Why can't I get rid of this?

[Guest]

Hi,

I'm new here so Hello. Can someone help? When I open my desktop I get two
messages. The first one says
c:\windows\system32\nwtdll32.exe
Windows cannot find 'c:\windows\system32\netdll32.exe'. Make sure you typed
the name correctly, and then try again. To search for a file, click the Start
button, and then click Search.
The second one says
Desktop
Could not load or run 'c\windows\system32\netdll32.exe' specified in the
resistry. Make sure the file exists on your computer or emove the reference
to it in the registry.
I have been on to other help websites and people have said its a Trojan. I
have run virus and spyware scans as suggested but nothing seems to help me
get rid of it poping up evertime I open up. I'm sure my computer is safe it's
just irritating that I can't get rid of them.

 

[Alan Edwards]

Remove the Registry entry or just disable it in Msconfig.

Check in Msconfig for any oddities.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

....Alan

 

[Mike Hyndman]

Hi,

I'm new here so Hello. Can someone help? When I open my desktop I get two
messages. The first one says
c:\windows\system32\nwtdll32.exe
Windows cannot find 'c:\windows\system32\netdll32.exe'. Make sure you typed
the name correctly, and then try again. To search for a file, click the Start
button, and then click Search.
The second one says
Desktop
Could not load or run 'c\windows\system32\netdll32.exe' specified in the
resistry. Make sure the file exists on your computer or emove the reference
to it in the registry.
I have been on to other help websites and people have said its a Trojan. I
have run virus and spyware scans as suggested but nothing seems to help me
get rid of it poping up evertime I open up. I'm sure my computer is safe it's
just irritating that I can't get rid of them.

This is definitely a virus infection caused by the Crymptera.A Trojan.
Try these free online scans: http://us.mcafee.com/root/mfs/default.asp
http://housecall.trendmicro.com/
http://www.pandasoftware.com/products/activescan/com/activescan

HTH
MH
remove -bats- to reply

 

[Guest]

Thanks Alan,

First let me say.. This is the first time I've used this site and I am
completly lost with most of the technical stuff. In my defence I had already
half tried what you suggested but because I was not sure of the buttons I was
pressing I sort of did what you said then undid it. I wasn't sure if I should
press apply or OK so pressed apply then when the system restarted it said
something about windows opening if a different way etc etc so I got worried
I'd done something wrong and ticked the items I'd unticked in the first
place. When I saw your post I thought come on this must be the right thing to
do so I did MSCONFIG again, searched for anything that had the same letters
in that the pop up messages had ie 'netdll32.exe' and there were 2. I
unticked these pressed OK then restarted. The message came up that windows
was in some mode or another and did I want to undo the changes I'd made so I
was brave and said no....... Now everything seems to be fine. Thanks so much.
Easy when you know how but if you don't know how.......
Thanks again.

Splange.

 

[Guest]

Thanks Mike,

Managed to sort it out after reading Alan's post but it's always nice that
other people try to help as well. I think I will look at the Panda site just
to see if I fancy it. I have already tried the others.

 

[PA Bear]

You're not out of the woods yet, I'm afraid.

Now find & remove the hijackware (Crypter.A trojan:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_CRYPTER.A)
that put nwtdll32.exe and net32dll.exe there in the first place!

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**