Windows solutions

mitcorb

I thought I would share this little experience with you all.
A recent malware invasion- a search engine hijacker- prompted my security application to quarantine something that causes a RunDLL error alert at boot up. See attachment.
Could be coincidental what the cause is.
But what is laughable is either my ignorance or the choices available to me when the alert pops up. You get to click OK, or the red X button in the upper right corner.

Try to talk to the Microsoft glacier? Gimme a direct phone number. This is the year 2012. This is Windows 7, not 3.xx They anticipated the need for the alert box. How about further instructions.

pbacot

not a windows person myself, but I thought slashes were always forward. But what to do?

Krisidious

local system slashes are backward, internet slashes are forward.

EscapeArtist

I would consider starting the computer in safe mode and going to Add or Remove Programs, then looking for the offending software that caused the problem and see if there is a leftover uninstaller available and try uninstalling it there. It seems the malware may be looking for a .dll that was deleted when the rest of it was deleted. There may be a portion of it left over that is seeking parts of itself to reinstall or continue operating.

If you know the name of the program that was causing the error, check the Task Manager CTRL+SHIFT+ESC and look for a process with the same name and kill it. Also check services (Services.exe) and see if anything is running there by the same name. Stop the services with the name. Look for a directory on the computer where the app was installed and delete the directory.

If you're not into digging around in your computer, try:

CCleaner
Ad Aware
Spybot S&D

All of these are free. The can be uninstalled after you are finished with them. Do not run them at the same time, I've had Spybot and Ad Aware cause issues in XP when I did that. Haven't tried it in Win 7 yet, but I don't want to have to break something as an experiment.

Also, make sure you have Microsoft Security Essentials turned on and updated.

Was there no file specified when the error popped up?

Paul Russam

I'd add Malwarebytesto that list.
Install it, update it(automatic) set it running on a FULL scan and go to bed.
If there's anything awry this will find it and kill it.
If it finds anything then it may take 2 couple of reboots/scans to properly clean out the stuff but it works.

Another alternative is Combofix. Its a lot rawer (is that a word?) than Malwarebytes but can (I understand) dig deeper.

mitcorb

@Jeff: Thanks. No filenames beyond what you see in the alert box. That's part of the issue. And I did search the registry, but my research suggests that the bad agent used a string of gibberish and not any recognizable values, so I didn't touch anything.

@Paul: Thank you, also. I use CCleaner in default settings regularly. Some preach that this tool can be a problem. I can't determine if it might be a part of the problem.
I used to maintain both Adaware and Spybot on my XP machine, but never in autorun mode for either.
Combofix is a tool used by the folks over at Malwarebytes forum.
I have been through that movie before. I would say it is successful, but tedious.

One other possibility is that I contact the TechHelp for the security program I am running. I have to say this, they did their job and halted the offender.

Krisidious

I love my CCleaner... gotta be careful with it. registry cleaning and such. but I love it.