I'm getting errors when booting up

  • Thread starter Thread starter Ross
  • Start date Start date
R

Ross

Windows system32\yswlxfaj.dll missing and also C:\windows\vxijohowobozeye/dat
missing.

Any ideas out there?

Thanks

Ross
 
You're seeing the effects of a hijackware infection!

NB: If you have no anti-virus application installed and/or the machine's not
been kept fully-patched at Windows Update, don't waste your time with any of
the below: Format & reinstall Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
 
The date and time was Monday, April 27, 2009 12:42:06 PM, and on a whim,
Ross pounded out on the keyboard:
Windows system32\yswlxfaj.dll missing and also C:\windows\vxijohowobozeye/dat
missing.

Any ideas out there?

Thanks

Ross
Click to expand...

Hi Ross,

You probably cleaned out an infection and the files are gone but still
remain in the registry. You could search the filenames from within the
registry and remove them.

Or download Autoruns, launch it and locate the file entries and right
click on them and select Delete.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx


Terry R.
 
Ross said:
Windows system32\yswlxfaj.dll missing and also
C:\windows\vxijohowobozeye/dat
missing.

Any ideas out there?

Thanks

Ross
Click to expand...

This is most likely the result of a virus/malware infection that your
antivirus program killed. However, the references to the infection are still
in the system, hence the warning messages. Click Start / Run / msconfig.exe,
then examine the items under the Startup tab carefully. When you find the
culprit, untick it. You don't risk anything by unticking the wrong item -
you can easily restore the tick later on. Don't untick your anti-virus
program!
 
Terry R. said:
The date and time was Monday, April 27, 2009 12:42:06 PM, and on a whim,
Ross pounded out on the keyboard:


Hi Ross,

You probably cleaned out an infection and the files are gone but still
remain in the registry. You could search the filenames from within the
registry and remove them.
Click to expand...

Slight correction: You wrote "the files [..] still remain in the registry"
but you probably meant to write "the files are gone but their references
remain in the registry". The registry does not contain any files.
 
Ross

They are remnants of a malware infestation. Use Autoruns to remove the
orphaned start-up entries

To identify what loads when you boot use Autoruns (freeware from Microsoft).
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from
starting,or you can right click an item and then delete it. If you
uncheck youcan recheck to re-enable the item. It is a much safer
approach than editing the Registry and better than using msconfig..
Another useful feature of the programme is that you can right click an
item and select Search Online to get information about the item
selected.

Start by looking at the entries on the Srvicess tab. You could find it
there. It may have a note saying "File missing".

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
The date and time was Monday, April 27, 2009 12:57:19 PM, and on a whim,
Pegasus [MVP] pounded out on the keyboard:
Terry R. said:
The date and time was Monday, April 27, 2009 12:42:06 PM, and on a whim,
Ross pounded out on the keyboard:

Hi Ross,

You probably cleaned out an infection and the files are gone but still
remain in the registry. You could search the filenames from within the
registry and remove them.
Click to expand...

Slight correction: You wrote "the files [..] still remain in the registry"
but you probably meant to write "the files are gone but their references
remain in the registry". The registry does not contain any files.
Click to expand...

The second sentence you left of mine makes that pretty clear, referring
to filenames, don't you think? I agree I could have worded it a little
better for clarity. And yes, obviously the registry doesn't contain files.


Terry R.
 
Ross said:
Windows system32\yswlxfaj.dll missing and also
C:\windows\vxijohowobozeye/dat
missing.

Any ideas out there?

Thanks

Ross
Click to expand...

Yes, these messages are a Good Thing. They mean that your antivirus
software is working.

Your system was infected, and your A/V software detected the infection and
removed it - but did not remove the launcher reference. Look in MSCONFIG
to see where the reference is, and remove it.

You should be sure your system is fully up-to-date for patches and A/V
definitions, and re-scan the whole system, after doing the following...

I would suggest that it would be a good idea to download and run the free
tool ccleaner (www.ccleaner.com). Look for the 'other builds' link, take
the slim build with no toolbar. Install and run it on each user account.
It will clear the Temp and Temporary Internet Files folders in one step, and
this is likely where that malware entered your system.

Note that running ccleaner in its default configuration will remove things
like passwords for websites. You can configure it to save some of those,
but at this point, given that your system was or is infected, it's time to
clean house. On the upside, clearing these folders will also speed up
system scans as there will be thousands fewer files to scan.

HTH
-pk
 
Nota Bene (note well). Makes it more important than a simple PS.


NB: If you have no anti-virus application installed
Click to expand...
NB: Run the FULL scan, not the QUICK scan!
Click to expand...

Sorry PABear, I have to ask . . . What is "NB:"?
I keep seeing this and I'm too lame to figure it out for my self.
____ _
| __\_\_o____/_|
<[___\_\_-----<------------------<No Spam Please><
| o'
 
Back
Top