missing .dll files

[slakk]

Hi,
I have a computer that has a messege that pops up everytime they log into there computer that they are missing .dll files. What is the best solution to fixing this messege?
I will post back with the exact messege when I find what it was again.
thanks

 

[IllogicallyLogical]

http://support.microsoft.com/kb/555375

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#

 

[linney]

If it is a genuine missing .dll message referring to a Windows file you can try running the System File Checker.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

If it is malware related try these.

Malwarebytes' Anti-Malware

http://www.malwarebytes.org/mbam.php

SuperAntispyware

http://superantispyware.com/

 

[slakk]

hi linney,
The exact messege that pop ups when I log into a certain user account is
error loading C:\DOCUME~1\USER~1.USER Specified module could not be loaded.
It pops up two messege windows saying that missing .dll files. ufkemt.dll and xdmwygmf.dll are the two says that it is missing. They are located in
C:\Documents and Settings\User\localsettings\Temp that is where I think I found them. Have to look again to make sure.
The user said that right before they started getting the pop up windows upon logging in. They where on the internet surfing and a windows just started opening up lots of them, they shut the computer down right away. Now that messege comes up whenever they log in. I did a scan with symantec antivirus corporate edition, didn't find anything. I was wondering if I could just delete those .dll files if they are in the temp directory or would that make matters worse. Would spy bot or adware be able find anything if my system is infected. Nothing else unsual happening though computer works fine for that user execpt for the missing .dll messege upon logging in.
thanks
slak

 

[BadBigBen]

Probably was a good idea to shutdown when that happened... but it was not fast enough, for it to install enough of the malware, where it tries to load stuff... that is the reason why you are getting the messages...

download Malwarebytes' Anti-Malware, and have it scan the PC...

MBAM

http://www.malwarebytes.org/mbam.php

Super AntiSpyware probably would also be a good idea...

http://www.superantispyware.com/

PS: anything starting from the TEMP folder at boot is a NO GO... So delete those files ASAP, then run the above two tools to make sure that it is pretty clean...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[slakk]

hey ben,
Thanks for the advice, I will try that malware bytes, if I use the free version will it still remove things it finds? It is not one of those free scanners that will find a whole bunch of things and then require you to buy the product to remove them? I have used superantispyware before, so I will give that a try.
thanks
slak

 

[linney]

Anti Malwarebytes is a very reputable program, it will do the job for you to the best of its' ability. We try not to recommend dodgy programs in the forum but you are right to be concerned as there are enough of them out there vying for your dollars. Some of them are worse than any malware you may already have.

 

[BadBigBen]

Linney, basically summed it up...

the difference between the free version and the paid version is, I believe, the background checking...

so it is safe to use and will not ask you to cough up cash to remove the baddies... ;-)

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[slakk]

Hi,
This is what is exactly what is coming up when a certain user logs in:
RUNDLL
Error loading C:\DOCUME~1\username\LOCALS~1\TEMP\ufkemt.dll
The specified module could not be found
That is the first window, second one says:
RUNDLL
Error loading C:\DOCUME~1\username\LOCALS~1\TEMP\xdmwggmf.dll
The specified module could not be found.

I went to the directory c:documents and settings\user\temp\local\temp but could not find either missing dll file there and I am showing hidden files.

When I did a search with for the files using Windows search it shows that they are quaranteen by symantec antivirus corporate edition.

I also had a window pop up from symantec antivirus protection scan saying it found virus name trojan.Vundo
Could this be the source of the missing .dll files pop up messege. I did a scan with malwarebytes, it found 4 objects but nothing about any trojan.vundo virus.

What should I do to rid this of the poping up window of missing .dll files?
Thanks,
slakk

 

[Lemon13]

removal tool for trojan.Vundo

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112210-3747-99

M. Knorr

MCSE, MCTS, MCSA, CCNA

 

[kjv1611]

slakk,

Notice that it's trying to open things from a temp directory. That's not good. The good news is that the temp files were apparently already deleted - so if it is malware, it's got a bug in it that's causing it not to run correctly... or so it sounds.

You could also try these 2 tools to help clean up in general - they scan for some spyware as well:

IObit Advanced System Care

Glary Utilities

And then also for cleaning any temp folders missed by any other apps:
CCleaner

--

"If to err is human, then I must be some kind of human!" -Me

 

[slakk]

hello,
I downloaded the trojan.vundo removal tool from symantec, or also known as FixVundo.exe.I disconnected the ethernet cable as the instructions said to do. Then ran that program from the administrator account and the results where Trojan.Vundo has not been found on your computer. Following instructions it said to reboot into safe mode if it does not appear to remove the threat. Tried pressing f8 upon startup wouldn't work. Went and used msconfig to boot into safemode and ran tool there, but same messege came up as before Trojan.Vundo has not been found on your computer. I was googling around for similiar problems and found a forum with exact same problem, but I guess that you are suppose to disable auto protect, then boot into safemode and run tool again. I didn't get a chance to try that yet. I am not really sure why disabling symantec auto protect and running the tool will find the virus.

I am thinking that trojan.vundo is behind the missing .dll files messeges. Hopefully ;0
thanks,
slakk

 

[BadBigBen]

ufkemt.dll = Vundo...

but as mentioned, it probably did not install all the way when it was SHUT DOWN forcible and thus most traces are not to be found...

but DL GMER and post it's LOG here:

http://www.gmer.net/

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[slakk]

Hi,
Ben, So All I have to do is download gmer and run it then save a log file to post. I have never used gmer or even heard of it before.
Thanks,
slak

 

[GabrielBL]

In more than 12 years of working on computers, I’ve never moved .dll files from one Windows computer into another to resolve an issue. My suggestion is probably the most drastic and / or the most painful, but will eliminate the problem. Pull the drive, put it in an external enclosure, back up the important data to another computer and run virus scan on it. Reinstall the drive, install a fresh copy of XP.

Gabriel Blanc-Laine
VP Sales & Marketing

http://www.Qtask.com

 

[SolarOnline]

I'd have to agree with GabrielBL sometimes the simplest solution is formating and reinstalling the OS.

ipMonitor & Kiwi Syslog Server 9 - Online Representative operating on behalf of SolarWinds, LLC