Windows XP Rundll error - please help

[llblawyer]

Hi please help. I managed to download a virus the other day and in the process of trying to rid myself of it have caused some further problems. When I turn on the computer now it starts up and I get a little screen saying

Rundll
Error loading w004234b.dll
The specified module could not be found

I have no idea what it is or how to rectify it. I guess I've deleted something I shouldn't have but how can I sort it out or stop this coming up.

Thanks for any help!

 

[arbour]

What Anti-Virus software are you running?

 

[llblawyer]

you name it i'm running it, well it feels like that anyhow. Have "spyware doctor" and norton although subscription expired still scans etc and downloaded free AVG aswell which seems to be working but am not sure if have got rid of the Trojan that i managed to download.

 

[muckshifter]

You do not want to be runing two AV programs at the same time. Install one or the other, but not both.

Download & install run CCleaner be careful NOT to install the Yahoo toolbar, just un-tick the install box for it.

Install, update & run ...

SpywareBlaster
MS Windows Defender
Ad-AwareSE
Spybot - Search & Destroy

... you can find these programs HERE


AVG is better than Norton, in my opinion, and you should also be using a Firewall.

Have fun!

 

[llblawyer]

Hi I think I've got a windows firewall? If I dump Norton will that delete my firewall it appears to all come up on the same screen?

 

[muckshifter]

Hi I think I've got a windows firewall? If I dump Norton will that delete my firewall it appears to all come up on the same screen?

Windows Firewall is Windows Firewall, not that good ... depends on what version of Norton you have as to whether it has a Firewall.

N I S ... Norton Internet Security, which is a joke, has a built-in firewall ... Norton Antivirus, does not.

As with an AV program, one firewall is enough, ZoneAlarm or Sygate Personal, both free, are of the best firewalls on the market ...

 

[llblawyer]

thanks will try the things you've advised hope you don't mind if i get back to you if I cannot get rid of this error! Thanks

 

[llblawyer]

Have done all mentioned and now have no norton, zonealarm firewall and avg anti virus however this is not getting rid of my start up message which is really concerning me

RunDll
Error loading w004234b.dll
The specified module could not be found

Any more ideas please?
Thanks

 

[muckshifter]

Have done all mentioned and now have no norton, zonealarm firewall and avg anti virus however this is not getting rid of my start up message which is really concerning me

RunDll
Error loading w004234b.dll
The specified module could not be found

Any more ideas please?
Thanks

I can find no reference on the Internet to "w004234b.dll" ... CCleaner is pretty dam good at getting rid off left over junk.

At this stage it is not a worry to me as it doing no harm, but something is on your PC trying to "call" that .dll file ... you ran ALL those programs I pointed out to you? Sorry, but Windows needs more than one program to protect it and most people here will be runing everyone of them, myself ex-cluded.

Can you tell me the original name of the Virus?

 

[llblawyer]

Hi Not sure of exact name unfortunately as panicked and tried to get rid of stuff without noting it all down, I know Trojan kept coming up in files and so did "backdoor. rbot. Gen" also "Dollarrevenue" and "VX2.Look2me" But seem to have got rid of all these things for the moment just this stupid message coming up although the computer keeps doing things without being told to so i think there's still something here!! This is such a pain, i'm not brainbox where this is concerned and just feel i'm going to have to crash the lot to get rid of this. Cheers for the help!

 

[muckshifter]

ah, better

I'll just point out here for all the 'lurkers' reading this thread that a Trojan is NOT a Virus and sorry to say most AV programs do not detect all Trojans.

Some more info' HERE and some more general info' HERE ... you see how things are further confusing when AV vendors have different names.

OK, I need some help here ... please download HijackThis and install it to it's own folder, run it and post a log-file here.

We'll take a look and see if we can't pinpoint the problem.

 

[llblawyer]

Hi appreciating your time on this one, have downloaded hijack this and the log file is as follows. hope it throws some light on it for you as just had a warning for something but don't know what "trojan horse Downloader.Generic 2.HTV" with lots of numbers etc.

Logfile of HijackThis v1.99.1
Scan saved at 19:39:07, on 05/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/broadband
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P32 "EPSON Stylus C46 Series (Copy 1)" /O6 "USB002" /M "Stylus C46"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto EPSON Stylus C46 Series on HAL2000] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P39 "Auto EPSON Stylus C46 Series on HAL2000" /O18 "\\HAL2000\Printer2" /M "Stylus C46"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [jyl58d57] RUNDLL32.EXE w004234b.dll,n 00258d550000000a004234b
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: WKCALREM.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/broadband
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-30.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144062495300
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.tescophoto.com/wpp/tesco//app/opcuploader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup162.cab
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\guard.tmp (file missing)
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\l0p2la7o1d.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Thanks
Katherine

 

[muckshifter]

Oh, did I tell you I hate Sony ... but we'll leave that for another rant.

Well, you'll be pleased to know there is nothing really 'nastie' lurking on your PC that HJT can see

OK, I want you to "fix" these ...

O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/downloa...abasetup162.cab
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\guard.tmp (file missing)
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\l0p2la7o1d.dll (file missing)


reboot and let me know ... but I cannot see where this is hiding.

 

[llblawyer]

sorry to be really stupid but how do i "fix" them, is that using the hijack thing again and asking it to do it. sorry stupid novices i know!! Sorry about the sony too!!

 

[llblawyer]

hi have also downloaded Windows Defender but it says it can't complete because of 0x80244001 what is going on!

 

[muckshifter]

sorry to be really stupid but how do i "fix" them, is that using the hijack thing again and asking it to do it. sorry stupid novices i know!! Sorry about the sony too!!

Yes, sorry ... run HJT again and put a tick in the boxes corisponding to the things I've pointed out.

I just noticed you wrote ... "just had a warning for something but don't know what "trojan horse Downloader.Generic 2.HTV" ... looks like we need more help.

Download this guy ... http://www.intermute.com/products/cwshredder.html ... and run it also.

Then, I want you to run ALL those programs again, but this time re-start your PC in Safe Mode ... go to restart, when the PC is restarting, you have to be quick and keep tapping the F8 key untill you see a new screen ... then pick Safe Mode.

It does look as though you have a little 'nastie' hiding away on your PC

 

[muckshifter]

hi have also downloaded Windows Defender but it says it can't complete because of 0x80244001 what is going on!

Never rains but it pours ... aaggghhh

Click Start / Choose Run / In the Run box, type regsvr32 MSXML3.dll / Click OK.

Oh boy!! I need a coffee ...

 

[crazylegs]

Muck's rather you than me....you have the patience of a saint....

 

[muckshifter]

Muck's rather you than me....you have the patience of a saint....

Saint I ain't ... patience = time ... but I'll still be in bed at 11.30 by the latest, Docs orders.

No disrespect meant to llblawyer, but when I ask people to use certain software it is for a reason ... if you do not follow my advice, we may as well pee into the wind.

There is definitely something on that system ... need to find the bugger.

 

[llblawyer]

hi sorry didn't download all the programs you said straight away, am still ploughing through trying not to mess it all up completely, have downloaded and run Ad aware and it's found "win32.Trogan downloader" AND "winantivirus pro" which says it needs quarantining which I am pressing to do but doesn't appear to be doing anything. Have one more program to run then close it down etc and run in safe mode but there is something there i guess. Apologies again for not more closely following your advice immediately.
I really appreciate all you are doing to help with this, really don't want to lose all my work etc, am trying to back all that up aswell as sort this out but my dvd drive is not wanting to work properly either, guess it's all part of the same problem. Thanks will keep going!!
Katherine