is annoying because it is a shared computer i have tried the run cmd regsvr32 way of deleting it but it doesnt work because it says WlanGINA.dll ws loaded, but the DllUnregisterServer entry point was not found. This file can not be registered
is there any way i can find out what program installed it and delete the entire program or erase just the file or even override it not letting me use the welcome screen because as far as i know that is the only problem
now i have been having problems with internet explorer every hour or so i will be connected to the internet but it wont show any pages except the error page and it is more frequent.
what pathetic loser would send viruses over the internet to destroy peoples computers at no benefit besides knowing that they caused problems i mean what is wrong with these losers
any help will be apreciated
Hi All,
I was try this :
regsvr32 /u haozs0.dll
but this error occurred:
haozs0.dll was loaded but the DllUnregisterServer entry point was not found.
this file can not be registered.
The solution I found was booting in Safe Mode, turning off Inherited permissions for the suspect DLL file, deleting the Everyone permission on this DLL file, setting a System Deny All permission on this DLL file, and giving myself full Allow, then reboot in Safe Mode again, delete the DLL file and delete any instances of it from the registry.
i have the iifedcca.dll and maybe another, (haven't tried to delete the other until if figure how to delete this one). i stopped the popups by going to Tools, Internet Options, Advance, unchecking Third Party Browser Extentions then restarting. i lost my 'Y'ahoo quick reference browser icon (but still have the basic yahoo toolbar) and the Google toolbar, only temporarily, until i figure out how to delete the dll. now, i have no popups. apparently, google and 'Y' toolbars and the unwanted popups work on the same 3rd party premise this dll creates. now i can work on this problem without being annoyed. hope this helps. keep the delete suggestions comming.
Not 100% out of the woods yet, but i had a VUNDO on my system until about 5 minutes ago. I looked it up by following the path manually, one by one through the c drive, to systems 32, to the ooocvw.dll file, then i put it on my desktop. After that, I changed the name and rebooted my computer. It came right off after that, now I can download automatic updates and put up my firewalls successfully again. W00h00! Hope this helps...
Hi everybody *******to remove those annoying .dll files that were infected by the almighty trojan virus...refer back to the posting of March 18th 2008 from bscholesboogie i did that and it worked awsome.
Help! 🙁
I have the ever evill
ntdll64.dll
on
C:\WINDOWS\system32
i hate it and every time i try to remove it in the command prompt it never works right for me
i tried to follow everything in the command prompt that http://www.spywareremove.com/removentdll64dll.html told me but it says that it "is not recognized as an internal or external command, operable program or batch file".
plase help me!!!
step by step would greatly appreciated! 🙂
I inadvertantly downloaded a backdoor trojan that created a "usrcntra32.dll" file in my Sys32 directory. It would not let me edit the registry or even access the Symantec web site. Of course it wouldn't let me delete it either.
What I finally had to do to get rid of it was to use a dos-based file manager program (On Hiren's Boot CD v6.0).
I have always used Fat32 as my file system, and once again, was glad I do. I booted to the CD and opened one of the 6 file management programs on the CD. I deleted the file.
Then I re-booted into safe mode as administrator, ran regedit and deleted all entries found with that file name.
Re-booted normally into XP and the file was finally gone and did not return.
Easy fix everyone, do it often - too much.
1. Sort the files in Windows\system32 by date modifed.
2. record the names fo the files, there are .ini files usually too.
2b. Open IE choose TOOLS - MANAGE ADDONS and disable the similar named DLL's loaded as addons.
3. Boot with a Windows XP or Vista CDROM (or many other boot CDROMS).
4. Choose R during boot for Repair, then go to the CONSOLE - DO NOT REPAIR IT !!!
5. Wait for the keyboard prompt to finish then logon with Administrator password
6. Browse to Windows\System32 - and delete the files - i usually do a DIR F* for files taht begin with "F", etc.
7. Type DEL NAME_OF_FILE
8. When finished- reboot, they are gone.
9. Then I usually download Spybot S&D or Similar to cleanup the rest
10. go into IE - TOOLS - INTERNET OPTIONS and last two tabs - reset everything.
