Error after running spybot and then restarting...

[Jim43]

I ran spybot search and destroy because I picked up some mal-ware that was hitting me with pop up ads every couple minutes or so, after I ran the program and restarted and ran it again, then restarted again, I got the following error message with a big red X:

"Error loading: c:\windows\system32\denekilo.dll
The specified module could not be found."


SpyBot removed something called "Virtumonde" and there's 3 different instances: "Virtumonde.sdn" "Virtumonde.dll" and "Virtumonde.prx" each with a "+" that when clicked reveals more files.

Under the last one "Virtumonde.prx" when I click the "+" it shows me (among others) the file that I am getting the error message for "c:\windows\system32\denekilo.dll"


^So, Should I restored this file?

SpyBot also removed something that said "Microsoft.WindowsSecurityCenter.FirewallBypass"



PleaseNote: besides the error message at startup, my system seems to be running fine, in fact faster then before but I have only just now received the error message so I don't know if everything is ok or not, and the error message occurs each time I boot up.


Thank you for any help you can provide, this is my first time running into adware and first time using spybot, I know where I received the infection, from a site I do not like and very seldomly visit but was sent there via a link, it was: "http://projectcovo.forums.com"

[Jim43]

also I received the infection when my mouse dragged across some highlighted text in a forum post which triggered an advertisement, I think clicked the x to close the advertisement and it closed it.

But shortly after that I started getting popups on every site I visited.


Do I need to post a high-jack this log somewhere?


forgive me I tried to read through all the instructions but I don't comprehend so well when there's so much information, I don't know what a "hijack my log" is or anything like that very foreign to me, sounds like a virus is going to hijack my computer if I download that.

[tashi]

Hello Jim43,



Do I need to post a high-jack this log somewhere?

forgive me I tried to read through all the instructions but I don't comprehend so well when there's so much information, I don't know what a "hijack my log" is or anything like that very foreign to me, sounds like a virus is going to hijack my computer if I download that.

A HJT log is posted for a preliminary analysis by one of our volunteer helpers in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) The program won't hijack your computer. :)

Instructions are here: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Hope that helps.

[Jim43]

hmmm, thanks.

but what about my question?


My question was relating to the "specified module cannot be found" error message I'm receiving on boot up.

[tashi]

Hello Jim43,


"Error loading: c:\windows\system32\denekilo.dll
The specified module could not be found."

It isn't unusual to receive such an error when "booting up" after using security scanning tools to remove a malware infection.



A HJT log is posted for a preliminary analysis by one of our volunteer helpers in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) The program won't hijack your computer. :)

Instructions are here: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)


So if you could post a log for analysis in the malware forum someone will assist when available. :)

Best regards.

[Jim43]

so I can't just safely restore that file apparently?

it could have been tampered with or compromised?

thanks tashi!

[tashi]

Hi Jim43,

so I can't just safely restore that file apparently?

it could have been tampered with or compromised?

denekilo.dll is seen in Vundo infections so no you don't want to restore it. ;)

I see you have started a topic in the malware forum. :) http://forums.spybot.info/showthread.php?t=55905

I did remove the two posts after the HJT log as,

Posting additional comments or logs before a volunteer responds, can push you back instead of forward, because your thread ends up with a newer date. In addition helpers would think you are already being assisted because of the post count. "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

The log alone is sufficient for a preliminary analysis plus you included a link back to this thread for reference. :bigthumb:

Cheers,

[tashi]

Hello Jim43,

IndiGenus has responded to your malware forum topic: http://forums.spybot.info/showthread.php?p=362324#post362324

Best regards. :)