Error after running spybot and then restarting...

[Jim43]

I ran spybot search and destroy because I picked up some mal-ware that was hitting me with pop up ads every couple minutes or so, after I ran the program and restarted and ran it again, then restarted again, I got the following error message with a big red X:

"Error loading: c:\windows\system32\denekilo.dll
The specified module could not be found."


SpyBot removed something called "Virtumonde" and there's 3 different instances: "Virtumonde.sdn" "Virtumonde.dll" and "Virtumonde.prx" each with a "+" that when clicked reveals more files.

Under the last one "Virtumonde.prx" when I click the "+" it shows me (among others) the file that I am getting the error message for "c:\windows\system32\denekilo.dll"


^So, Should I restored this file?

SpyBot also removed something that said "Microsoft.WindowsSecurityCenter.FirewallBypass"



PleaseNote: besides the error message at startup, my system seems to be running fine, in fact faster then before but I have only just now received the error message so I don't know if everything is ok or not, and the error message occurs each time I boot up.


Thank you for any help you can provide, this is my first time running into adware and first time using spybot, I know where I received the infection, from a site I do not like and very seldomly visit but was sent there via a link, it was: "http://projectcovo.forums.com"

[Jim43]

also I received the infection when my mouse dragged across some highlighted text in a forum post which triggered an advertisement, I think clicked the x to close the advertisement and it closed it.

But shortly after that I started getting popups on every site I visited.


Do I need to post a high-jack this log somewhere?


forgive me I tried to read through all the instructions but I don't comprehend so well when there's so much information, I don't know what a "hijack my log" is or anything like that very foreign to me, sounds like a virus is going to hijack my computer if I download that.

[tashi]

Hello Jim43,

Do I need to post a high-jack this log somewhere?

forgive me I tried to read through all the instructions but I don't comprehend so well when there's so much information, I don't know what a "hijack my log" is or anything like that very foreign to me, sounds like a virus is going to hijack my computer if I download that.

A HJT log is posted for a preliminary analysis by one of our volunteer helpers in the Malware Removal Forum The program won't hijack your computer.

Instructions are here: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Hope that helps.

[Jim43]

hmmm, thanks.

but what about my question?


My question was relating to the "specified module cannot be found" error message I'm receiving on boot up.

[tashi]

Hello Jim43,

"Error loading: c:\windows\system32\denekilo.dll
The specified module could not be found."

It isn't unusual to receive such an error when "booting up" after using security scanning tools to remove a malware infection.

A HJT log is posted for a preliminary analysis by one of our volunteer helpers in the Malware Removal Forum The program won't hijack your computer.

Instructions are here: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

So if you could post a log for analysis in the malware forum someone will assist when available.

Best regards.

[Jim43]

so I can't just safely restore that file apparently?

it could have been tampered with or compromised?

thanks tashi!

[tashi]

Hi Jim43,

so I can't just safely restore that file apparently?

it could have been tampered with or compromised?

denekilo.dll is seen in Vundo infections so no you don't want to restore it.

I see you have started a topic in the malware forum. http://forums.spybot.info/showthread.php?t=55905

I did remove the two posts after the HJT log as,

Posting additional comments or logs before a volunteer responds, can push you back instead of forward, because your thread ends up with a newer date. In addition helpers would think you are already being assisted because of the post count.

"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

The log alone is sufficient for a preliminary analysis plus you included a link back to this thread for reference.

Cheers,

[tashi]

Hello Jim43,

IndiGenus has responded to your malware forum topic: http://forums.spybot.info/showthread...324#post362324

Best regards.