Works every time -
I also picked up one of the TR/VundoGen trojans called pmnlligh.dll in my System32 folder and tried most of the techniques mentioned in this very helpful thread. Unfortunately the Unlocker trick didn't work even moving the Recycle Bin right next to the file in SafeMode, because my quickest movement taking less than 1 second set off the error messages and repeatedly blocked it from a successful conclusion. I didn't have an OEM Win XP disk, only a Dell XP disk that seemed to lack the Windows Recovery Console application completely. So if anyone has this "difficult to remove", unwanted dll problem in a DELL Computer, I stumbled on an easy solution. If you can figure out how to enter UPON BOOTUP the tiny built-in Norton Ghost partition on your Dell hard drive (NOT the Dell section for hardware), and fumble around with the unfamiliar dialog boxes and buttons, you will find a complete mini layout of your hard drive without any of the main windows drivers running yet. I was easily able to delete the troublesome dll without any argument. I can't find any mention of this secret compartment in the Dell literature. Maybe some sharp person on Dell Computers on this thread can tell us how to go into the partition the right way since it is so helpful!
am not able to remove some drivers from my PC. i had installed internet download manager and the trial period of 30 days expired. an error message is always appearing on my desktop saying some system files got corrupted by the IDM. i want to completely remove the IDM files from my PC. please help.thanks
i have a virus fakealert and .vbs agent which is basically the same one i think the fake alert has win32 and dll
i cant remove it because it says that can cause system instability and avg free ont remove it how do i remove please help me
also i think this virus shut down my security then 2 seconds later my update finished(for windows and avg) and they turned right back on. pls help im freaking nervous >
Thanks bscholesboogie, This worked for me after I found the dll files were really killing my computer.
First I couldn't get rid of them, then I found your post.
It worked the first time.
Thanks,
Steve
# bscholesboogie Says:
March 18th, 2008 at 6:44 pm
bob was correct. To get rid of a Vundo-type Explorer Addon .dll, you have to use the Windows Recovery Console. Here's how (at least for WindowsXP SP2):
1. Insert your WindowsXP disc (my computer is a Dell laptop; I had to request an OS disc from Dell Support)
2. Press any key to boot from CD (if you don't see this message, you may have to change your boot order; Press F2 at the beginning of boot to bring up the menu)
3. After the necessary drivers load, press r to load the Windows Recovery Console
4. Type (w/out quotes) cd C:\WINDOWS\System32
5. Type (w/out quotes) DELETE (whatever your bug's name is; IMHO HijackThis is the best utility for locating it/them).
6. Type EXIT
7. Reboot in Normal mode and verify that the file is gone.
8. Be more careful next time about what websites you visit.
Hi
I daily need to register number of dll files before open a secure site. ofter register the files it work but when system restart we need to register the files again , what the setting so that files are registere permanently........
I've got the dll "ddcBUkjH.dll" (C:\Windows\System32\ddcBUkjH.dll), Trend says its a TROJ_GENERIC.DIT.
Cant seem to remove it with the regsvr. HELP!
I have 2 .dll files on my pc that look very dodgy and start up as a internet explorer add on even after i disable them. the two files are:
jkyxom.dll
yijokuwu.dll
the second one of which has a creatin date of 01/01/1601 :S
tried your advice but aparently the files cant be registered. it says on my manage add-ons section that the two files are in my windows\system32 folder but I cant find them and neither can my pc.
help please 😀
thank you
I need help I have a dll file that keeps showing "something" within it. I am freaking out! SDmodul.dll everytime i try to find it manually it means access denied I have no clue how to remove this thing and apparently its been in my computer since 2007 and Im lost. Any help would be great appreciated.
I get the pop up ' The applicaton or DLL C: WINDOWS system 32 lozohana.dll is not a valid windows image. Please check this agaisnt your installation diskette. '
Safe mode hasn't worked, when I reboot it pops up again, and my anti virus has detected 'vondu' among other things but this has continued.
