Deleting .dll's from Tools-System Start Up

[Twonk]

Hi, I have the remnants of some dodgy .dlls in system start up that were associated with a virtumonde virus I had a while ago, they are still there in bold despite seemingly being cleaned off everywhere else on the system (I hope).

I have tried deleting them from within S&D tools - system start up but they won't go away!

Please advise how too delete or if i should just ignore them, I have daily anti-virus, anti-spyware scans set up (AVG) and updated S&D last week and did a full scan and no problems are detected.

Thanks,

[spybotsandra]

Hello,

Please download the latest detection update (2007/02/14):
http://www.safer-networking.org/en/download/index.html
This should fix it.
Or choose the direct installation file:
http://www.safer-networking.org/upda...d_includes.exe

If this doesn't solve the problem please send us your *complete* Spybot bug report: Run Spybot - Search & Destroy and switch to Advance Mode via the menu item Mode, let it scan, try to fix the problems (!) and then go to "Tools --> View Report". Tick on all of the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to your email and send it again to detections(at)spybot.info.

Best regards
Sandra
Team Spybot

[Twonk]

Hi Sandra,

Thanks for replying, perhaps I haven't expained myself very well.

I have already removed the .exe that was reproducing the .dlls and deleted the .dlls off my system and the virus no longer appears to be present, ms process explorer and avg anti virus/spyware software show no traces of the .exe or the .dlls

My query is why the .dlls still appear ONLY in Spybots Tools/System Start Up and can't be deleted from there, although having said that they don't seem to be doing anyharm, they are unchecked and nowhere else to be found on my machine which is strange?

Hope that explains it better,

PS. I updated & ran spybot scan couple of days ago no threats found.

[Twonk]

Bump anyone?

[Twonk]

Bump again :-)

[spybotsandra]

Hello,

Seems like there is still something left.
Perhaps you have just deleted the startup dll's - and there are still some active prozesses. A report would help.

Best regards
Sandra
Team Spybot

[Twonk]

Hello,

Seems like there is still something left.
Perhaps you have just deleted the startup dll's - and there are still some active prozesses. A report would help.

Best regards
Sandra
Team Spybot

Thank you,
I can see no active processes anywhere, ms process explorer show non of these .dlls it did when the lop.AH pop up warning was happening but now it all seems gone except the .dlls are still showing in spybot system tools start up (NOWHERE ELSE!) that's what confuses me? (they are bold and unchecked)

What report would help you understand this better?

[spybotsandra]

Hello,

Please download HijackThis: http://www.downloads.subratam.org/hijackthis.zip
Double click HijackThis.exe.
Just start the program.
Hit Scan.
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Please mail that log to our detectives at detections(at)spybot.info.

Best regards
Sandra
Team Spybot

[Twonk]

Hello,

Please download HijackThis: http://www.downloads.subratam.org/hijackthis.zip
Double click HijackThis.exe.
Just start the program.
Hit Scan.
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Please mail that log to our detectives at detections(at)spybot.info.

Best regards
Sandra
Team Spybot

My HJT log is clean that is why I am asking why are the .dlls still showing in Spybot 'Tools' 'System Start Up' even though the Trojan Lop.AH .exe program and the .dlls it produced have been killed?

PS. I have also cleared volume information as well to make sure nothing hidden in there, as far as I can tell my pc is clean apart from these 'dead' .dlls in spybot system start up, as I say they are absolutely nowhere else to be seen does the snapshot need refreshing or something?

[md usa spybot fan]

Twonk:

If you would like an answer to your question, I fail to understand why you are refusing to provide any of the reports that spybotsandra requested or even name the .dll file(s) that you are unable to delete from Spybot's System Startup listing.

In the first response to your post, spybotsandra asked for a SpybotSD.Report that would have shown the System Startup entries that you are trying to delete as well as other information about your system. You dismissed her request with:

… perhaps I haven't expained (sig) myself very well.

… I updated & ran spybot scan couple of days ago no threats found.

The fact that you ran Spybot and found not threats has nothing to do with providing the information required to trace the source of your problem.

If you would like to get to the bottom of the problem that you are having, I strongly suggest that you follow the instructions that spybotsandra posted here:

• http://forums.spybot.info/showpost.p...13&postcount=2

As an alternative you can trace source of the startup entry in Spybot's System Startup listing by looking at the following guide that indicates were startup entries can be located and trying to figure out why the entry can not be deleted or is reestablishing itself:

• A Collection Of Autostart Locations, by Tony Kleinkramer
  http://forums.subratam.org/index.php?act=ST&f=29&t=1063
  
  A printable version of the same topic:
  
• A Collection Of Autostart Locations, by Tony Kleinkramer
  http://forums.subratam.org/index.php...er&f=29&t=1063