RunDLL message regarding _c007601f.dat

[LDD15]

I have been cleaning up a computer for someone who got a couple of virus' and
some spyware. The virus software found the following files and is unable to
clean them:
-c:\Windows\System32\_c0064d4.dat
-c:\Windows\System32\_c007601f.dat
-c:\Windows\System32\_008317f.dat

The virus scan has the files in quaranteen or vault and are indicated as
infected.

Everything seems to be working fine except that on boot I receive a message
that indicates that the module c:\Windows\System32\_c007601f.dat can't be
found.

Questions:
Is this a necessary windows file?
If not, how can I determine what is calling for the file and remove the call?
If so, how can I restore a clean version?
Finally, should I worry about the fact that so far the other files have not
been called for?

Thanks.

 

[Detlev Dreyer]

I have been cleaning up a computer for someone who got a couple of virus' and
some spyware. The virus software found the following files and is unable to
clean them:

"Cleaning a Compromised System"
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

 

[Elmo]

I have been cleaning up a computer for someone who got a couple of virus' and
some spyware. The virus software found the following files and is unable to
clean them:
-c:\Windows\System32\_c0064d4.dat
-c:\Windows\System32\_c007601f.dat
-c:\Windows\System32\_008317f.dat

The virus scan has the files in quarantine or vault and are indicated as
infected.

Everything seems to be working fine except that on boot I receive a message
that indicates that "the module c:\Windows\System32\_c007601f.dat can't be
found".

Questions:
Is this a necessary windows file?
If not, how can I determine what is calling for the file and remove the call?
If so, how can I restore a clean version?
Finally, should I worry about the fact that so far the other files have not
been called for?

Thanks.

A Google Groups search showed no mention of that file, other than your
post. That suggests that some malware was removed (quarantined in your
case), but the reference to the file was not removed from the registry.

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file into the search pane. Click "Find Next", and
when located, delete the reference to the file. Press F3 to continue
the search.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

You could click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.