Please Help!!
THANK YOU VERY MUCH 4 THE INFORMATION!!!! FINALLY!!! After HOURS looking on USELESS forums n trying to find ANY removal program that could help me to delete a F****** dll, I finally did it! Im not sure if it will work 4 all of them but in my case was SIMPLE N EASY! Congratulations n TYVM AGAIN!!
I have this virus of some sort, wstutzer.dll. Tryed to delete it through cmd,regsvr32,but it says access denied.My antivirus picks it up very frequently,and also says access denied when it tries to delete it.Have anybody seen this dll. before?Can somebody guide me in a way so I can delete this? Greatly appreciated!!
plz help i figure it out the sality exe file in drive D which was the xvl.pdf.. then how i can find the sality Dll only..
what software can detect only the sality dll.. and not the sality exe file.. so that I can unrgstrd in regsvr32..
Plzzz. help me......
it gives error like" module "spp.dll" was loaded but call to DllUnregisterServer failed with error 0*80070005."
it's working..
sorry...but i omitted the word "not" on my first message...actually it's not really working...i always fail deleting the personal anti-virus.
Thanks to bscholesboogie.
If i may add though, you can verify if the bugs that you've deleted are still there by issuing this command:
dir bugfilename
... while still at the directory of the deleted bugs.
Again, thanks a lot.
RESTART RESTART RESTART AFTER YOU DO IT !!! IT WORKS !!! THANK YOU !!!
I have a virus wmsetup.dll, and everytime i try to access it through CMD, it denies me access. My virus scanner Prevx3.0 can't delete it. Help?
Have finally been able to remove a .dll which I hadn't been able to delete - basically found that it could be cut and pasted elsewhere, wouldn't let me delete it when I just in moved it to another folder, but would when I cut and pasted it to another drive (a data drive therefore no programs to run).
You can also use “System Restore†to remove the program at no cost. Click start, All Programs, Accessories, System Tools, click System Restore. Restore your computer to the day just before the program was installed. It worked for me, however, McAfee had to be reinstalled. I made a similar entry yesterday, but it must have been deleted by accident.
i constantly have an error message that pops up about a file winrnr.dll and says it is unable to run with this version of windows or an error in downloading has occurred. i went through this whole process and when i get to the part to unregister it an error message comes up that says
The module "winrnr.dll" may not be compatible with the version of windows that you're running. Check if the module is compatible with and x86 or x64 version of regsvr32.exe.
I dont know if the winrnr.dll is a virus or what but i can't even open the file or find out any information about it. It just says there was an error while downloading it or something
I cannot locate the spyware-folder or total-security anywhere... the only directory I find is Documents and Settings for our computer, and the above prompts reply "the system cannot find the path specified". I don't know what to do!
hi..
nice to find such support..
my spyware is tracing ZIMF.dll in system32\driverstore\filerespository\hplj1020.inf_d8a03872\zimf.dll
I think it was created while installing HP Laserjet 1020 printer, since its is tracked by spyware, m trying to remove it but all efforts r waste.. msg appeared:: "The module "ZIMF.dll" was loaded but the entry point dllunregisterserver was not found."... Make sure that "ZIMF.DLL" is a valid DLL or OCX file and then try again.
pl tell wat r its impact on system performance and how can it b removed..
best regards,
AV
thank you all, i had 2 dll files linked to a protection system virus that couldnt be removed. i CHANGED NAMES of these two files and then erased them easily. the only remaining thing to do was to erase manually all other files located in the Protection System folder in my computer and finally stop psystem.exe, that was still running, and erase it manually as any other file!
my pc is infected with dbgeng32.dll , i tried deleting it but it says file not found. Can anyone help?
My O/S is WinXP SP2, there are some files which are virus effected. The O/S id NTFS, therefore I am not able to see or delete the infected file which was available in DOS.
Now Please give me your suggestion that how can I do this & with what procedure. This should be such that it should not affect the current version.
Thanks.
Hi. I can't install Tony Hawk's American Wasteland cause of the 2908 error.
I deleted mscoree.dll and removed net framework (I used cmd, task manager and add/remove files)
and I still can't install the game. I always get the same error.
if anyone knows how to solve this, please email me. Thank you!
P.S I have Windows XP professional Version 2002 Service Pack 3
Kevin
hello guys. my pc just been infected by the virus zwunzi, zwunzi.dll
how can i get rid of this virus? please help me!
email: veritasgeek@yahoo.com
I have zwunzi too. it is terrible. your PC is unusable basically you are unable to do anything your systems resources are maxed out. it takes 20 minutes to open a web page help us. it has been going onfor days... frustrating.... aaaaggghhhhh
I also have zwunzi am unable to remove using the manual method. none of my applications can even detect it. and i already made this post. it was here then it vanished why.. i actually saw it on here.. now gone..
I've found that if you still can't delete the file using the command prompt, the best thing to do is rename it. My example: regsvr32 /u
I've found that if you still can't delete the file using the command prompt, the best thing to do is rename it. My example:
cd windows\\system32
regsvr32 /u winhelper86.dll
The file was unregistered successfully.
DEL winhelper86.dll
Access Denied
Despite my attempt, it still registered as a denied file. So I decided to rename it.
rename winhelper86.dll spyware.txt
As a text file it is no more accessible, but it shouldn\'t be able to function either. A stop-gap measure, but better than nothing.
the same problem.. .DLL... the program it was looking for was uninstalled already, yet looking for its ocsetu~1.DLL. pls. help...tnx
Followed the instructions and got a positive message. However the file is still there, and when I try to delete it I get "Access Denied". Any solutions?
Actually, I managed to get rid of the file, but for some reason "iexplore.exe" restarts in my task manager. The IE application doesn't show but it shows in running processes. Any thoughts on that?
Hello, I tried using this method in deleting airaetv.dll, and it is showing the same error message that everyone else is getting. I have AVG and it detects it, but everytime I try to delete it with AVG on a reboot, it keeps coming back, along with gmqlpzym.dll. AVG won't delete it, and is blocking my internet connection with its firewall. Help please.
I'm trying to uninstall PC Doctor Spyware and I can't because of dll files. How can I get rid of something I don't want?
So when I open ANYTHING I get the error that reads "rundll32.exe - Bad Image" on the top blue bar and then it reads "The application or DLL C:\WINDOWS\system32\yelesato.dll is not a valid Windows image. Please check this against your installation diskette." When I press ok the program opens. I have run my anti-virus program without luck. Please help....
i have Trojan TR/NAS.210944
that's what avira antivir says..
it keeps shutting my internet explorer or mozilla.. it prevents access from the internet.
HELP PLEASE!
how do i remove it?
it's in C:\Windows\System32\sshnas21.dll
i tried to deleteit but it says access denied.
HELP PLS.
hey guys i have a problem...
everytime i try to run my anitvirus my computer always freezes at windowsformsintegration.dll i've tried three different types of antivirus software (AVG, pandasecurity, and Airva) i tried to delete it and access was denied i did it both in safe mode and normal mode. please help me
thanks.
i got a 'TR/Hiloti.47616.D.24' [trojan] in my 'C:\WINDOWS\widmlt.dll' Folder. I also tried the method which is above mentioned. But it doenst works. It says widmlt.dll was loaded, but the DIIUnregisterServer entry point was not found.
Can someone help me?
So when I open few applications I get the error that reads “namefile.exe – Bad Image†on the top blue bar and then it reads “The application or DLL C:\WINDOWS\system32\qqvwnva.dll is not a valid Windows image. Please check this against your installation diskette.†When I press ok the program opens. I have run my anti-virus program without luck. Please help….
Same here as above - Unregister yfcrcwl.dll does not work (Access Denied)
It does not work in safe mode (Access Denied)
It does not work wih explorer shut down (Access Denied)
Cannot rename it (Access Denied)
Cannot Overwrite it (Access Denied)
Well you all get the idea I guess, so what to do ?
Another file I have seen mentioned above was possible to delete - sshnas21.dll
To delete this meant searching through the registry - Search for sshnas21 and delete every instance of it, you will then be able to delete the .dll from system32 folder
I did all of the introduction but i got this.
Cmd command
:::::::::::::::::::::::::::::::::::::::::::::::::::::
C:\isafeallinonekeyloger>dir
Volume in driver C has no label.
Volume Serial Number is 38D6-62A8
Directory of C:\Downloads
10/20/2010 10:56 AM .
10/20/2010 10:56 AM ..
0 File(s) 0 bytes
2 Dir(s) 278,626,304 bytes free
:::::::::::::::::::::::::::::::::::::::::::::::
Where is the File to unregister? It doesn't show the dll files name.
please help !!!
Thanks
Leapheng
PLEASE HELP
Am trying to get rid off few sticky dll's
Followed the above instructions:
C:\Program Files\Orbitdownloader>regsvr32 /u idht.dll
and got the below massage (for others as well):
'regsvr32' is not recognized as an internal or external command,
operable program or batch file.
Thanks in advanced
hi this is jeet .. i follow the instruction such kind of above .. but i didnt find the dll file in my lappi/........
Hi,
I tried deleting and i got the message unreg successful but yet when i try to delete the folder from Program Files,I am unable to delete it and it says Unable to delete snxPlugins.dll
what do i do now.
Help Me Please
there is one more option u can change the extension .dll to .bak and restart ur pc and delete the file it works
dude u r a life saver!!!! ty so much !!!
DLL files were forever a mystery for me that what they were. Thanks a lot for remove my ignorance. I have try this and I have to say its magic. I am actually feeling very relaxed now.
hi I am trying to delete a dll file and am unable to, tried a few things suggested but message is same "not recognised as an internal operated program or batch file"...anyone help please
SteveO
I have a useless DDL. i was using for a computer game, i actually have the dll on my desktop because i forgot what/who/when it got extracted there
I did the command prompt, didn't work. I appreciate the help!
You can definitely see your expertise within the work you write. The arena hopes for even more passionate writers like you who are not afraid to say how they believe. All the time go after your heart.
It wont let me open up host in any way. Any help?
To the point and well written, I appreciate for the info
I am new at this, there was no Cancel Reply box, just Submit Comment. Good of vima to mention about the ommitted "not". Another thing since I am behind on my bill payments do telephone service providers install spyware and malware on slow payers?
It worked! Only thing not mentioned was I had to do it in SAFE MODE.
I constantly get an message which says MBR Rep.exe. Bad image on blue bar and the application or DLL C:/WINDOWS/ system32/MSIMG32.dll is not a valid windows image. please check this against your installation diskette. pl help me how to get rid of or solve the problem. also get message mmc.exe-Bad image on blue bar DLL C:/WINDOWS/ system32/MSIMG32.dll when I try to defragment. I have Windows xp sp3 installed.
I managed to delete framedyn.dll by accidentally and now cant use google crome, can't download updates and hardly anything works right!!!!! tried to restore system files tried re-installing updates,>>>>>>>>>>>>Please HELP
You need to run the windows repair tool that can make the difference when you are not able to fix the DLL file error then running Windows repair tool can fix and restore all the windows DLL files to the original version. If this cannot fix the DLL error then you need to use the PC cleaner software to fix the DLL error with the help of PC Repair Tool that detects all the errors invalid, corrupt damaged registry entries that rises the DLL errors and fix it automatically and enhances the performance of the system
I'm having a problem with "sessapart.dll" its blocking the battlefly to run. I'm having trouble with this. I'm not even able to disable it. Its getting into my nerves. Its showing me "The module "sessapart.dll" was loaded but the entry-point DllUnregisterServer was not found. Make sure that "sessapart.dll" is a valid DLL or OCX and then try again." Please help me. I'm not even sure that its a legal file.